Bug 804306

Fixed in selinux-policy-3.10.0-104

selinux-policy-3.10.0-104.fc17.noarch, in user-built anaconda install DVD using pungi with private repo containing packages downloaded from successful koji build, still gives these errors [they look like the same ones]:

23:52:01,925 NOTICE kernel:[   19.314166] type=1400 audit(1332287510.017:3): avc:  denied  { write } for  pid=435 comm="loadkeys" name="python2.7" dev="dm-0" ino=34233 scontext=system_u:system_r:loadkeys_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=dir
23:52:01,925 NOTICE kernel:[   19.314374] type=1400 audit(1332287510.017:4): avc:  denied  { remove_name } for  pid=435 comm="loadkeys" name="site.pyc" dev="dm-0" ino=34323 scontext=system_u:system_r:loadkeys_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=dir
23:52:01,925 NOTICE kernel:[   19.314576] type=1400 audit(1332287510.017:5): avc:  denied  { unlink } for  pid=435 comm="loadkeys" name="site.pyc" dev="dm-0" ino=34323 scontext=system_u:system_r:loadkeys_t:s0 tcontext=unconfined_u:object_r:lib_t:s0 tclass=lnk_file
23:52:01,925 NOTICE kernel:[   19.317048] type=1400 audit(1332287510.020:6): avc:  denied  { add_name } for  pid=435 comm="loadkeys" name="site.pyc" scontext=system_u:system_r:loadkeys_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=dir
23:52:01,925 NOTICE kernel:[   19.317260] type=1400 audit(1332287510.020:7): avc:  denied  { create } for  pid=435 comm="loadkeys" name="site.pyc" scontext=system_u:system_r:loadkeys_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=file
23:52:01,925 NOTICE kernel:[   19.317509] type=1400 audit(1332287510.020:8): avc:  denied  { write } for  pid=435 comm="loadkeys" name="site.pyc" dev="dm-0" ino=34323 scontext=system_u:system_r:loadkeys_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=file
23:52:01,925 NOTICE kernel:[   19.877844] type=1400 audit(1332287510.581:9): avc:  denied  { create } for  pid=457 comm="systemd-tmpfile" name="tmp" scontext=system_u:system_r:systemd_tmpfiles_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=dir
23:52:01,925 NOTICE kernel:[   19.881187] type=1400 audit(1332287510.585:10): avc:  denied  { setattr } for  pid=457 comm="systemd-tmpfile" name="tmp" dev="dm-0" ino=16972 scontext=system_u:system_r:systemd_tmpfiles_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=dir
23:52:01,925 NOTICE kernel:[   19.881662] type=1400 audit(1332287510.585:11): avc:  denied  { relabelfrom } for  pid=457 comm="systemd-tmpfile" name="tmp" dev="dm-0" ino=16972 scontext=system_u:system_r:systemd_tmpfiles_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=dir
23:52:01,925 NOTICE kernel:[   27.492647] type=1400 audit(1332287518.196:20): avc:  denied  { read } for  pid=435 comm="loadkeys" name="psched" dev="proc" ino=4026531977 scontext=system_u:system_r:loadkeys_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file
23:52:01,925 NOTICE kernel:[   27.492682] type=1400 audit(1332287518.196:21): avc:  denied  { open } for  pid=435 comm="loadkeys" name="psched" dev="proc" ino=4026531977 scontext=system_u:system_r:loadkeys_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file
23:52:01,925 NOTICE kernel:[   27.492726] type=1400 audit(1332287518.196:22): avc:  denied  { getattr } for  pid=435 comm="loadkeys" path="/proc/435/net/psched" dev="proc" ino=4026531977 scontext=system_u:system_r:loadkeys_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file
23:52:01,925 NOTICE kernel:[   29.627991] type=1400 audit(1332287520.331:23): avc:  denied  { read } for  pid=435 comm="loadkeys" name="urandom" dev="devtmpfs" ino=4473 scontext=system_u:system_r:loadkeys_t:s0 tcontext=system_u:object_r:urandom_device_t:s0 tclass=chr_file
