Bug 1316278 - incorrect SELinux label on /sys/fs/cgroup and restorecon fails with "Read-only file system"
incorrect SELinux label on /sys/fs/cgroup and restorecon fails with "Read-onl...
Status: NEW
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: systemd (Show other bugs)
7.2
Unspecified Linux
medium Severity medium
: rc
: ---
Assigned To: systemd-maint
qe-baseos-daemons
:
Depends On:
Blocks: 1420851 1481966
  Show dependency treegraph
 
Reported: 2016-03-09 16:10 EST by k2eric
Modified: 2017-08-16 03:51 EDT (History)
9 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1481966 (view as bug list)
Environment:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
CentOS 0010078 None None None 2016-03-09 16:10 EST
Red Hat Knowledge Base (Solution) 3005761 None None None 2017-04-19 02:54 EDT

  None (edit)
Description k2eric 2016-03-09 16:10:39 EST
Description of problem:

(originally reported on the CentOS bug tracker and someone suggested that I should report here instead)

/sys/fs/cgroup is currently assigned the incorrect SELinux label of

system_u:object_r:tmpfs_t:s0

but restorecon reports that it should be

system_u:object_r:cgroup_t:s0

restorecon is unable to fix the issue as it returns an error: Read-only file system


Version-Release number of selected component (if applicable):

CentOS 7.2.1511

selinux-policy 3.13.1 (release 60.el7_2.3, Based off of reference policy: Checked out revision  2.20091117)


How reproducible:

always


Steps to Reproduce:

1. run ls -aZ /sys/fs/cgroup to verify directory has label of system_u:object_r:tmpfs_t:s0

2. run sudo restorecon -v /sys/fs/cgroup to correct the label


Actual results:

You will see the following error message:

restorecon set context /sys/fs/cgroup->system_u:object_r:cgroup_t:s0 failed:'Read-only file system'


Expected results:

restorecon should have have corrected the label of /sys/fs/cgroup to system_u:object_r:cgroup_t


Additional info:

You can confirm the correct label here:

https://github.com/TresysTechnology/refpolicy/blob/778dfaf776800887d1f9c320a7ac6199139b694b/policy/modules/kernel/filesystem.fc#L14 [^]
Comment 3 Lukas Vrabec 2016-07-12 10:23:12 EDT
I cannot remember. But I don't think so.
Comment 6 Lukas Vrabec 2017-08-16 03:46:36 EDT
This should be fixed in systemd code. 

Michal, 
Could you add labeling for /sys/fs/cgroup dir cgroup_t ? 

Thanks.

Note You need to log in before you can comment on or make changes to this bug.