Description of problem: This happened while dnf was running as root on cli and yumex-dnf was running as admin user looking at the dnf history database. At the same time https://bugzilla.redhat.com/show_bug.cgi?id=1276921 happened. SELinux is preventing find from 'read' accesses on the directory repodata. ***** Plugin catchall (100. confidence) suggests ************************** If sie denken, dass es find standardmässig erlaubt sein sollte, read Zugriff auf repodata directory zu erhalten. Then sie sollten dies als Fehler melden. Um diesen Zugriff zu erlauben, können Sie ein lokales Richtlinien-Modul erstellen. Do zugriff jetzt erlauben, indem Sie die nachfolgenden Befehle ausführen: # grep find /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:abrt_t:s0-s0:c0.c1023 Target Context system_u:object_r:rpm_tmp_t:s0 Target Objects repodata [ dir ] Source find Source Path find Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-152.fc23.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 4.2.3-300.fc23.x86_64 #1 SMP Mon Oct 5 15:42:54 UTC 2015 x86_64 x86_64 Alert Count 7 First Seen 2015-11-01 11:38:20 CET Last Seen 2015-11-01 11:38:20 CET Local ID 7e5cfa36-9dca-4dba-a821-dca0e84692c3 Raw Audit Messages type=AVC msg=audit(1446374300.719:693): avc: denied { read } for pid=15519 comm="find" name="repodata" dev="dm-0" ino=17791 scontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_tmp_t:s0 tclass=dir permissive=0 Hash: find,abrt_t,rpm_tmp_t,dir,read Version-Release number of selected component: selinux-policy-3.13.1-152.fc23.noarch Additional info: reporter: libreport-2.6.3 hashmarkername: setroubleshoot kernel: 4.2.3-300.fc23.x86_64 type: libreport
Description of problem: I used DNF at that time. Version-Release number of selected component: selinux-policy-3.13.1-152.fc23.noarch Additional info: reporter: libreport-2.6.3 hashmarkername: setroubleshoot kernel: 4.2.5-300.fc23.x86_64 type: libreport
Description of problem: put "n" as answer to update or not question from dnf : ... ... Upgrade 56 Packages Total download size: 122 M Is this ok [y/N]: n Traceback (most recent call last): File "/bin/dnf", line 35, in <module> main.user_main(sys.argv[1:], exit_code=True) File "/usr/lib/python3.4/site-packages/dnf/cli/main.py", line 198, in user_main errcode = main(args) File "/usr/lib/python3.4/site-packages/dnf/cli/main.py", line 84, in main return _main(base, args) File "/usr/lib/python3.4/site-packages/dnf/cli/main.py", line 144, in _main ret = resolving(cli, base) File "/usr/lib/python3.4/site-packages/dnf/cli/main.py", line 173, in resolving base.do_transaction(display=displays) File "/usr/lib/python3.4/site-packages/dnf/cli/cli.py", line 200, in do_transaction if self.conf.assumeno or not self.output.userconfirm(): File "/usr/lib/python3.4/site-packages/dnf/cli/output.py", line 631, in userconfirm choice = dnf.i18n.ucd_input(msg) File "/usr/lib/python3.4/site-packages/dnf/i18n.py", line 109, in ucd_input return dnf.pycomp.raw_input() UnicodeDecodeError: 'utf-8' codec can't decode bytes in position 0-1: invalid continuation byte [sheepdestroyer@sheepora ~] $ Version-Release number of selected component: selinux-policy-3.13.1-153.fc23.noarch Additional info: reporter: libreport-2.6.3 hashmarkername: setroubleshoot kernel: 4.2.5-300.fc23.x86_64 type: libreport
This AVC is probably caused by dnf's EVENT=notify script which is run by abrtd: https://github.com/rpm-software-management/dnf/blob/master/etc/collect_dnf.conf Mirek, can you please take a look at the script? The script makes copies of files from /var/cache/dnf, /var/tmp/dnf-${username}-* and /var/log/dnf.log and /var/log/dnf.transaction.log
In this case we should allow it.
