Description of problem: Alert showed up in the graphical SELinux Troubleshooter tool after performing a network install from the current Fedora development 25 (rawhide) tree, fully relabeling the file system and rebooting the system in permissive mode. SELinux is preventing accounts-daemon from 'write' accesses on the directory root. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that accounts-daemon should be allowed write access on the root directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'accounts-daemon' --raw | audit2allow -M my-accountsdaemon # semodule -X 300 -i my-accountsdaemon.pp Additional Information: Source Context system_u:system_r:accountsd_t:s0 Target Context system_u:object_r:admin_home_t:s0 Target Objects root [ dir ] Source accounts-daemon Source Path accounts-daemon Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages filesystem-3.2-37.fc24.x86_64 Policy RPM selinux-policy-3.13.1-193.fc25.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 4.7.0-0.rc1.git3.1.fc25.x86_64 #1 SMP Thu Jun 2 15:45:29 UTC 2016 x86_64 x86_64 Alert Count 1 First Seen 2016-06-04 11:16:31 CEST Last Seen 2016-06-04 11:16:31 CEST Local ID 4cf6afbc-28ad-4b76-9218-9aa86e43f217 Raw Audit Messages type=AVC msg=audit(1465031791.730:94): avc: denied { write } for pid=743 comm="accounts-daemon" name="root" dev="dm-0" ino=655362 scontext=system_u:system_r:accountsd_t:s0 tcontext=system_u:object_r:admin_home_t:s0 tclass=dir permissive=0 Hash: accounts-daemon,accountsd_t,admin_home_t,dir,write Version-Release number of selected component: selinux-policy-3.13.1-193.fc25.noarch Additional info: reporter: libreport-2.7.1 hashmarkername: setroubleshoot kernel: 4.7.0-0.rc1.git3.1.fc25.x86_64 reproducible: Not sure how to reproduce the problem type: libreport Potential duplicate: bug 1341911
Description of problem: Appears on boot of current Rawhide Workstation live with enforcing=0 . If you attempt to boot without enforcing=0, the system never reaches the desktop. There are 3 other alerts, not sure which is the critical one. Version-Release number of selected component: selinux-policy-3.13.1-194.fc25.noarch Additional info: reporter: libreport-2.7.1 hashmarkername: setroubleshoot kernel: 4.7.0-0.rc2.git1.1.fc25.x86_64 reproducible: Not sure how to reproduce the problem type: libreport
Proposing as an F25 Alpha blocker: "All release-blocking images must boot in their supported configurations. ... Release-blocking live images must boot to the expected boot menu, and then to a desktop or to a login prompt where it is clear how to log in to a desktop." - Workstation live does not reach a desktop unless you boot with enforcing=0 . This (and/or the other two related denials I listed in 'See Also') are my best bets as to why.
adding Ray for info, as he's the accountsservice maintainer.
Confirming this also appears to be what prevents a fresh Workstation network install from booting; I see the same denial and can boot with enforcing=0 . (The other two accounts-daemon denials don't happen for this case, though).
probably dupe of bug 1331926. i guess i forgot to do a rawhide build.
Sorry, it's still broken the same way in today's Rawhide nightly, with accountsservice-0.6.42-1.fc25.
Ray, What is state of this issue? Do you need any policy changes?
no sure. I tried to reproduce everything worked for me. adamw mentioned to me on the 15th (on irc) that things were working for him again, too, so I'll just close this WORKSFORME If a problem remanifests we can reopen.
Description of problem: Alert appeared in the SELinux Troubleshooter utility after removing directory /root/.cache and rebooting the system. Version-Release number of selected component: selinux-policy-3.13.1-197.fc25.noarch Additional info: reporter: libreport-2.7.1 hashmarkername: setroubleshoot kernel: 4.7.0-0.rc4.git1.2.fc25.x86_64 reproducible: Not sure how to reproduce the problem type: libreport
(In reply to Joachim Frieben from comment #9) Installed packages include accountsservice-0.6.42-1.fc25.
(In reply to Ray Strode [halfline] from comment #8) As of accountsservice-0.6.42-1.fc25, directory /root/.cache does get created upon reboot every time it has been removed, and this action does trigger an AVC as reported in /var/log/audit/audit.log but currently -not- by the SELinux Troubleshooter utility. This behaviour contradicts the changelog of package accountsservice which states: * Tue May 31 2016 Ray Strode <rstrode redhat com> - 0.6.40-4 - Don't create /root/.cache at startup Resolves: #1331926
does your /usr/lib/systemd/system/accounts-daemon.service have: Environment=GVFS_DISABLE_FUSE=1 Environment=GIO_USE_VFS=local Environment=GVFS_REMOTE_VOLUME_MONITOR_IGNORE=1 in it?
