Bug 859730

Summary: SELinux is preventing /usr/bin/ln from 'read' accesses on the lnk_file /usr/lib/systemd/system/anaconda.target.wants/anaconda-shell@tty2.service.
Product: [Fedora] Fedora Reporter: Jesús Abelardo Saldívar Aguilar <jasaldivara>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 17CC: dominick.grift, dwalsh, mgrepl
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
Whiteboard: abrt_hash:675a9e2e3199b3f0e4bc229b71c01be21caaf2f308388591e762962ffae03a60
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-12-20 16:17:30 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
File: type
none
File: hashmarkername none

Description Jesús Abelardo Saldívar Aguilar 2012-09-23 15:17:21 UTC
Additional info:
libreport version: 2.0.13
kernel:         3.5.4-1.fc17.x86_64

description:
:SELinux is preventing /usr/bin/ln from 'read' accesses on the lnk_file /usr/lib/systemd/system/anaconda.target.wants/anaconda-shell.
:
:*****  Plugin catchall (100. confidence) suggests  ***************************
:
:If cree que de manera predeterminada, ln debería permitir acceso read sobre  anaconda-shell lnk_file.     
:Then debería reportar esto como un error.
:Puede generar un módulo de política local para permitir este acceso.
:Do
:permita el acceso momentáneamente executando:
:# grep ln /var/log/audit/audit.log | audit2allow -M mypol
:# semodule -i mypol.pp
:
:Additional Information:
:Source Context                system_u:system_r:initrc_t:s0
:Target Context                system_u:object_r:systemd_unit_file_t:s0
:Target Objects                /usr/lib/systemd/system/anaconda.target.wants
:                              /anaconda-shell [ lnk_file ]
:Source                        ln
:Source Path                   /usr/bin/ln
:Port                          <Desconocido>
:Host                          (removed)
:Source RPM Packages           coreutils-8.15-7.fc17.x86_64
:Target RPM Packages           
:Policy RPM                    selinux-policy-3.10.0-149.fc17.noarch
:Selinux Enabled               True
:Policy Type                   targeted
:Enforcing Mode                Enforcing
:Host Name                     (removed)
:Platform                      Linux (removed) 3.5.4-1.fc17.x86_64 #1 SMP Mon Sep
:                              17 15:03:59 UTC 2012 x86_64 x86_64
:Alert Count                   2
:First Seen                    2012-09-23 10:10:43 CDT
:Last Seen                     2012-09-23 10:10:43 CDT
:Local ID                      b690b766-b1ca-40db-8b05-5b06318588e7
:
:Raw Audit Messages
:type=AVC msg=audit(1348413043.102:95): avc:  denied  { read } for  pid=5784 comm="ln" name="anaconda-shell" dev="sda5" ino=262462 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:object_r:systemd_unit_file_t:s0 tclass=lnk_file
:
:
:type=SYSCALL msg=audit(1348413043.102:95): arch=x86_64 syscall=stat success=no exit=EACCES a0=7fff2e9c0ed6 a1=7fff2e9c0930 a2=7fff2e9c0930 a3=a items=0 ppid=5777 pid=5784 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=ln exe=/usr/bin/ln subj=system_u:system_r:initrc_t:s0 key=(null)
:
:Hash: ln,initrc_t,systemd_unit_file_t,lnk_file,read
:
:audit2allow
:
:#============= initrc_t ==============
:allow initrc_t systemd_unit_file_t:lnk_file read;
:
:audit2allow -R
:
:#============= initrc_t ==============
:allow initrc_t systemd_unit_file_t:lnk_file read;
:

Comment 1 Jesús Abelardo Saldívar Aguilar 2012-09-23 15:17:24 UTC
Created attachment 616141 [details]
File: type

Comment 2 Jesús Abelardo Saldívar Aguilar 2012-09-23 15:17:25 UTC
Created attachment 616142 [details]
File: hashmarkername

Comment 3 Miroslav Grepl 2012-09-24 10:39:53 UTC
Did it happen by default? Or did you modify an init script?

Comment 4 Jesús Abelardo Saldívar Aguilar 2012-09-24 16:01:09 UTC
(In reply to comment #3)
> Did it happen by default? Or did you modify an init script?

It happens by default

Comment 5 Daniel Walsh 2012-09-25 20:01:27 UTC
We have allowed this in F18.

Comment 6 Miroslav Grepl 2012-09-27 16:52:13 UTC
Did you disable unconfined.pp module?

Comment 7 Jesús Abelardo Saldívar Aguilar 2012-09-28 18:42:32 UTC
I'm not sure, I think I may have disabled it to speed up some policies compiling.
How can I check if it's disabled?

Comment 8 Daniel Walsh 2012-10-01 14:37:24 UTC
semodule -l | grep unconfined

Comment 9 Jesús Abelardo Saldívar Aguilar 2012-10-06 17:37:12 UTC
Yes, I have it disabled:

# semodule -l | grep unconfined
> unconfined	3.3.0	Disabled

Comment 10 Daniel Walsh 2012-10-09 17:55:29 UTC
mgrepl lets add

systemd_read_unit_files(initrc_t)

Comment 11 Miroslav Grepl 2012-10-17 07:45:38 UTC
Added.

commit ff478003b3f90275893c30a861143d4aeafc52d5
Author: Miroslav Grepl <mgrepl>
Date:   Wed Oct 17 09:45:13 2012 +0200

    Allow initrc_t to readl all systemd unit files

Comment 12 Fedora Update System 2012-10-17 12:34:32 UTC
selinux-policy-3.10.0-156.fc17 has been submitted as an update for Fedora 17.
https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-156.fc17

Comment 13 Fedora Update System 2012-10-18 00:25:45 UTC
Package selinux-policy-3.10.0-156.fc17:
* should fix your issue,
* was pushed to the Fedora 17 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-156.fc17'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-16347/selinux-policy-3.10.0-156.fc17
then log in and leave karma (feedback).

Comment 14 Fedora Update System 2012-12-20 16:17:32 UTC
selinux-policy-3.10.0-156.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.