Bug 2541481
| Summary: | AVC denials with systemd-pcrlogin@.service attempting to record logins into TPM NvPCR | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Selene Lynn <alt.euyis> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | NEW --- | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 45 | CC: | dwalsh, forums0, lvrabec, mmalik, omosnacek, pkoncity, vmojzis, zpytela |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Also should have added that I use a boot configuration with Secure Boot on and the shim directly loading a UKI image, which satisfies systemd's measured boot with UKI security conditions. This service probably doesn't run on systems booting with GRUB like other systemd services that include ConditionSecurity=measured-uki/measured-os in their unit file, which might explain the lack of reporting. Just a comment to say I am also experiencing this on Fedora 45 Silverblue. I am also experiencing other AVC denials which I suspect could be causing the TPM2 systemd services from properly working.
Just a log file I think:
audit[687]: AVC avc: denied { write } for pid=687 comm="systemd-tpm2-se" name="tpm2-measure.log" dev="tmpfs" ino=94 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:syslogd_var_run_t:s0 tclass=file permissive=0
Probably more importantly:
audit[738]: AVC avc: denied { open } for pid=738 comm="systemd-pcrexte" path="/run/systemd/tpm2-pcr-public-key.pem" dev="tmpfs" ino=114 scontext=system_u:system_r:systemd_pcrextend_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=file permissive=1
audit[738]: AVC avc: denied { getattr } for pid=738 comm="systemd-pcrexte" path="/run/systemd/tpm2-pcr-public-key.pem" dev="tmpfs" ino=114
scontext=system_u:system_r:systemd_pcrextend_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=file permissive=1
audit[888]: AVC avc: denied { read } for pid=888 comm="systemd-pcrexte" name="tpm2-pcr-public-key.pem" dev="tmpfs" ino=114 scontext=system_u:system_r:systemd_pcrextend_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=file permissive=1
Also using UKI
|
systemd since 261 attempts to record user logins for each boot into TPM NvPCR with the systemd-pcrlogin@.service, which similar to the situation with systemd-tpm2-setup-early.service also doesn't work with the current SELinux policies. It appears that the service gets denied access to first information on the TPM device in udev data, and then systemd's own directory in /run that's supposed to hold the NvPCR index. The current interaction creates audit log spam on every regular user login (since the service fails and gets pulled in again every time) and use of su/sudo -i too which gets pretty annoying as well with SELinux Troubleshooter set to notify. Attempts to access /run/udev/data, events in sequence: type=AVC msg=audit(1790348366.63:2839): avc: denied { read } for pid=135216 comm="systemd-pcrexte" name="c252:65536" dev="tmpfs" ino=1556 scontext=system_u:system_r:systemd_pcrextend_t:s0 tcontext=system_u:object_r:udev_var_run_t:s0 tclass=file permissive=1 type=AVC msg=audit(1790348366.63:2840): avc: denied { open } for pid=135216 comm="systemd-pcrexte" path="/run/udev/data/c252:65536" dev="tmpfs" ino=1556 scontext=system_u:system_r:systemd_pcrextend_t:s0 tcontext=system_u:object_r:udev_var_run_t:s0 tclass=file permissive=1 type=AVC msg=audit(1790348366.63:2841): avc: denied { getattr } for pid=135216 comm="systemd-pcrexte" path="/run/udev/data/c252:65536" dev="tmpfs" ino=1556 scontext=system_u:system_r:systemd_pcrextend_t:s0 tcontext=system_u:object_r:udev_var_run_t:s0 tclass=file permissive=1 Attempt to access /run/systemd/nvpcr: type=AVC msg=audit(1790348366.64:2843): avc: denied { read } for pid=135216 comm="systemd-pcrexte" path="/run/systemd/nvpcr" dev="tmpfs" ino=1294 scontext=system_u:system_r:systemd_pcrextend_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=dir permissive=1 Reproducible: Always Steps to Reproduce: 1.Log in as any user on Fedora 45, which now uses systemd v262 Actual Results: AVC denials and failed systemd-pcrlogin@(user id) service. Expected Results: The service working correctly, although presumably it would also require fixed policies for systemd-tpm2-setup-early.service. Additional Information: SELinux policy in use: SELinux Policy RPM selinux-policy-targeted-45.19-1.fc45.noarch Local Policy RPM selinux-policy-targeted-45.19-1.fc45.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing