Bug 571293
| Summary: | yum-cron spooks selinux | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Michal Jaegermann <michal> |
| Component: | yum-cron | Assignee: | Habig, Alec <ahabig> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | 12 | CC: | ahabig, dwalsh, james.antill |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2010-11-03 21:36:31 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
The tmpfile for mailing yum-cron results got put into /var/run as part of resolving bug 431588's bad interaction with selinux, at the recommendation of the selinux maintainer. Why not /var/tmp instead I'm not sure. The writing by appending to the file (rather than creating it and writing all in one go) was done to make selinux happier. I just tried and got something slightly different, with these two Denies back-to-back: type=AVC msg=audit(1268074518.532:40): avc: denied { append } for pid=1654 comm="semodule" path="/var/run/yum-cron.Y59Q0E" dev=sda5 ino=527981 scontext=unconfined_u:system_r:semanage_t:s0 tcontext=system_u:object_r:rpm_var_run_t:s0 tclass=file type=AVC msg=audit(1268074518.532:40): avc: denied { append } for pid=1654 comm="semodule" path="/var/run/yum-cron.Y59Q0E" dev=sda5 ino=527981 scontext=unconfined_u:system_r:semanage_t:s0 tcontext=system_u:object_r:rpm_var_run_t:s0 tclass=file Although I get the email anyway, so not sure what exactly is being denied? Will contact the selinux folks to see what should be done. I believe this is dontaudited in selinux-policy-3.6.32-98.fc12 yum update selinux-policy-targeted --enablerepo=updates-testing This message is a reminder that Fedora 12 is nearing its end of life. Approximately 30 (thirty) days from now Fedora will stop maintaining and issuing updates for Fedora 12. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as WONTFIX if it remains open with a Fedora 'version' of '12'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version prior to Fedora 12's end of life. Bug Reporter: Thank you for reporting this issue and we are sorry that we may not be able to fix it before Fedora 12 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora please change the 'version' of this bug to the applicable version. If you are unable to change the version, please add a comment here and someone will do it for you. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete. The process we are following is described here: http://fedoraproject.org/wiki/BugZappers/HouseKeeping This one's been fixed for a while, we forgot to close it - doing so now. |
Description of problem: /etc/cron.daily/0yum.cron does the following: YUMTMP=$(mktemp /var/run/yum-cron.XXXXXX) and later writes to this file. There is there 'restorecon $YUMTMP' but selinux reacts to this as follows: avc: denied { append } for pid=13232 comm="restorecond" path="/var/run/yum-cron.vQpiKP" dev=sda3 ino=2490727 scontext=system_u:system_r:restorecond_t:s0 tcontext=system_u:object_r:rpm_var_run_t:s0 tclass=file Why this happens and who is at fault I really do not know. OTOH why $YUMTMP resides in /var/run instead of, say, /var/tmp is also not clear. It thought that /var/run is really for other things. Version-Release number of selected component (if applicable): yum-cron-0.9.1-1.fc12 selinux-policy-targeted-3.6.32-92.fc12 How reproducible: I can see that repeateadly in log files.