23:52:01,925 NOTICE kernel:[   29.628074] type=1400 audit(1332287520.332:24): avc:  denied  { open } for  pid=435 comm="loadkeys" name="urandom" dev="devtmpfs" ino=4473 scontext=system_u:system_r:loadkeys_t:s0 tcontext=system_u:object_r:urandom_device_t:s0 tclass=chr_file
23:52:01,925 NOTICE kernel:[   30.344928] type=1400 audit(1332287521.048:25): avc:  denied  { execute } for  pid=601 comm="bash" name="hostname" dev="dm-0" ino=35269 scontext=system_u:system_r:getty_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file
23:52:01,925 NOTICE kernel:[   30.344980] type=1400 audit(1332287521.048:26): avc:  denied  { read open } for  pid=601 comm="bash" name="hostname" dev="dm-0" ino=35269 scontext=system_u:system_r:getty_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file
23:52:01,925 NOTICE kernel:[   30.345074] type=1400 audit(1332287521.049:27): avc:  denied  { execute_no_trans } for  pid=601 comm="bash" path="/usr/bin/hostname" dev="dm-0" ino=35269 scontext=system_u:system_r:getty_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file
23:52:01,925 NOTICE kernel:[   30.626852] type=1400 audit(1332287521.330:28): avc:  denied  { read } for  pid=598 comm="bash" name=".profile" dev="dm-0" ino=106821 scontext=system_u:system_r:getty_t:s0 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file
23:52:01,925 NOTICE kernel:[   30.626900] type=1400 audit(1332287521.330:29): avc:  denied  { open } for  pid=598 comm="bash" name=".profile" dev="dm-0" ino=106821 scontext=system_u:system_r:getty_t:s0 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file
23:52:10,723 NOTICE kernel:[   40.006220] type=1400 audit(1332287530.709:33): avc:  denied  { append } for  pid=653 comm="auditd" path="/tmp/anaconda.log" dev="dm-0" ino=98752 scontext=system_u:system_r:auditd_t:s0 tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=file
23:52:10,723 NOTICE kernel:[   40.008469] type=1400 audit(1332287530.712:34): avc:  denied  { read write } for  pid=653 comm="auditd" path="/dev/mapper/control" dev="devtmpfs" ino=6965 scontext=system_u:system_r:auditd_t:s0 tcontext=system_u:object_r:lvm_control_t:s0 tclass=chr_file
23:52:10,723 NOTICE kernel:[   40.010229] type=1400 audit(1332287530.714:35): avc:  denied  { read write } for  pid=653 comm="auditd" path=2F746D702F6666694642356F795A202864656C6574656429 dev="dm-0" ino=98756 scontext=system_u:system_r:auditd_t:s0 tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=file
23:52:10,724 NOTICE kernel:[   40.014330] type=1400 audit(1332287530.718:36): avc:  denied  { read } for  pid=653 comm="auditd" name="psched" dev="proc" ino=4026531977 scontext=system_u:system_r:auditd_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file
23:52:10,724 NOTICE kernel:[   40.016186] type=1400 audit(1332287530.720:37): avc:  denied  { open } for  pid=653 comm="auditd" name="psched" dev="proc" ino=4026531977 scontext=system_u:system_r:auditd_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file
23:52:10,726 NOTICE kernel:[   40.019382] type=1400 audit(1332287530.723:38): avc:  denied  { getattr } for  pid=653 comm="auditd" path="/proc/653/net/psched" dev="proc" ino=4026531977 scontext=system_u:system_r:auditd_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file
00:10:02,029 INFO dbus: avc:  received policyload notice (seqno=2)

Having checked the install messages when the initrd.img was first created during my pungi run, I'm reasonably sure that selinux-policy-3.10.0-104 is the actual version of the system that runs from the DVD during the install.  However, I cannot find such an identifying message in the anaconda logs that are written to /tmp during the install.  The installed /root/install.log does say that selinux-policy-3.10.0-104.fc17.noarch was the version that was fresh installed into the target.

