Bug 1160008 - SELinux is preventing /usr/lib/systemd/systemd-logind from 'mounton' accesses on the directory .
Summary: SELinux is preventing /usr/lib/systemd/systemd-logind from 'mounton' accesses...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 21
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:5062451b53b0075a3f041de0e79...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-11-03 21:03 UTC by Laurent Wandrebeck
Modified: 2014-12-17 12:41 UTC (History)
7 users (show)

Fixed In Version: selinux-policy-3.13.1-99.fc21
Clone Of:
Environment:
Last Closed: 2014-12-03 17:15:24 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Laurent Wandrebeck 2014-11-03 21:03:14 UTC
Description of problem:
Updating to F21 via yum.
SELinux is preventing /usr/lib/systemd/systemd-logind from 'mounton' accesses on the directory .

*****  Plugin catchall (100. confidence) suggests   **************************

If vous pensez que systemd-logind devrait être autorisé à accéder mounton sur  directory par défaut.
Then vous devriez rapporter ceci en tant qu'anomalie.
Vous pouvez générer un module de stratégie local pour autoriser cet accès.
Do
autoriser cet accès pour le moment en exécutant :
# grep systemd-logind /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:systemd_logind_t:s0
Target Context                system_u:object_r:user_tmp_t:s0
Target Objects                 [ dir ]
Source                        systemd-logind
Source Path                   /usr/lib/systemd/systemd-logind
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           systemd-208-25.fc20.x86_64
                              systemd-216-5.fc21.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.12.1-192.fc20.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.16.6-203.fc20.x86_64 #1 SMP Sat
                              Oct 25 12:44:32 UTC 2014 x86_64 x86_64
Alert Count                   2
First Seen                    2014-11-03 22:00:23 CET
Last Seen                     2014-11-03 22:01:01 CET
Local ID                      2ad3fe5d-2674-4a88-8f67-3b54e23682f6

Raw Audit Messages
type=AVC msg=audit(1415048461.608:161): avc:  denied  { mounton } for  pid=7520 comm="systemd-logind" path="/run/user/0" dev="tmpfs" ino=511324 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:user_tmp_t:s0 tclass=dir permissive=0


type=SYSCALL msg=audit(1415048461.608:161): arch=x86_64 syscall=mount success=no exit=EACCES a0=7fe8c40a2e32 a1=7fe8c48ae340 a2=7fe8c40a2e32 a3=6 items=0 ppid=1 pid=7520 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=systemd-logind exe=/usr/lib/systemd/systemd-logind subj=system_u:system_r:systemd_logind_t:s0 key=(null)

Hash: systemd-logind,systemd_logind_t,user_tmp_t,dir,mounton

Additional info:
reporter:       libreport-2.3.0
hashmarkername: setroubleshoot
kernel:         3.16.6-203.fc20.x86_64
type:           libreport

Potential duplicate: bug 1075835

Comment 1 Lukas Vrabec 2014-11-04 11:48:03 UTC
commit 856636f9d072611b17387b1ba072147d14d8731d
Author: Miroslav Grepl <mgrepl>
Date:   Thu Mar 13 15:51:32 2014 +0100

    Allow systemd-logind to mount /run/user/1000 to get gdm working

back ported to F20

Comment 2 Fedora Update System 2014-11-21 12:24:03 UTC
selinux-policy-3.13.1-99.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/selinux-policy-3.13.1-99.fc21

Comment 3 Fedora Update System 2014-12-03 17:15:24 UTC
selinux-policy-3.13.1-99.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.