Bug 1288822 - SELinux is preventing /usr/lib/systemd/systemd-logind from 'getattr' accesses on the file /dev/shm/lldpad.state.
SELinux is preventing /usr/lib/systemd/systemd-logind from 'getattr' accesses...
Status: CLOSED EOL
Product: Fedora
Classification: Fedora
Component: systemd (Show other bugs)
22
x86_64 Unspecified
high Severity medium
: ---
: ---
Assigned To: systemd-maint
Fedora Extras Quality Assurance
abrt_hash:06792b7dfe1e4a2cbe2df373025...
: Reopened
: 1290768 (view as bug list)
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2015-12-06 05:01 EST by Frank Büttner
Modified: 2017-01-04 19:39 EST (History)
26 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-07-19 16:24:06 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Frank Büttner 2015-12-06 05:01:20 EST
Description of problem:
SELinux is preventing /usr/lib/systemd/systemd-logind from 'getattr' accesses on the file /dev/shm/lldpad.state.

*****  Plugin catchall (100. confidence) suggests   **************************

If sie denken, dass es systemd-logind standardmässig erlaubt sein sollte, getattr Zugriff auf lldpad.state file zu erhalten.
Then sie sollten dies als Fehler melden.
Um diesen Zugriff zu erlauben, können Sie ein lokales Richtlinien-Modul erstellen.
Do
zugriff jetzt erlauben, indem Sie die nachfolgenden Befehle ausführen:
# grep systemd-logind /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:systemd_logind_t:s0
Target Context                system_u:object_r:tmpfs_t:s0
Target Objects                /dev/shm/lldpad.state [ file ]
Source                        systemd-logind
Source Path                   /usr/lib/systemd/systemd-logind
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           systemd-219-25.fc22.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-128.21.fc22.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 4.2.6-201.fc22.x86_64 #1 SMP Tue
                              Nov 24 18:42:39 UTC 2015 x86_64 x86_64
Alert Count                   1
First Seen                    2015-12-06 11:00:07 CET
Last Seen                     2015-12-06 11:00:07 CET
Local ID                      e14f762a-7461-4628-8d26-9dde949ff669

Raw Audit Messages
type=AVC msg=audit(1449396007.765:451): avc:  denied  { getattr } for  pid=953 comm="systemd-logind" path="/dev/shm/lldpad.state" dev="tmpfs" ino=1262 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file permissive=0


type=SYSCALL msg=audit(1449396007.765:451): arch=x86_64 syscall=newfstatat success=no exit=EACCES a0=23 a1=55db111e289b a2=7ffcf5d66670 a3=100 items=0 ppid=1 pid=953 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=systemd-logind exe=/usr/lib/systemd/systemd-logind subj=system_u:system_r:systemd_logind_t:s0 key=(null)

Hash: systemd-logind,systemd_logind_t,tmpfs_t,file,getattr

Version-Release number of selected component:
selinux-policy-3.13.1-128.21.fc22.noarch

Additional info:
reporter:       libreport-2.6.3
hashmarkername: setroubleshoot
kernel:         4.2.6-201.fc22.x86_64
type:           libreport

Potential duplicate: bug 1190461
Comment 1 Lukas Vrabec 2015-12-08 08:48:13 EST
Hi, 
Please, use:
#restorecon -v /dev/shm/lldpad.state

To fix this issue.

I tried to reproduce this issue, and after lldpad service start it's created "/dev/shm/lldpad.state" with right label: "lldpad_tmpfs_t" on my F22. 