I don't know if I marked this fixed by mistake.

Anyways,


Looking at your AVC's.

You have python code trying to compile it self and write these generate allow rules like

allow loadkeys_t lib_t:dir { write remove_name add_name };
allow loadkeys_t lib_t:file { write create };
allow loadkeys_t lib_t:lnk_file unlink;

Which we will never allow, the site.pyc has to be shipped in an rpm or run before any confined domains touch it.

Is loadkeys in this environment a python script?

Looks like there is some kind of wacky transitions going on since you have getty_t running bash and hostname?

Instead of using /tmp/anaconda.log can you use /var/log/anaconda.log, then apps will be allowed to append to it.

Some app is leaking an open file descriptor to /dev/mapper/control

I will add a rule to allow auditd to read the network state.

Looks like you have a mislabled /var/tmp within your pungi environment.
Probably need the script that creates /var/tmp to execute restorecon on it.

> Looks like you have a mislabled /var/tmp within your pungi environment.
> Probably need the script that creates /var/tmp to execute restorecon on it.

Hmmm.  What I do is:
-----
mkdir -p      /dev/shm/pungi-$$
restorecon    /dev/shm/pungi-$$  # change from user_tmpfs_t to device_t
export TMPDIR=/dev/shm/pungi-$$
ln -s $DESTDIR/work/$ARCH $TMPDIR

setenforce 0

pungi ...
-----
because using tmpfs (RAM) instead of SATA (harddrive) saves some minutes of time (>10% of a 20-minute run).  Or at least it did at some point during the last couple years.  It would be even better if pungi/yum/lorax honored TMPDIR and adjusted pathnames appropriately for use under chroot().  But the maintainer of pungi has not been interested.

Lorax uses the default TMPDIR if you don't supply the workdir argument to the run() method. Otherwise it uses what you give it. So this just needs to be changed in pungi where lorax is called.

'loadkeys' was a python replacement for the actual 'loadkeys' binary, which (AFAICT) existed to save like ~100KB on the installer image, back when that was actually worth caring about. I think we can just use the normal 'loadkeys' binary and most of those messages should go away.

Having done that, I'm left with these three AVC messages:

avc:  denied  { append } for  pid=748 comm="auditd" path="/tmp/anaconda.log" dev="dm-0" ino=33497 scontext=system_u:system_r:auditd_t:s0 tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=file

avc:  denied  { read write } for  pid=748 comm="auditd" path="/dev/mapper/control" dev="devtmpfs" ino=7062 scontext=system_u:system_r:auditd_t:s0 tcontext=system_u:object_r:lvm_control_t:s0 tclass=chr_file

avc:  denied  { read write } for  pid=748 comm="auditd" path=2F746D702F666669473557414652202864656C6574656429 dev="dm-0" ino=33512 scontext=system_u:system_r:auditd_t:s0 tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=file

The first is anaconda.log. We could move it for F18 but doing it for F17 would be really hard. Can we just relabel it var_log_t?

The second is /dev/mapper/control. No idea where that comes from; if I had to guess I'd say it's probably LVM's fault :P

The third and final message.. no idea what's happening there. but it's more mapper junk, so I'd guess it's associated.

Basically, I think most of this could be fixed by *not* replacing loadkeys with our weirdo loadkeys. I'll try switching that over and see how/if that helps.

lorax-17.16-1.fc17 has been submitted as an update for Fedora 17.
https://admin.fedoraproject.org/updates/lorax-17.16-1.fc17

Package lorax-17.16-1.fc17:
* should fix your issue,
* was pushed to the Fedora 17 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing lorax-17.16-1.fc17'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-6491/lorax-17.16-1.fc17
then log in and leave karma (feedback).