| Summary: | SELinux is preventing /bin/cp from 'relabelfrom' accesses on the file quick. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Simon Farnsworth <simon> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED WORKSFORME | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 14 | CC: | dwalsh, mgrepl, stephent98 |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | setroubleshoot_trace_hash:a3b2dc4af837d03e00ed323170e3b2b843dc6fed3043118c4fcab6e3896c5b29 | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-03-18 22:14:46 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
This looks like you mislabeled your /var/lib directory. Please execute restorecon -R -v -F /var/lib Should fix this problem. At some point you got your cron system running as unconfined_u? This system was installed as Fedora 14 with btrfs, and has run with SELinux enabled from that point - I have never intentionally run with SELinux disabled. No idea how cron got to run as unconfined_u; I've run the restorecon command you suggested, and if the AVC recurs, I will reopen this bug, asking for help diagnosing how cron got into the bad state. Getting these with F15 when prelink runs:
type=AVC msg=audit(1304694371.161:103): avc: denied { relabelfrom } for pid=2504 comm="cp" name="quick" dev=sdb6 ino=132792 scontext=system_u:system_r:prelink_cron_system_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:prelink_var_lib_t:s0 tclass=file
This was a clean reinstall to eliminate problems caused by booting with selinux=0.
[joeblow@fir lib]$ sealert -l 8d477043-3597-48d3-8760-25416f95736e | head -1
SELinux is preventing /bin/cp from relabelfrom access on the file /var/lib/prelink/quick.
[joeblow@fir lib]$ ls -lZ /var/lib/prelink/quick
-rw-r--r--. root root unconfined_u:object_r:prelink_var_lib_t:s0 /var/lib/prelink/quick
selinux-policy-3.9.16-21.fc15.noarch
selinux-policy-targeted-3.9.16-21.fc15.noarch
$ sestatus
SELinux status: enabled
SELinuxfs mount: /selinux
Current mode: enforcing
Mode from config file: enforcing
Policy version: 24
Policy from config file: targeted
The problem is the prelink_var_lib_t file was created by unconfined_u, and we are blocking on a constraint. If you ran restorecon -FR -v /var/lib/prelink This problem will go away. I have added a fix to policy to allow this which should be in selinux-policy-3.9.16-24.fc15 |
SELinux is preventing /bin/cp from 'relabelfrom' accesses on the file quick. ***** Plugin catchall (100. confidence) suggests *************************** If you believe that cp should be allowed relabelfrom access on the quick file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep cp /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:prelink_cron_system_t:s0-s0:c0.c 1023 Target Context unconfined_u:object_r:prelink_var_lib_t:s0 Target Objects quick [ file ] Source cp Source Path /bin/cp Port <Unknown> Host (removed) Source RPM Packages coreutils-8.5-7.fc14 Target RPM Packages Policy RPM selinux-policy-3.9.7-31.fc14 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 2.6.35.11-83.fc14.x86_64 #1 SMP Mon Feb 7 07:06:44 UTC 2011 x86_64 x86_64 Alert Count 2 First Seen Fri 18 Mar 2011 08:49:49 PM GMT Last Seen Fri 18 Mar 2011 08:49:49 PM GMT Local ID 8628e5b4-94f4-4d8c-aaec-9af998a844ee Raw Audit Messages type=AVC msg=audit(1300481389.897:3432): avc: denied { relabelfrom } for pid=23835 comm="cp" name="quick" dev=sda6 ino=93293 scontext=system_u:system_r:prelink_cron_system_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:prelink_var_lib_t:s0 tclass=file type=SYSCALL msg=audit(1300481389.897:3432): arch=x86_64 syscall=fsetxattr success=no exit=EACCES a0=4 a1=7fff71efab70 a2=c05930 a3=2b items=0 ppid=23828 pid=23835 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=14 comm=cp exe=/bin/cp subj=system_u:system_r:prelink_cron_system_t:s0-s0:c0.c1023 key=(null) Hash: cp,prelink_cron_system_t,prelink_var_lib_t,file,relabelfrom audit2allow #============= prelink_cron_system_t ============== #!!!! This avc is a constraint violation. You will need to add an attribute to either the source or target type to make it work. #Contraint rule: allow prelink_cron_system_t prelink_var_lib_t:file relabelfrom; audit2allow -R #============= prelink_cron_system_t ============== #!!!! This avc is a constraint violation. You will need to add an attribute to either the source or target type to make it work. #Contraint rule: allow prelink_cron_system_t prelink_var_lib_t:file relabelfrom;