DescriptionMatthias Andree
2024-11-26 09:00:10 UTC
Description of problem:
during dnf upgrade
SELinux is preventing anaconda-genera from 'write' accesses on the sock_file /var/lib/sss/pipes/nss.
***** Plugin catchall (100. confidence) suggests **************************
Wenn Sie denken, dass es anaconda-genera standardmäßig erlaubt sein sollte, write Zugriff auf nss sock_file zu erhalten.
Then sie sollten dies als Fehler melden.
Um diesen Zugriff zu erlauben, können Sie ein lokales Richtlinien-Modul erstellen.
Do
zugriff jetzt erlauben, indem Sie die nachfolgenden Befehle ausführen:
# ausearch -c 'anaconda-genera' --raw | audit2allow -M my-anacondagenera
# semodule -X 300 -i my-anacondagenera.pp
Additional Information:
Source Context system_u:system_r:anaconda_generator_t:s0
Target Context system_u:object_r:sssd_var_lib_t:s0
Target Objects /var/lib/sss/pipes/nss [ sock_file ]
Source anaconda-genera
Source Path anaconda-genera
Port <Unbekannt>
Host (removed)
Source RPM Packages
Target RPM Packages
SELinux Policy RPM selinux-policy-targeted-41.26-1.fc41.noarch
Local Policy RPM selinux-policy-targeted-41.26-1.fc41.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name (removed)
Platform Linux (removed) 6.11.8-300.fc41.x86_64 #1 SMP
PREEMPT_DYNAMIC Thu Nov 14 20:37:39 UTC 2024
x86_64
Alert Count 3
First Seen 2024-11-23 19:22:20 CET
Last Seen 2024-11-26 09:58:26 CET
Local ID 2aad7a67-7855-499c-b42d-5e4bfe9a3747
Raw Audit Messages
type=AVC msg=audit(1732611506.96:393): avc: denied { write } for pid=9036 comm="anaconda-genera" name="nss" dev="dm-1" ino=2752603 scontext=system_u:system_r:anaconda_generator_t:s0 tcontext=system_u:object_r:sssd_var_lib_t:s0 tclass=sock_file permissive=1
Hash: anaconda-genera,anaconda_generator_t,sssd_var_lib_t,sock_file,write
Version-Release number of selected component:
selinux-policy-targeted-41.26-1.fc41.noarch
Additional info:
reporter: libreport-2.17.15
reason: SELinux is preventing anaconda-genera from 'write' accesses on the sock_file /var/lib/sss/pipes/nss.
kernel: 6.11.8-300.fc41.x86_64
type: libreport
comment: during dnf upgrade
package: selinux-policy-targeted-41.26-1.fc41.noarch
hashmarkername: setroubleshoot
component: selinux-policy
component: selinux-policy
Description of problem: during dnf upgrade SELinux is preventing anaconda-genera from 'write' accesses on the sock_file /var/lib/sss/pipes/nss. ***** Plugin catchall (100. confidence) suggests ************************** Wenn Sie denken, dass es anaconda-genera standardmäßig erlaubt sein sollte, write Zugriff auf nss sock_file zu erhalten. Then sie sollten dies als Fehler melden. Um diesen Zugriff zu erlauben, können Sie ein lokales Richtlinien-Modul erstellen. Do zugriff jetzt erlauben, indem Sie die nachfolgenden Befehle ausführen: # ausearch -c 'anaconda-genera' --raw | audit2allow -M my-anacondagenera # semodule -X 300 -i my-anacondagenera.pp Additional Information: Source Context system_u:system_r:anaconda_generator_t:s0 Target Context system_u:object_r:sssd_var_lib_t:s0 Target Objects /var/lib/sss/pipes/nss [ sock_file ] Source anaconda-genera Source Path anaconda-genera Port <Unbekannt> Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-41.26-1.fc41.noarch Local Policy RPM selinux-policy-targeted-41.26-1.fc41.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 6.11.8-300.fc41.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Nov 14 20:37:39 UTC 2024 x86_64 Alert Count 3 First Seen 2024-11-23 19:22:20 CET Last Seen 2024-11-26 09:58:26 CET Local ID 2aad7a67-7855-499c-b42d-5e4bfe9a3747 Raw Audit Messages type=AVC msg=audit(1732611506.96:393): avc: denied { write } for pid=9036 comm="anaconda-genera" name="nss" dev="dm-1" ino=2752603 scontext=system_u:system_r:anaconda_generator_t:s0 tcontext=system_u:object_r:sssd_var_lib_t:s0 tclass=sock_file permissive=1 Hash: anaconda-genera,anaconda_generator_t,sssd_var_lib_t,sock_file,write Version-Release number of selected component: selinux-policy-targeted-41.26-1.fc41.noarch Additional info: reporter: libreport-2.17.15 reason: SELinux is preventing anaconda-genera from 'write' accesses on the sock_file /var/lib/sss/pipes/nss. kernel: 6.11.8-300.fc41.x86_64 type: libreport comment: during dnf upgrade package: selinux-policy-targeted-41.26-1.fc41.noarch hashmarkername: setroubleshoot component: selinux-policy component: selinux-policy