Bug 1253604 - SELinux is preventing /usr/bin/bash from 'write' accesses on the directory addons.
SELinux is preventing /usr/bin/bash from 'write' accesses on the directory ad...
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
x86_64 Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Miroslav Grepl
Fedora Extras Quality Assurance
Depends On:
  Show dependency treegraph
Reported: 2015-08-14 04:52 EDT by Yajo
Modified: 2015-08-14 07:07 EDT (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2015-08-14 06:34:11 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Yajo 2015-08-14 04:52:59 EDT
Description of problem:
Like bug 1234757 comment 2, after doing `restorecon -RF .`.
SELinux is preventing /usr/bin/bash from 'write' accesses on the directory addons.

*****  Plugin catchall (100. confidence) suggests   **************************

If cree que de manera predeterminada, bash debería permitir acceso write sobre  addons directory.     
Then debería reportar esto como un error.
Puede generar un módulo de política local para permitir este acceso.
permita el acceso momentáneamente executando:
# grep launch /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:svirt_lxc_net_t:s0:c411,c529
Target Context                unconfined_u:object_r:user_home_t:s0
Target Objects                addons [ dir ]
Source                        launch
Source Path                   /usr/bin/bash
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           bash-4.3.39-6.fc22.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-128.8.fc22.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 4.1.4-200.fc22.x86_64 #1 SMP Tue
                              Aug 4 03:22:33 UTC 2015 x86_64 x86_64
Alert Count                   1
First Seen                    2015-08-14 10:51:47 CEST
Last Seen                     2015-08-14 10:51:47 CEST
Local ID                      3e8a3aee-35bb-4cde-9eda-7a60fc7423bc

Raw Audit Messages
type=AVC msg=audit(1439542307.668:871): avc:  denied  { write } for  pid=15565 comm="launch" name="addons" dev="dm-2" ino=2491404 scontext=system_u:system_r:svirt_lxc_net_t:s0:c411,c529 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir permissive=0

type=SYSCALL msg=audit(1439542307.668:871): arch=x86_64 syscall=faccessat success=no exit=EACCES a0=ffffffffffffff9c a1=26374c0 a2=2 a3=7fff4eef67e0 items=0 ppid=11998 pid=15565 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=launch exe=/usr/bin/bash subj=system_u:system_r:svirt_lxc_net_t:s0:c411,c529 key=(null)

Hash: launch,svirt_lxc_net_t,user_home_t,dir,write

Version-Release number of selected component:

Additional info:
reporter:       libreport-2.6.2
hashmarkername: setroubleshoot
kernel:         4.1.4-200.fc22.x86_64
type:           libreport
Comment 1 Daniel Walsh 2015-08-14 06:34:11 EDT
Are you volume mounting this directory into a container?  Doing a restorecon -RF forced the label of the volume back to user_home_t.

If you want to use this volume in your container, you need to change its label back to svirt_sandbox_file_t.

chcon -r -t svirt_sandbox_file_t -l s0:c411,c529 addons

Should fix your problem.
Comment 2 Yajo 2015-08-14 07:07:28 EDT

Note You need to log in before you can comment on or make changes to this bug.