Bug 952204

Summary: [selinux] localectl denial
Product: [Retired] oVirt Reporter: Fabian Deutsch <fdeutsch>
Component: ovirt-nodeAssignee: Fabian Deutsch <fdeutsch>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 3.2CC: acathrow, jboggs, mburns, mgoldboi, ovirt-bugs, ovirt-maint
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: ovrt-node-3.0.0 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-08-26 09:48:32 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 947475    
Attachments:
Description Flags
Error shown on the screen
none
complete audit.log none

Description Fabian Deutsch 2013-04-15 11:26:40 UTC
Created attachment 735868 [details]
Error shown on the screen

Description of problem:
Fedora migrated to localectl, so do we (bug #882206) this introduces an selinux denial which ultimately stops the installer from succeeding.

Version-Release number of selected component (if applicable):
Recent F18 build

How reproducible:
always

Steps to Reproduce:
1. Launch test build
2. Select keyboard layout
3.
  
Actual results:
error on installer screen and denial in audit.log

Expected results:
installer completes / next page can be selected

Additional info:
setenforce 0 is a workaround

type=SERVICE_START msg=audit(1366024948.199:342): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="systemd-localed" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=AVC msg=audit(1366024948.200:343): avc:  denied  { create } for  pid=4807 comm="systemd-localed" name=".vconsole.confVStRrV" scontext=system_u:system_r:systemd_localed_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file
type=AVC msg=audit(1366024948.200:343): avc:  denied  { write } for  pid=4807 comm="systemd-localed" path="/etc/.vconsole.confVStRrV" dev="tmpfs" ino=31394 scontext=system_u:system_r:systemd_localed_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file
type=SYSCALL msg=audit(1366024948.200:343): arch=c000003e syscall=2 success=yes exit=5 a0=7f5b25cc8f60 a1=800c2 a2=180 a3=1a7e2f2fa items=3 ppid=1 pid=4807 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="systemd-localed" exe="/usr/lib/systemd/systemd-localed" subj=system_u:system_r:systemd_localed_t:s0 key=(null)
type=CWD msg=audit(1366024948.200:343):  cwd="/"
type=PATH msg=audit(1366024948.200:343): item=0 name="/etc/.vconsole.confVStRrV" inode=14543 dev=00:21 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0
type=PATH msg=audit(1366024948.200:343): item=1 name=(null) inode=14543 dev=00:21 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0
type=PATH msg=audit(1366024948.200:343): item=2 name=(null) inode=31394 dev=00:21 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0
type=AVC msg=audit(1366024948.200:344): avc:  denied  { setattr } for  pid=4807 comm="systemd-localed" name=".vconsole.confVStRrV" dev="tmpfs" ino=31394 scontext=system_u:system_r:systemd_localed_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file
type=SYSCALL msg=audit(1366024948.200:344): arch=c000003e syscall=91 success=yes exit=0 a0=5 a1=1a4 a2=fbad2484 a3=22 items=1 ppid=1 pid=4807 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="systemd-localed" exe="/usr/lib/systemd/systemd-localed" subj=system_u:system_r:systemd_localed_t:s0 key=(null)
type=PATH msg=audit(1366024948.200:344): item=0 name=(null) inode=31394 dev=00:21 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0
type=AVC msg=audit(1366024948.200:345): avc:  denied  { rename } for  pid=4807 comm="systemd-localed" name=".vconsole.confVStRrV" dev="tmpfs" ino=31394 scontext=system_u:system_r:systemd_localed_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file
type=SYSCALL msg=audit(1366024948.200:345): arch=c000003e syscall=82 success=yes exit=0 a0=7f5b25cc8f60 a1=7f5b251acf3f a2=7f5b25ccc3a0 a3=22 items=4 ppid=1 pid=4807 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="systemd-localed" exe="/usr/lib/systemd/systemd-localed" subj=system_u:system_r:systemd_localed_t:s0 key=(null)
type=CWD msg=audit(1366024948.200:345):  cwd="/"

Comment 1 Fabian Deutsch 2013-04-15 11:29:58 UTC
Created attachment 735869 [details]
complete audit.log

Comment 2 Fabian Deutsch 2013-04-15 11:42:10 UTC
http://gerrit.ovirt.org/#/c/13922/

Comment 3 Fabian Deutsch 2013-08-26 09:45:48 UTC
The fix for this patch has been merged and is present in the released ovirt-node-3.0.0.