Bug 2335134
| Summary: | SELinux prevents ras-mc-ctl.service from starting | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Dezponia Veil <bugzilla.redhat.com-mail> | ||||
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
| Severity: | low | Docs Contact: | |||||
| Priority: | low | ||||||
| Version: | 41 | CC: | dwalsh, lvrabec, mmalik, omosnacek, pkoncity, vmojzis, zpytela | ||||
| Target Milestone: | --- | Keywords: | SELinux | ||||
| Target Release: | --- | Flags: | zpytela:
mirror+
|
||||
| Hardware: | x86_64 | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | selinux-policy-41.47-1.fc41 | Doc Type: | --- | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2025-09-14 01:35:18 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
Created attachment 2064421 [details]
ras-mc-ctl.service sealert output
For reference the sysfs file "dimm_label" can be found here: /sys/devices/system/edac/mc/mc*/(dimm|rank)*/dimm_label In my system it looks like this: # ls -lahZ /sys/devices/system/edac/mc/mc0/rank0/dimm_label -rw-r--r--. 1 root root system_u:object_r:sysfs_t:s0 4,0K X xxx XX.XX /sys/devices/system/edac/mc/mc0/rank0/dimm_label FEDORA-2025-acfddac85e (selinux-policy-41.47-1.fc41) has been submitted as an update to Fedora 41. https://bodhi.fedoraproject.org/updates/FEDORA-2025-acfddac85e FEDORA-2025-acfddac85e has been pushed to the Fedora 41 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-acfddac85e` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-acfddac85e See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2025-acfddac85e (selinux-policy-41.47-1.fc41) has been pushed to the Fedora 41 stable repository. If problem still persists, please make note of it in this bug report. |
Starting the service ras-mc-ctl.service from the rasdaemon package fails when SELinux is set to enforcing mode. Reproducible: Always Steps to Reproduce: 1. Install rasdaemon package with `dnf install rasdaemon` 2. Start rasdaemon.service with `systemctl start rasdemon`. Note that this works. 3. Try to start ras-mc-ctl.service with `systemctl start ras-mc-ctl.service`. Note that this fails with an error from systemctl. 4. Set SELinux to permissive mode with `setenforcing 0`. 5. Try to start ras-mc-ctl.service again. Note that now it works. Actual Results: # systemctl start ras-mc-ctl.service Job for ras-mc-ctl.service failed because the control process exited with error code. See "systemctl status ras-mc-ctl.service" and "journalctl -xeu ras-mc-ctl.service" for details. Expected Results: # systemctl start ras-mc-ctl.service # systemctl status ras-mc-ctl.service ● ras-mc-ctl.service - Initialize EDAC v3.0.0 Drivers For Machine Hardware Loaded: loaded (/usr/lib/systemd/system/ras-mc-ctl.service; disabled; preset: disabled) Drop-In: /usr/lib/systemd/system/service.d └─10-timeout-abort.conf, 50-keep-warm.conf Active: active (exited) since XYAZ XXXX-XX-XX XX:XX:XX YYY; 1min 00s ago --- I've included the output of "sealert -l" when running SELinux in permissive mode as a log file to this bug report. Below is the Raw Audit Messages from this output: type=AVC msg=audit(1735686000.621:305): avc: denied { write } for pid=4494 comm="ras-mc-ctl" name="dimm_label" dev="sysfs" ino=60664 scontext=system_u:system_r:rasdaemon_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file permissive=1 type=SYSCALL msg=audit(1735686000.621:305): arch=x86_64 syscall=openat success=yes exit=ESRCH a0=ffffff9c a1=556391175920 a2=80241 a3=1b6 items=0 ppid=1 pid=4494 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=ras-mc-ctl exe=/usr/bin/perl subj=system_u:system_r:rasdaemon_t:s0 key=(null) Package versions Linux 6.12.6-200.fc41.x86_64 #1 SMP selinux-policy-targeted-41.27-1.fc41.noarch rasdaemon-0.8.0-5.fc41.x86_64