Bug 773469

Summary: Multiple denials when booting with systemd 38
Product: [Fedora] Fedora Reporter: Adam Williamson <awilliam>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED RAWHIDE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: unspecified    
Version: rawhideCC: dominick.grift, dwalsh, mgrepl
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-01-16 18:33:20 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Adam Williamson 2012-01-11 21:55:24 UTC
When booting Rawhide with systemd-38-3, I see all these denials:

[    3.388925] type=1400 audit(1326316063.301:4): avc:  denied  { relabelto } fo
r  pid=1 comm="systemd" name="lv_swap" dev=devtmpfs ino=10446 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=lnk_file
[    3.809595] type=1400 audit(1326316063.722:5): avc:  denied  { read } for  pid=498 comm="systemd-journal" name="urandom" dev=devtmpfs ino=1033 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:urandom_device_t:s0 tclass=chr_file
[    4.090198] type=1400 audit(1326316064.003:6): avc:  denied  { write } for  pid=1 comm="systemd" name="/" dev=tmpfs ino=7402 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:mnt_t:s0 tclass=dir
[    4.090203] type=1400 audit(1326316064.003:7): avc:  denied  { add_name } for  pid=1 comm="systemd" name="Sea500" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:mnt_t:s0 tclass=dir
[    4.090206] type=1400 audit(1326316064.003:8): avc:  denied  { create } for  pid=1 comm="systemd" name="Sea500" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:mnt_t:s0 tclass=dir
[    4.315148] type=1400 audit(1326316064.228:9): avc:  denied  { read } for  pid=534 comm="systemd-journal" name="urandom" dev=devtmpfs ino=1033 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:urandom_device_t:s0 tclass=chr_file
[    4.656632] type=1400 audit(1326316064.570:10): avc:  denied  { read } for  pid=551 comm="systemd-journal" name="urandom" dev=devtmpfs ino=1033 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:urandom_device_t:s0 tclass=chr_file

When booting with systemd-37-4, I see only these:

[    4.062732] type=1400 audit(1326318438.973:4): avc:  denied  { write } for  pid=1 comm="systemd" name="/" dev=tmpfs ino=14118 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:mnt_t:s0 tclass=dir
[    4.062743] type=1400 audit(1326318438.973:5): avc:  denied  { add_name } for  pid=1 comm="systemd" name="Sea500" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:mnt_t:s0 tclass=dir
[    4.062752] type=1400 audit(1326318438.973:6): avc:  denied  { create } for  pid=1 comm="systemd" name="Sea500" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:mnt_t:s0 tclass=dir

My system fails to boot correctly with 38, but I'm not sure if this is a consequence of these denials or not.

Comment 1 Adam Williamson 2012-01-11 21:55:49 UTC
This is with selinux-policy-3.10.0-74.

Comment 2 Daniel Walsh 2012-01-13 14:36:54 UTC
Why is systemd creating a directory in /mnt? Sea500?

Do you have unconfined disabled?

Comment 3 Adam Williamson 2012-01-16 18:05:12 UTC
the ssea500 stuff you can ignore, that's a mount of my own which is in fstab so systemd pokes it. it's there in the 'working' case and doesn't really seem to cause any problems.



-- 
Fedora Bugzappers volunteer triage team
https://fedoraproject.org/wiki/BugZappers

Comment 4 Daniel Walsh 2012-01-16 18:33:20 UTC
Fixed in selinux-policy-3.10.0-74.2

Comment 5 Adam Williamson 2012-01-16 22:34:45 UTC
One more left apart from the sea500:

Jan 16 09:56:04 adam kernel: type=1400 audit(1326736563.724:21): avc:  denied  { write } for  pid=1 comm="systemd" name="/" dev=tmpfs ino=1477058 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:mnt_t:s0 tclass=dir

However, -38 still does not boot and -37 still does, and this denial shows up in both. So it's not strictly related to -38, and the SELinux denials weren't the cause of -38 failing to boot in my case :(



-- 
Fedora Bugzappers volunteer triage team
https://fedoraproject.org/wiki/BugZappers

Comment 6 Miroslav Grepl 2012-01-17 12:03:15 UTC
This AVC relates with "Sea500".