Hi, Please attach: $ ps -efZ | grep unconfined_service_t
This just means that a process running as unconfined_service_t during boot created a kernel keyring owned by root. Then sssd_t tries to read it. I would just allow it. We have never gotten a good handle on confining the kernel keyring. Most likely one of these processes created the keyring. system_u:system_r:unconfined_service_t:s0 root 897 1 0 09:21 ? 00:00:00 /sbin/rngd -f This process is running with the wrong label. restorecon -f /sbin/rngd, to see if this fixed the label. system_u:system_r:unconfined_service_t:s0 redis 1411 1 0 09:22 ? 00:00:00 /usr/bin/redis-server 127.0.0.1:6379 Same thing here restorecon -v /usr/bin/redis-server Could be some other bin_t process is starting these domains. system_u:system_r:unconfined_service_t:s0 pcp 3385 1 0 09:22 ? 00:00:00 pmlogger -P -r -T24h10m -c config.default -m pmlogger_check 20150427.09.22 system_u:system_r:unconfined_service_t:s0 streeter 3927 3897 0 09:22 ? restorecon -v /usr/bin/pmlogger 00:00:00 ssh -x -a -oClearAllForwardings=yes -2 streeter.hst.phx2.redhat.com -s sftp system_u:system_r:unconfined_service_t:s0 streeter 4242 3897 0 09:22 ? 00:00:00 /usr/bin/sshfs streeter.hst.phx2.redhat.com:/srv/collabrador /home/streeter/collabrador unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 streeter 6628 5652 0 09:25 pts/0 00:00:00 grep --color=auto unconfined_service_t Are you launching ssh from a service script/unit file?
Thank you Dan for the detailed analysis. I think it's time to move the bug to selinux-policy b/c it looks like you'll want to allow reading unconfined keyring..
This message is a reminder that Fedora 21 is nearing its end of life. Approximately 4 (four) weeks from now Fedora will stop maintaining and issuing updates for Fedora 21. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a Fedora 'version' of '21'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora 21 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior this bug is closed as described in the policy above. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete.
Hi, Any update here? Could you still reproduce this issue?
I don't see this on Fedora 23.
Thank you.