Bug 987608
| Summary: | SELinux is preventing systemd-tmpfile from 'relabelto' accesses on the chr_file loop-control. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Nicolas Mailhot <nicolas.mailhot> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | rawhide | CC: | dominick.grift, dwalsh, mgrepl |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:ba7b7bd414343051095f6d2ba29f0635f3a9a7a44f965d61860e360079df4a0a | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2013-07-24 08:39:39 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
*** This bug has been marked as a duplicate of bug 987601 *** |
Description of problem: SELinux is preventing systemd-tmpfile from 'relabelto' accesses on the chr_file loop-control. ***** Plugin associate (99.5 confidence) suggests ************************** If vous souhaitez modifier l'étiquette de loop-control en loop_control_device_t, ce qui est interdit car pas un type de fichier valide. Then vous devez choisir une étiquette de fichier valide. Do select a valid file type. List valid file labels by executing: # seinfo -afile_type -x ***** Plugin catchall (1.49 confidence) suggests *************************** If vous pensez que systemd-tmpfile devrait être autorisé à accéder relabelto sur loop-control chr_file par défaut. Then vous devriez rapporter ceci en tant qu'anomalie. Vous pouvez générer un module de stratégie local pour autoriser cet accès. Do autoriser cet accès pour le moment en exécutant : # grep systemd-tmpfile /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:systemd_tmpfiles_t:s0 Target Context system_u:object_r:loop_control_device_t:s0 Target Objects loop-control [ chr_file ] Source systemd-tmpfile Source Path systemd-tmpfile Port <Inconnu> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.12.1-66.fc20.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 3.11.0-0.rc0.git3.1.fc20.x86_64 #1 SMP Tue Jul 9 21:34:37 UTC 2013 x86_64 x86_64 Alert Count 1 First Seen 2013-07-23 20:34:45 CEST Last Seen 2013-07-23 20:34:45 CEST Local ID 505969de-7dcd-4027-8a4e-65bfcd64984b Raw Audit Messages type=AVC msg=audit(1374604485.341:70): avc: denied { relabelto } for pid=574 comm="systemd-tmpfile" name="loop-control" dev="devtmpfs" ino=9972 scontext=system_u:system_r:systemd_tmpfiles_t:s0 tcontext=system_u:object_r:loop_control_device_t:s0 tclass=chr_file Hash: systemd-tmpfile,systemd_tmpfiles_t,loop_control_device_t,chr_file,relabelto Additional info: reporter: libreport-2.1.5 hashmarkername: setroubleshoot kernel: 3.11.0-0.rc0.git3.1.fc20.x86_64 type: libreport