Description of problem: Error was probably caused by DNF automatic updates. Version-Release number of selected component: selinux-policy-3.13.1-158.6.fc23.noarch Additional info: reporter: libreport-2.6.4 hashmarkername: setroubleshoot kernel: 4.3.5-300.fc23.x86_64 type: libreport
Description of problem: just run sudo dnf clean all Version-Release number of selected component: selinux-policy-3.13.1-158.6.fc23.noarch Additional info: reporter: libreport-2.6.4 hashmarkername: setroubleshoot kernel: 4.3.5-300.fc23.x86_64 type: libreport
Still present with selinux-policy-targeted-3.13.1-180.fc24.noarch
Hi, Do you know where is repodata dir stored? I believe this dir should have rpm_var_cache_t label. Then, we have rules for this action. $ sesearch -A -s abrt_t -t rpm_var_cache_t -p read -c dir Found 1 semantic av rules: allow abrt_t rpm_var_cache_t : dir { ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open } ;
@Lukas vrabec: I don't have any clue, no. Is there any file name or extension I can search for? I would expect it to be somewhere below /var/cache/dnf or /var/lib/dnf, since both dnf and yumex-dnf are using dnf api.
*** Bug 1327241 has been marked as a duplicate of this bug. ***
There is no `sesearch` command on my computer and `dnf provides sesearch` doesn't find one either.
dnf install setools-console
Looks the same here: $ sesearch -A -s abrt_t -t rpm_var_cache_t -p read -c dir Found 1 semantic av rules: allow abrt_t rpm_var_cache_t : dir { ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open } ;
*** Bug 1344375 has been marked as a duplicate of this bug. ***
Description of problem: I was installing OSSEC client on Fedora 24. The commands that I ran were as follows: # wget -q -O – https://www.atomicorp.com/installers/atomic | sh # dnf install ossec-hids ossec-hids-client The following error came up after entering the second command: Running transaction Installing : inotify-tools-3.14-10.fc24.x86_64 1/3 Installing : ossec-hids-2.8.3-51.fc24.art.x86_64 2/3 Installing : ossec-hids-client-2.8.3-51.fc24.art.x86_64 3/3 Restarting ossec-hids (via systemctl): Job for ossec-hids.service failed because the control process exited with error code. See "systemctl status ossec-hids.service" and "journalctl -xe" for details. [FAILED] ^Cwarning: %triggerin(man-db-2.7.5-3.fc24.x86_64) scriptlet failed, signal 2 Traceback (most recent call last): File "/usr/lib/python3.5/site-packages/dnf/yum/rpmtrans.py", line 427, in callback self._scriptError(bytes, total, h) File "/usr/lib/python3.5/site-packages/dnf/yum/rpmtrans.py", line 557, in _scriptError pkg, _, _ = self._extract_cbkey(h) File "/usr/lib/python3.5/site-packages/dnf/yum/rpmtrans.py", line 229, in _extract_cbkey return self._extract_str_cbkey(cbkey) File "/usr/lib/python3.5/site-packages/dnf/yum/rpmtrans.py", line 237, in _extract_str_cbkey assert(isinstance(name, basestring)) AssertionError FATAL ERROR: python callback ??? failed, aborting! I am not sure how to reproduce. Version-Release number of selected component: selinux-policy-3.13.1-190.fc24.noarch Additional info: reporter: libreport-2.7.1 hashmarkername: setroubleshoot kernel: 4.5.7-300.fc24.x86_64 reproducible: Not sure how to reproduce the problem type: libreport
Description of problem: Not sure what caused this. Version-Release number of selected component: selinux-policy-3.13.1-158.fc23.noarch Additional info: reporter: libreport-2.7.2 hashmarkername: setroubleshoot kernel: 4.6.4-301.fc24.x86_64 type: libreport
Description of problem: I was running "sudo dnf update". At the end of the process the window was freeze. Version-Release number of selected component: selinux-policy-3.13.1-191.14.fc24.noarch Additional info: reporter: libreport-2.7.2 hashmarkername: setroubleshoot kernel: 4.7.2-201.fc24.x86_64 type: libreport
selinux-policy-3.13.1-191.16.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-fe39b806b6
selinux-policy-3.13.1-191.16.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.
Description of problem: i dnf update esecute the command but the system interrupt Version-Release number of selected component: selinux-policy-3.13.1-190.fc24.noarch Additional info: reporter: libreport-2.7.1 hashmarkername: setroubleshoot kernel: 4.7.5-200.fc24.x86_64 reproducible: Not sure how to reproduce the problem type: libreport