Bug 1013205 - SELinux is preventing tuned from 'write' accesses on the directory /sys/fs/selinux.
SELinux is preventing tuned from 'write' accesses on the directory /sys/fs/se...
Status: CLOSED EOL
Product: Fedora
Classification: Fedora
Component: tuned (Show other bugs)
20
x86_64 Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Jaroslav Škarvada
Fedora Extras Quality Assurance
abrt_hash:f48e87d90fbaed2559dc18b81e6...
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2013-09-28 06:22 EDT by Heiko Adams
Modified: 2015-06-29 20:42 EDT (History)
10 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-06-29 20:42:48 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Heiko Adams 2013-09-28 06:22:28 EDT
Description of problem:
SELinux is preventing tuned from 'write' accesses on the directory /sys/fs/selinux.

*****  Plugin restorecon (90.5 confidence) suggests   ************************

If sie die Kennzeichnung korrigieren möchten.
/sys/fs/selinux Standard-Kennzeichnung sollte sysfs_t sein.
Then sie können restorecon ausführen.
Do
# /sbin/restorecon -v /sys/fs/selinux

*****  Plugin setenforce (9.50 confidence) suggests   ************************

If sie glauben, dass tuned versuchte, SELinux zu deaktivieren.
Then sie werden eventuell durch einen Hacker angegriffen, da eingeschränkte Anwendungen diesen Zugriff nicht benötigen sollten.
Do
setzen Sie sich mit Ihrem Sicherheitsadministrator in Verbindung und melden Sie dieses Problem.

*****  Plugin catchall (1.40 confidence) suggests   **************************

If sie denken, dass es tuned standardmässig erlaubt sein sollte, write Zugriff auf selinux directory zu erhalten.
Then sie sollten dies als Fehler melden.
Um diesen Zugriff zu erlauben, können Sie ein lokales Richtlinien-Modul erstellen.
Do
zugriff jetzt erlauben, indem Sie die nachfolgenden Befehle ausführen:
# grep tuned /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:tuned_t:s0
Target Context                system_u:object_r:security_t:s0
Target Objects                /sys/fs/selinux [ dir ]
Source                        tuned
Source Path                   tuned
Port                          <Unbekannt>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.12.1-83.fc20.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.11.1-300.fc20.x86_64 #1 SMP Sat
                              Sep 14 15:01:23 UTC 2013 x86_64 x86_64
Alert Count                   1
First Seen                    2013-09-28 12:07:32 CEST
Last Seen                     2013-09-28 12:07:32 CEST
Local ID                      8565f21b-42ea-4414-8fb2-cfa4af5eb600

Raw Audit Messages
type=AVC msg=audit(1380362852.435:320): avc:  denied  { write } for  pid=568 comm="tuned" name="/" dev="selinuxfs" ino=1 scontext=system_u:system_r:tuned_t:s0 tcontext=system_u:object_r:security_t:s0 tclass=dir


Hash: tuned,tuned_t,security_t,dir,write

Additional info:
reporter:       libreport-2.1.7
hashmarkername: setroubleshoot
kernel:         3.11.1-300.fc20.x86_64
type:           libreport
Comment 1 Daniel Walsh 2013-09-28 06:56:25 EDT
What is tuned trying to do with SELInux?
Comment 2 Heiko Adams 2013-10-01 05:34:36 EDT
Description of problem:
Just booted my system and logged into my Xfce session

Additional info:
reporter:       libreport-2.1.7
hashmarkername: setroubleshoot
kernel:         3.11.2-301.fc20.x86_64
type:           libreport
Comment 3 Jaroslav Škarvada 2013-10-18 05:28:45 EDT
(In reply to Daniel Walsh from comment #1)
> What is tuned trying to do with SELInux?

AFAIK nothing, there is no support code for it. Maybe it is caused by some third party plugin or script?
Comment 4 Jaroslav Škarvada 2013-10-18 05:32:26 EDT
Heiko, what's the profile name you were using (cat /etc/tuned/active_profile)? Is it standard profile from the tuned package or your customized profile? Also please provide output of:

# rpm -qV tuned
Comment 5 Heiko Adams 2013-10-18 06:52:05 EDT
I'm using the standard profile

$ rpm -qV tuned
S.5....T.  c /etc/tuned/active_profile
Comment 6 Jaroslav Škarvada 2013-10-18 07:03:31 EDT
Is it the balanced profile?

