Bug 2277355
| Summary: | Spammed by abrtdumpjourn write errors | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Cristian Le <fedora> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | rawhide | CC: | dwalsh, knazekovan, lvrabec, mmalik, omosnacek, pkoncity, vmojzis, zpytela |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2024-04-26 15:16:46 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
*** This bug has been marked as a duplicate of bug 2265927 *** |
SETroubleshoot details: ``` SELinux is preventing abrt-dump-journ from write access on the sock_file io.systemd.Machine. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that abrt-dump-journ should be allowed write access on the io.systemd.Machine sock_file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'abrt-dump-journ' --raw | audit2allow -M my-abrtdumpjourn # semodule -X 300 -i my-abrtdumpjourn.pp Additional Information: Source Context system_u:system_r:abrt_dump_oops_t:s0 Target Context system_u:object_r:systemd_userdbd_runtime_t:s0 Target Objects io.systemd.Machine [ sock_file ] Source abrt-dump-journ Source Path abrt-dump-journ Port <Unknown> Host cfelm-pcx33660 Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-40.16-1.fc40.noarch Local Policy RPM selinux-policy-targeted-40.16-1.fc40.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name cfelm-pcx33660 Platform Linux cfelm-pcx33660 6.8.7-300.fc40.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Apr 17 19:21:08 UTC 2024 x86_64 Alert Count 1020 First Seen 2024-03-26 20:12:48 CET Last Seen 2024-04-26 14:34:06 CEST Local ID 998e790d-7550-4662-ad99-12be70db7276 Raw Audit Messages type=AVC msg=audit(1714134846.390:401): avc: denied { write } for pid=1300 comm="abrt-dump-journ" name="io.systemd.Machine" dev="tmpfs" ino=2445 scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=0 Hash: abrt-dump-journ,abrt_dump_oops_t,systemd_userdbd_runtime_t,sock_file,write ``` One curious thing reported on the Fedora Devel matrix room: "Not sure why a journal dumper is talking to that rather than journald though" Reproducible: Sometimes Steps to Reproduce: Probably not very reproducible, but here is how I've encountered it 1. Open Dataspell (jupyter notebook IDE by Jetbrains) 2. Start the Jupyter server and run the first cell. No errors or SELinux so far 3. Run the whole notebook, still not able to reproduce 4. Restart everything and try to run it all very fast to get memory issues and stuff 5. Get flooded by SELinux reports like those above