[fedora@fedora ~]$ sesearch -A -s systemd_logind_t -t lldpad_tmpfs_t 
Found 1 semantic av rules:
   allow systemd_logind_t tmpfsfile : file { getattr unlink } ; 

[fedora@fedora ~]$ rpm -q selinux-policy
selinux-policy-3.13.1-128.21.fc22.noarch

Closing for now, please re-open if you find some troubles.
Thank you.
Comment 2 Frank Büttner 2015-12-08 09:41:06 EST
This will not work.
ll -Z /dev/shm/lldpad.state 
-rw-------. 1 root root system_u:object_r:tmpfs_t:s0 4096  8. Dez 09:09 /dev/shm/lldpad.state

restorecon -v /dev/shm/lldpad.state
restorecon:  Warning no default label for /dev/shm/lldpad.state

rpm -q selinux-policy
selinux-policy-3.13.1-128.21.fc22.noarch
Comment 3 Lukas Vrabec 2015-12-08 11:03:22 EST
Coudl you attach output of:
# matchpathcon /dev/shm/lldpad.state
# sesearch -A -s systemd_logind_t -t tmpfsfile
# ps -efZ | grep lldpad

Thank you.
Comment 4 Frank Büttner 2015-12-08 11:14:19 EST
Hello, here the needed informations:

matchpathcon /dev/shm/lldpad.state
/dev/shm/lldpad.state	<<none>>

sesearch -A -s systemd_logind_t -t tmpfsfile
Found 3 semantic av rules:
   allow daemon user_tmp_t : file { getattr append } ; 
   allow systemd_logind_t user_tmp_t : dir { getattr mounton search open } ; 
   allow systemd_logind_t tmpfsfile : file { getattr unlink } ; 


ps -efZ | grep lldpad
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 16396 16245  0 17:13 pts/1 00:00:00 grep --color=auto lldpad


I hope it will help.
Comment 5 Lukas Vrabec 2015-12-08 11:20:58 EST
This is weird, 
Here is file, where I added labeling for this in August. 

$ git blame lldpad.fc
6232c2fb (Dominick Grift 2012-09-11 12:26:25 +0200 1) /etc/rc\.d/init\.d/lldpad --      gen_context(system_u:object_r:lldpad_initrc_exec_t,s0)
6232c2fb (Dominick Grift 2012-09-11 12:26:25 +0200 2) 
6232c2fb (Dominick Grift 2012-09-11 12:26:25 +0200 3) /usr/sbin/lldpad  --      gen_context(system_u:object_r:lldpad_exec_t,s0)
6232c2fb (Dominick Grift 2012-09-11 12:26:25 +0200 4) 
6232c2fb (Dominick Grift 2012-09-11 12:26:25 +0200 5) /var/lib/lldpad(/.*)?     gen_context(system_u:object_r:lldpad_var_lib_t,s0)
6232c2fb (Dominick Grift 2012-09-11 12:26:25 +0200 6) 
6232c2fb (Dominick Grift 2012-09-11 12:26:25 +0200 7) /var/run/lldpad.* gen_context(system_u:object_r:lldpad_var_run_t,s0)
732fbe7e (Lukas Vrabec   2015-08-12 17:37:31 +0200 8) 
732fbe7e (Lukas Vrabec   2015-08-12 17:37:31 +0200 9) /dev/shm/lldpad.*   --  gen_context(system_u:object_r:lldpad_tmpfs_t,s0)

How you started this service? By hand or by systemctl?
Comment 6 Frank Büttner 2015-12-08 13:31:10 EST
systemctl status lldpad.service 
● lldpad.service - Link Layer Discovery Protocol Agent Daemon.
   Loaded: loaded (/usr/lib/systemd/system/lldpad.service; disabled; vendor preset: disabled)
   Active: inactive (dead)

systemctl status lldpad.socket 
● lldpad.socket
   Loaded: loaded (/usr/lib/systemd/system/lldpad.socket; disabled; vendor preset: disabled)
   Active: inactive (dead)
   Listen: @/com/intel/lldpad (Datagram)


I don't start it by hand.
Comment 7 Dave Allan 2015-12-10 14:08:05 EST
Description of problem:
Unsure, someone was SSH'd into my system at the time, which is unusual, and this is the first I've seen the denial, so they may be related, but that's pure speculation.

Version-Release number of selected component:
selinux-policy-3.13.1-128.21.fc22.noarch

Additional info:
reporter:       libreport-2.6.3
hashmarkername: setroubleshoot
kernel:         4.2.6-201.fc22.x86_64
type:           libreport
Comment 9 Frank Büttner 2015-12-13 05:18:12 EST
Description of problem:
Run bareos backup software.