# cat /etc/tuned/active_profile
Comment 7 Heiko Adams 2013-10-18 07:09:30 EDT
$ cat /etc/tuned/active_profile
balanced
Comment 8 Jaroslav Škarvada 2013-10-21 07:19:38 EDT
Hmm, I have currently no idea what caused this. I am unable to reproduce it on my machines, xfce with lightdm (also tried gdm) and:
selinux-policy-3.12.1-90
tuned-2.2.2-2

Could you attach your /var/log/tuned/tuned.log?
And also please provide output of the following command:
# ls /etc/tuned
Comment 9 Heiko Adams 2013-10-21 07:24:07 EDT
curiously I can't reproduce this anymore. Seems to be fixed with one of the last policy updates.

$ cat /var/log/tuned/tuned.log
2013-10-21 10:37:22,049 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 1000
2013-10-21 10:37:32,365 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 100
2013-10-21 10:37:42,367 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 1000
2013-10-21 10:41:22,391 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 100
2013-10-21 10:42:22,398 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 1000
2013-10-21 10:42:42,401 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 100
2013-10-21 10:51:22,763 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 1000
2013-10-21 10:51:32,765 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 100
2013-10-21 10:51:42,847 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 1000
2013-10-21 10:52:02,850 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 100
2013-10-21 11:01:33,720 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 1000
2013-10-21 11:02:03,790 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 100
2013-10-21 11:02:23,913 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 1000
2013-10-21 11:02:33,915 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 100
2013-10-21 11:02:43,917 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 1000
2013-10-21 11:03:03,919 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 100
2013-10-21 11:08:44,583 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 1000
2013-10-21 11:08:54,585 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 100
2013-10-21 11:10:14,593 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 1000
2013-10-21 11:10:24,594 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 100
2013-10-21 11:13:04,611 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 1000
2013-10-21 11:13:24,668 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 100
2013-10-21 11:13:34,669 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 1000
2013-10-21 11:15:04,710 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 100
2013-10-21 11:25:56,111 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 1000
2013-10-21 11:26:46,255 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 100
2013-10-21 11:30:46,727 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 1000
2013-10-21 11:32:16,746 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 100
2013-10-21 11:34:57,053 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 1000
2013-10-21 11:35:07,055 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 100
2013-10-21 11:35:17,057 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 1000
2013-10-21 11:35:27,058 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 100
2013-10-21 11:59:51,599 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 1000
2013-10-21 12:01:41,836 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 100
2013-10-21 12:01:51,838 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 1000
2013-10-21 12:02:01,840 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 100
2013-10-21 12:02:51,845 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 1000
2013-10-21 12:03:01,846 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 100
2013-10-21 12:04:01,853 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 1000
2013-10-21 12:04:21,855 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 100
2013-10-21 12:04:31,857 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 1000
2013-10-21 12:04:41,858 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 100
2013-10-21 12:27:54,270 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 1000
2013-10-21 12:29:54,283 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 100
2013-10-21 12:30:04,284 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 1000
2013-10-21 12:30:54,570 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 100
2013-10-21 12:37:35,804 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 1000
2013-10-21 12:38:26,112 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 100
2013-10-21 13:06:18,380 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 1000
2013-10-21 13:06:28,499 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 100
2013-10-21 13:06:38,500 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 1000
2013-10-21 13:07:18,505 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 100
2013-10-21 13:08:08,510 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 1000
2013-10-21 13:08:18,512 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 100
2013-10-21 13:12:38,768 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 1000
2013-10-21 13:12:58,826 INFO     tuned.plugins.plugin_cpu: setting new cpu latency 100

$ ls /etc/tuned
active_profile
Comment 10 Fedora End Of Life 2015-05-29 05:28:12 EDT
This message is a reminder that Fedora 20 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 20. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as EOL if it remains open with a Fedora  'version'
of '20'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora 20 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.
Comment 11 Fedora End Of Life 2015-06-29 20:42:48 EDT
Fedora 20 changed to end-of-life (EOL) status on 2015-06-23. Fedora 20 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.

Note You need to log in before you can comment on or make changes to this bug.