Hide Forgot
Description of problem: I have enabled kdump on my system, and I am using a locally fedpkg built kernel. SELinux is preventing /usr/sbin/kexec from 'read' accesses on the file /boot/vmlinuz-4.2.0-0.rc0.git1.1.local.fc23.x86_64. ***** Plugin restorecon (99.5 confidence) suggests ************************ If you want to fix the label. /boot/vmlinuz-4.2.0-0.rc0.git1.1.local.fc23.x86_64 default label should be boot_t. Then you can run restorecon. Do # /sbin/restorecon -v /boot/vmlinuz-4.2.0-0.rc0.git1.1.local.fc23.x86_64 ***** Plugin catchall (1.49 confidence) suggests ************************** If you believe that kexec should be allowed read access on the vmlinuz-4.2.0-0.rc0.git1.1.local.fc23.x86_64 file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep kexec /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:kdump_t:s0 Target Context system_u:object_r:modules_object_t:s0 Target Objects /boot/vmlinuz-4.2.0-0.rc0.git1.1.local.fc23.x86_64 [ file ] Source kexec Source Path /usr/sbin/kexec Port <Unknown> Host (removed) Source RPM Packages kexec-tools-2.0.8-8.fc22.x86_64 Target RPM Packages kernel-core-4.2.0-0.rc0.git1.1.local.fc23.x86_64 Policy RPM selinux-policy-3.13.1-128.4.fc22.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 4.2.0-0.rc0.git1.1.local.fc23.x86_64 #1 SMP Thu Jul 9 08:40:29 ACST 2015 x86_64 x86_64 Alert Count 14 First Seen 2015-07-09 10:20:50 ACST Last Seen 2015-07-17 11:03:15 ACST Local ID d907aa73-9912-4a7a-bd85-ccc60f19666a Raw Audit Messages type=AVC msg=audit(1437096795.895:276): avc: denied { read } for pid=2572 comm="kexec" name="vmlinuz-4.2.0-0.rc0.git1.1.local.fc23.x86_64" dev="sda2" ino=157 scontext=system_u:system_r:kdump_t:s0 tcontext=system_u:object_r:modules_object_t:s0 tclass=file permissive=0 type=SYSCALL msg=audit(1437096795.895:276): arch=x86_64 syscall=open success=no exit=EACCES a0=7fff63eb5f55 a1=0 a2=7f17c8d63770 a3=691 items=0 ppid=1397 pid=2572 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=kexec exe=/usr/sbin/kexec subj=system_u:system_r:kdump_t:s0 key=(null) Hash: kexec,kdump_t,modules_object_t,file,read Version-Release number of selected component: selinux-policy-3.13.1-128.4.fc22.noarch Additional info: reporter: libreport-2.6.0 hashmarkername: setroubleshoot kernel: 4.2.0-0.rc0.git1.1.local.fc23.x86_64 type: libreport
*** Bug 1278288 has been marked as a duplicate of this bug. ***
Until the fix from #1247017 is not applied you can follow this step: ***** Plugin restorecon (99.5 confidence) suggests ************************ If you want to fix the label. /boot/vmlinuz-4.2.0-0.rc0.git1.1.local.fc23.x86_64 default label should be boot_t. Then you can run restorecon. Do # /sbin/restorecon -v /boot/vmlinuz-4.2.0-0.rc0.git1.1.local.fc23.x86_64 Could systemd guys merge this patch to f22 branch? http://pkgs.fedoraproject.org/cgit/systemd.git/commit/?id=d4f265678413c7656d78074af12ec7f083b50aac Thank you
*** Bug 1298214 has been marked as a duplicate of this bug. ***
*** Bug 1247017 has been marked as a duplicate of this bug. ***
*** Bug 1305284 has been marked as a duplicate of this bug. ***
systemd-222-15.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2016-ea18762698
systemd-219-28.fc22 has been submitted as an update to Fedora 22. https://bodhi.fedoraproject.org/updates/FEDORA-2016-04b6975be9
systemd-219-28.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-04b6975be9
systemd-222-15.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-ea18762698
Fedora 22 changed to end-of-life (EOL) status on 2016-07-19. Fedora 22 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of Fedora please feel free to reopen this bug against that version. If you are unable to reopen this bug, please file a new report against the current release. If you experience problems, please add a comment to this bug. Thank you for reporting this bug and we are sorry it could not be fixed.