Version-Release number of selected component:
selinux-policy-3.13.1-128.21.fc22.noarch

Additional info:
reporter:       libreport-2.6.3
hashmarkername: setroubleshoot
kernel:         4.2.6-201.fc22.x86_64
type:           libreport
Comment 10 Lukas Vrabec 2015-12-15 10:42:56 EST
*** Bug 1290768 has been marked as a duplicate of this bug. ***
Comment 11 morgan read 2016-01-03 16:03:46 EST
Description of problem:
logged in

Version-Release number of selected component:
selinux-policy-3.13.1-128.21.fc22.noarch

Additional info:
reporter:       libreport-2.6.3
hashmarkername: setroubleshoot
kernel:         4.2.8-200.fc22.x86_64
type:           libreport
Comment 12 morgan read 2016-01-26 17:30:32 EST
Description of problem:
Recently switched user and back

Version-Release number of selected component:
selinux-policy-3.13.1-128.21.fc22.noarch

Additional info:
reporter:       libreport-2.6.3
hashmarkername: setroubleshoot
kernel:         4.2.8-200.fc22.x86_64
type:           libreport
Comment 13 Peter H. Jones 2016-01-29 13:21:18 EST
Got it in kernel-4.3.4-200.fc22.x86_64:
SELinux is preventing systemd-logind from getattr access on the file /dev/shm/lldpad.state.

*****  Plugin restorecon (99.5 confidence) suggests   ************************

If you want to fix the label. 
/dev/shm/lldpad.state default label should be lldpad_tmpfs_t.
Then you can run restorecon.
Do
# /sbin/restorecon -v /dev/shm/lldpad.state

*****  Plugin catchall (1.49 confidence) suggests   **************************

If you believe that systemd-logind should be allowed getattr access on the lldpad.state file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep systemd-logind /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:systemd_logind_t:s0
Target Context                system_u:object_r:tmpfs_t:s0
Target Objects                /dev/shm/lldpad.state [ file ]
Source                        systemd-logind
Source Path                   systemd-logind
Port                          <Unknown>
Host                          localhost.localdomain
Source RPM Packages           systemd-219-26.fc22.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-128.22.fc22.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     localhost.localdomain
Platform                      Linux localhost.localdomain 4.2.8-200.fc22.x86_64
                              #1 SMP Tue Dec 15 16:50:23 UTC 2015 x86_64 x86_64
Alert Count                   2
First Seen                    2016-01-02 13:40:40 EST
Last Seen                     2016-01-02 19:39:38 EST
Local ID                      e22acacc-f108-4dfb-9977-202897294d69

Raw Audit Messages
type=AVC msg=audit(1451781578.283:1239): avc:  denied  { getattr } for  pid=1208 comm="systemd-logind" path="/dev/shm/lldpad.state" dev="tmpfs" ino=9754 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file permissive=0


type=SYSCALL msg=audit(1451781578.283:1239): arch=x86_64 syscall=newfstatat success=no exit=EACCES a0=21 a1=55c9bbf184a3 a2=7ffd36631570 a3=100 items=1 ppid=1 pid=1208 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=systemd-logind exe=/usr/lib/systemd/systemd-logind subj=system_u:system_r:systemd_logind_t:s0 key=(null)

type=CWD msg=audit(1451781578.283:1239): cwd=/

type=PATH msg=audit(1451781578.283:1239): item=0 name=lldpad.state inode=9754 dev=00:13 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tmpfs_t:s0 nametype=NORMAL

Hash: systemd-logind,systemd_logind_t,tmpfs_t,file,getattr
""
Comment 14 Madd Sauer 2016-02-13 07:59:36 EST
Description of problem:
add a P-ATA disk via converter (PATA to USB) onto a USB 3 Serial Bus

Version-Release number of selected component:
selinux-policy-3.13.1-158.2.fc23.noarch

Additional info:
reporter:       libreport-2.6.3
hashmarkername: setroubleshoot
kernel:         4.2.8-300.fc23.x86_64
type:           libreport
Comment 15 morgan read 2016-02-22 07:09:56 EST
Description of problem:
logging back in after switching user to another account

