Bug 1266635 - selinux preventing systemd-logind from reading efi variables
selinux preventing systemd-logind from reading efi variables
Status: CLOSED RAWHIDE
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
rawhide
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Miroslav Grepl
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2015-09-25 19:37 EDT by Kevin Fenzi
Modified: 2015-10-12 08:26 EDT (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-10-12 08:26:08 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Kevin Fenzi 2015-09-25 19:37:37 EDT
On boot I am seeing: 

Sep 25 17:26:38 voldemort.scrye.com audit[1221]: AVC avc:  denied  { read } for  pid=1221 comm="systemd-logind" name="OsIndicationsSupported-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=10917 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
Sep 25 17:26:38 voldemort.scrye.com audit[1221]: AVC avc:  denied  { open } for  pid=1221 comm="systemd-logind" path="/sys/firmware/efi/efivars/OsIndicationsSupported-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=10917 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
Sep 25 17:26:38 voldemort.scrye.com audit[1221]: AVC avc:  denied  { getattr } for  pid=1221 comm="systemd-logind" path="/sys/firmware/efi/efivars/OsIndicationsSupported-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=10917 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
Sep 25 17:26:39 voldemort.scrye.com audit[1221]: AVC avc:  denied  { read } for  pid=1221 comm="systemd-logind" name="OsIndicationsSupported-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=10917 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
Sep 25 17:26:39 voldemort.scrye.com audit[1221]: AVC avc:  denied  { open } for  pid=1221 comm="systemd-logind" path="/sys/firmware/efi/efivars/OsIndicationsSupported-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=10917 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
Sep 25 17:26:39 voldemort.scrye.com audit[1221]: AVC avc:  denied  { getattr } for  pid=1221 comm="systemd-logind" path="/sys/firmware/efi/efivars/OsIndicationsSupported-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=10917 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
Sep 25 17:26:42 voldemort.scrye.com audit[1221]: AVC avc:  denied  { read } for  pid=1221 comm="systemd-logind" name="OsIndicationsSupported-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=10917 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
Sep 25 17:26:42 voldemort.scrye.com audit[1221]: AVC avc:  denied  { open } for  pid=1221 comm="systemd-logind" path="/sys/firmware/efi/efivars/OsIndicationsSupported-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=10917 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
Sep 25 17:26:42 voldemort.scrye.com audit[1221]: AVC avc:  denied  { getattr } for  pid=1221 comm="systemd-logind" path="/sys/firmware/efi/efivars/OsIndicationsSupported-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=10917 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
Sep 25 17:26:44 voldemort.scrye.com audit[1221]: AVC avc:  denied  { read } for  pid=1221 comm="systemd-logind" name="OsIndicationsSupported-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=10917 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
Sep 25 17:26:44 voldemort.scrye.com audit[1221]: AVC avc:  denied  { open } for  pid=1221 comm="systemd-logind" path="/sys/firmware/efi/efivars/OsIndicationsSupported-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=10917 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
Sep 25 17:26:44 voldemort.scrye.com audit[1221]: AVC avc:  denied  { getattr } for  pid=1221 comm="systemd-logind" path="/sys/firmware/efi/efivars/OsIndicationsSupported-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=10917 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
Sep 25 17:26:44 voldemort.scrye.com audit[1221]: AVC avc:  denied  { read } for  pid=1221 comm="systemd-logind" name="OsIndicationsSupported-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=10917 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
Sep 25 17:26:44 voldemort.scrye.com audit[1221]: AVC avc:  denied  { open } for  pid=1221 comm="systemd-logind" path="/sys/firmware/efi/efivars/OsIndicationsSupported-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=10917 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
Sep 25 17:26:44 voldemort.scrye.com audit[1221]: AVC avc:  denied  { getattr } for  pid=1221 comm="systemd-logind" path="/sys/firmware/efi/efivars/OsIndicationsSupported-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=10917 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
Sep 25 17:26:58 voldemort.scrye.com audit[1221]: AVC avc:  denied  { read } for  pid=1221 comm="systemd-logind" name="OsIndicationsSupported-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=10917 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
Sep 25 17:26:58 voldemort.scrye.com audit[1221]: AVC avc:  denied  { open } for  pid=1221 comm="systemd-logind" path="/sys/firmware/efi/efivars/OsIndicationsSupported-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=10917 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
Sep 25 17:26:58 voldemort.scrye.com audit[1221]: AVC avc:  denied  { getattr } for  pid=1221 comm="systemd-logind" path="/sys/firmware/efi/efivars/OsIndicationsSupported-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=10917 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
Sep 25 17:26:58 voldemort.scrye.com audit[1221]: AVC avc:  denied  { read } for  pid=1221 comm="systemd-logind" name="OsIndicationsSupported-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=10917 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
Sep 25 17:26:58 voldemort.scrye.com audit[1221]: AVC avc:  denied  { open } for  pid=1221 comm="systemd-logind" path="/sys/firmware/efi/efivars/OsIndicationsSupported-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=10917 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
Sep 25 17:26:58 voldemort.scrye.com audit[1221]: AVC avc:  denied  { getattr } for  pid=1221 comm="systemd-logind" path="/sys/firmware/efi/efivars/OsIndicationsSupported-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=10917 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
Sep 25 17:26:59 voldemort.scrye.com audit[1221]: AVC avc:  denied  { read } for  pid=1221 comm="systemd-logind" name="OsIndicationsSupported-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=10917 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
Sep 25 17:26:59 voldemort.scrye.com audit[1221]: AVC avc:  denied  { open } for  pid=1221 comm="systemd-logind" path="/sys/firmware/efi/efivars/OsIndicationsSupported-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=10917 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
Sep 25 17:26:59 voldemort.scrye.com audit[1221]: AVC avc:  denied  { getattr } for  pid=1221 comm="systemd-logind" path="/sys/firmware/efi/efivars/OsIndicationsSupported-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=10917 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
Comment 1 Miroslav Grepl 2015-10-12 08:26:08 EDT
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
index 8209291..92de375 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
@@ -106,6 +106,9 @@ files_delete_tmpfs_files(systemd_logind_t)
 fs_mount_tmpfs(systemd_logind_t)
 fs_unmount_tmpfs(systemd_logind_t)
 fs_list_tmpfs(systemd_logind_t)
+
+fs_read_efivarfs_files(systemd_logind_t)


Please update to the latest rawhide. Thank you.

Note You need to log in before you can comment on or make changes to this bug.