Bug 2277658
| Summary: | SELinux is preventing abrt-dump-journ from 'connectto' accesses on the unix_stream_socket /run/systemd/userdb/io.systemd.Machine. | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | hkoba <buribullet> | ||||||
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> | ||||||
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||||
| Severity: | unspecified | Docs Contact: | |||||||
| Priority: | low | ||||||||
| Version: | 40 | CC: | buribullet, chplee, decal_schnapps157, dwalsh, knazekovan, lvrabec, mmalik, omosnacek, pkoncity, robertjenssen, vmojzis, y9t7sypezp, zpytela | ||||||
| Target Milestone: | --- | ||||||||
| Target Release: | --- | ||||||||
| Hardware: | x86_64 | ||||||||
| OS: | Unspecified | ||||||||
| Whiteboard: | abrt_hash:a4b9eba7151e2cdf8c2b64af5d13d86ad9a70264adae2a52e146359914a9a02c;VARIANT_ID=workstation; | ||||||||
| Fixed In Version: | selinux-policy-40.18-2.fc40 | Doc Type: | If docs needed, set a value | ||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2024-05-12 04:17:55 UTC | Type: | --- | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Attachments: |
|
||||||||
|
Description
hkoba
2024-04-29 00:58:01 UTC
Created attachment 2029876 [details]
File: description
Created attachment 2029877 [details]
File: os_info
*** Bug 2279045 has been marked as a duplicate of this bug. *** *** Bug 2279104 has been marked as a duplicate of this bug. *** *** Bug 2279236 has been marked as a duplicate of this bug. *** FEDORA-2024-759c80369d (selinux-policy-40.18-2.fc40) has been submitted as an update to Fedora 40. https://bodhi.fedoraproject.org/updates/FEDORA-2024-759c80369d While reproducing this bug, I found that it occurs with Workstation, but not with Xfce.
With Workstation:
$ rpm -qa selinux\*
selinux-policy-40.17-1.fc40.noarch
selinux-policy-targeted-40.17-1.fc40.noarch
Test command:
$ date ; { sleep 60 & } ; sleep 3 ; kill -ABRT %1 ; date
Tue May 7 09:43:21 PM UTC 2024
[1] 4308
Tue May 7 09:43:24 PM UTC 2024
$
[1]+ Aborted (core dumped) sleep 60
$ sudo ausearch -ts 21:43 -m avc
----
time->Tue May 7 21:43:25 2024
type=AVC msg=audit(1715118205.191:390): avc: denied { connectto } for pid=875 comm="abrt-dump-journ" path="/run/systemd/userdb/io.systemd.Machine" scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:system_r:systemd_machined_t:s0 tclass=unix_stream_socket permissive=0
----
time->Tue May 7 21:43:25 2024
type=AVC msg=audit(1715118205.192:391): avc: denied { connectto } for pid=875 comm="abrt-dump-journ" path="/run/systemd/userdb/io.systemd.Home" scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket permissive=0
----
time->Tue May 7 21:43:25 2024
type=AVC msg=audit(1715118205.194:392): avc: denied { connectto } for pid=875 comm="abrt-dump-journ" path="/run/systemd/userdb/io.systemd.Machine" scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:system_r:systemd_machined_t:s0 tclass=unix_stream_socket permissive=0
----
time->Tue May 7 21:43:25 2024
type=AVC msg=audit(1715118205.194:393): avc: denied { connectto } for pid=875 comm="abrt-dump-journ" path="/run/systemd/userdb/io.systemd.Home" scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket permissive=0
On Workstation: $ ll /run/systemd/userdb/ total 0 lrwxrwxrwx. 1 root root 42 May 7 21:25 io.systemd.DropIn -> /run/systemd/userdb/io.systemd.Multiplexer srw-rw-rw-. 1 root root 0 May 7 21:25 io.systemd.DynamicUser srw-rw-rw-. 1 root root 0 May 7 21:25 io.systemd.Home srw-rw-rw-. 1 root root 0 May 7 21:25 io.systemd.Machine srw-rw-rw-. 1 root root 0 May 7 21:25 io.systemd.Multiplexer lrwxrwxrwx. 1 root root 42 May 7 21:25 io.systemd.NameServiceSwitch -> /run/systemd/userdb/io.systemd.Multiplexer $ sudo lsof +c 0 |& fgrep Machine systemd-machine 842 root 9u unix 0x000000008f1ef52e 0t0 9924 /run/systemd/userdb/io.systemd.Machine type=STREAM (LISTEN) On Xfce, there is no io.systemd.Machine: $ ll /run/systemd/userdb/ total 0 lrwxrwxrwx. 1 root root 42 May 7 14:54 io.systemd.DropIn -> /run/systemd/userdb/io.systemd.Multiplexer srw-rw-rw-. 1 root root 0 May 7 14:54 io.systemd.DynamicUser srw-rw-rw-. 1 root root 0 May 7 14:54 io.systemd.Home srw-rw-rw-. 1 root root 0 May 7 14:54 io.systemd.Multiplexer lrwxrwxrwx. 1 root root 42 May 7 14:54 io.systemd.NameServiceSwitch -> /run/systemd/userdb/io.systemd.Multiplexer The difference appears to be in whether systemd-container is installed or not. On Workstation: $ systemctl list-unit-files -a \*systemd-machine\* UNIT FILE STATE PRESET systemd-machine-id-commit.service static - systemd-machined.service static - $ locate systemd-machined.service /usr/lib/systemd/system/systemd-machined.service /usr/share/man/man8/systemd-machined.service.8.gz $ rpm -qf /usr/lib/systemd/system/systemd-machined.service systemd-container-255.4-1.fc40.x86_64 On Xfce: $ rpm -q systemd-container package systemd-container is not installed FEDORA-2024-759c80369d has been pushed to the Fedora 40 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-759c80369d` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-759c80369d See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2024-759c80369d (selinux-policy-40.18-2.fc40) has been pushed to the Fedora 40 stable repository. If problem still persists, please make note of it in this bug report. |