Version-Release number of selected component:
selinux-policy-3.13.1-128.21.fc22.noarch

Additional info:
reporter:       libreport-2.6.4
hashmarkername: setroubleshoot
kernel:         4.3.4-200.fc22.x86_64
type:           libreport
Comment 16 morgan read 2016-03-04 16:50:18 EST
Description of problem:
logged out and in from another account

Version-Release number of selected component:
selinux-policy-3.13.1-128.21.fc22.noarch

Additional info:
reporter:       libreport-2.6.4
hashmarkername: setroubleshoot
kernel:         4.3.6-201.fc22.x86_64
type:           libreport
Comment 17 Wilf 2016-03-30 17:17:05 EDT
Description of problem:
Seems to happen with Xfce, possibly related to testing a game under Wine

Version-Release number of selected component:
selinux-policy-3.13.1-128.21.fc22.noarch

Additional info:
reporter:       libreport-2.6.4
hashmarkername: setroubleshoot
kernel:         4.4.6-200.fc22.x86_64
type:           libreport
Comment 18 morgan read 2016-04-16 13:13:49 EDT
Description of problem:
logged in

Version-Release number of selected component:
selinux-policy-3.13.1-128.21.fc22.noarch

Additional info:
reporter:       libreport-2.6.4
hashmarkername: setroubleshoot
kernel:         4.4.6-201.fc22.x86_64
type:           libreport
Comment 19 Lukas Vrabec 2016-04-18 07:33:58 EDT
Same issue is here for F23: https://bugzilla.redhat.com/show_bug.cgi?id=1284293
Comment 20 Harald Hoyer 2016-04-22 05:17:39 EDT
would be fixed by a newer systemd:

https://github.com/systemd/systemd/pull/3039
Comment 21 morgan read 2016-06-11 08:55:35 EDT
Description of problem:
switched user back and forth

Version-Release number of selected component:
selinux-policy-3.13.1-128.28.fc22.noarch

Additional info:
reporter:       libreport-2.6.4
hashmarkername: setroubleshoot
kernel:         4.4.11-200.fc22.x86_64
type:           libreport
Comment 22 morgan read 2016-06-23 10:29:25 EDT
Description of problem:
First I knew of bug was abrt alert.

Version-Release number of selected component:
selinux-policy-3.13.1-128.28.fc22.noarch

Additional info:
reporter:       libreport-2.6.4
hashmarkername: setroubleshoot
kernel:         4.4.13-200.fc22.x86_64
type:           libreport
Comment 23 Jeff Layton 2016-06-27 10:36:27 EDT
Description of problem:
I'm seeing this every time the machine boots.

Version-Release number of selected component:
selinux-policy-3.13.1-158.15.fc23.noarch

Additional info:
reporter:       libreport-2.6.4
hashmarkername: setroubleshoot
kernel:         4.5.7-200.fc23.x86_64
type:           libreport
Comment 24 Fedora End Of Life 2016-07-19 16:24:06 EDT
Fedora 22 changed to end-of-life (EOL) status on 2016-07-19. Fedora 22 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.
Comment 25 Luis Alamilla 2016-07-29 10:53:34 EDT
Description of problem:
Unicamente se inició sesion con una cuenta nueva, incluso se establecio la contraseña al momento.

Version-Release number of selected component:
selinux-policy-3.13.1-128.28.fc22.noarch

Additional info:
reporter:       libreport-2.6.4
hashmarkername: setroubleshoot
kernel:         4.4.14-200.fc22.x86_64
type:           libreport
Comment 26 Jake Jackson 2016-07-30 03:09:19 EDT
Description of problem:
Launched gparted,...

Version-Release number of selected component:
selinux-policy-3.13.1-158.15.fc23.noarch

Additional info:
reporter:       libreport-2.6.4
hashmarkername: setroubleshoot
kernel:         4.5.7-202.fc23.x86_64
type:           libreport

Note You need to log in before you can comment on or make changes to this bug.