Both Fedora 24 and Fedora 25 include identical files /usr/lib/systemd/system/accounts-daemon.service with content: [Unit] Description=Accounts Service # In order to avoid races with identity-providing services like SSSD or # winbind, we need to ensure that Accounts Service starts after # nss-user-lookup.target After=nss-user-lookup.target Wants=nss-user-lookup.target [Service] Type=dbus BusName=org.freedesktop.Accounts ExecStart=/usr/libexec/accounts-daemon StandardOutput=syslog Environment=GVFS_DISABLE_FUSE=1 Environment=GIO_USE_VFS=local Environment=GVFS_REMOTE_VOLUME_MONITOR_IGNORE=1 [Install] # We pull this in by graphical.target instead of waiting for the bus # activation, to speed things up a little: gdm uses this anyway so it is nice # if it is already around when gdm wants to use it and doesn't have to wait for # it. WantedBy=graphical.target
can you run strings /proc/$(pidof accounds-daemon)/environ and post the output ?
(In reply to Ray Strode [halfline] from comment #14) LANG=en_US.UTF-8 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin GVFS_DISABLE_FUSE=1 GIO_USE_VFS=local GVFS_REMOTE_VOLUME_MONITOR_IGNORE=1
Discussed at 2016-07-20 blocker review meeting: [1]. We decided to remove blocker nomination from this bug. Original bug seems to be already fixed. There is no need to block on this now. If the problem appears again, please repropose. [1] https://meetbot.fedoraproject.org/fedora-blocker-review/2016-07-20/f25-blocker-review.2016-07-20-16.00.html
(In reply to Petr Schindler from comment #16) Comment 11 is still valid even though related AVCs are again reported by the graphical SELinux Troubleshooter utility.
SELinux is preventing accounts-daemon from write access on the directory /root. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that accounts-daemon should be allowed write access on the root directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'accounts-daemon' --raw | audit2allow -M my-accountsdaemon # semodule -X 300 -i my-accountsdaemon.pp Additional Information: Source Context system_u:system_r:accountsd_t:s0 Target Context system_u:object_r:admin_home_t:s0 Target Objects /root [ dir ] Source accounts-daemon Source Path accounts-daemon Port <Unknown> Host noname Source RPM Packages Target RPM Packages filesystem-3.2-37.fc24.x86_64 Policy RPM selinux-policy-3.13.1-203.fc25.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name noname Platform Linux noname 4.7.0-0.rc7.git4.2.fc25.x86_64 #1 SMP Tue Jul 19 15:56:43 UTC 2016 x86_64 x86_64 Alert Count 1 First Seen 2016-07-21 13:35:52 CEST Last Seen 2016-07-21 13:35:52 CEST Local ID a5502fb0-e5b5-4f36-993c-f0d6a463462d Raw Audit Messages type=AVC msg=audit(1469100952.512:91): avc: denied { write } for pid=672 comm="accounts-daemon" name="root" dev="dm-0" ino=262146 scontext=system_u:system_r:accountsd_t:s0 tcontext=system_u:object_r:admin_home_t:s0 tclass=dir permissive=0 Hash: accounts-daemon,accountsd_t,admin_home_t,dir,write
This bug appears to have been reported against 'rawhide' during the Fedora 25 development cycle. Changing version to '25'.
Description of problem: This popped up on me on first boot after a default Workstation Live install (Fedora-Workstation-Live-x86_64-25-20160815.n.2.iso). I just started terminal and ran dnf, nothing else. Not sure whether this occurred before or after. Version-Release number of selected component: selinux-policy-3.13.1-207.fc25.noarch Additional info: reporter: libreport-2.7.2 hashmarkername: setroubleshoot kernel: 4.8.0-0.rc1.git0.1.fc25.x86_64 type: libreport
Proposing as a Final blocker: "There must be no SELinux denial notifications or crash notifications on boot of or during installation from a release-blocking live image, or at first login after a default install of a release-blocking desktop. " https://fedoraproject.org/wiki/Fedora_25_Final_Release_Criteria#SELinux_and_crash_notifications
Description of problem: Bug occurred on booting a F25 Workstation livemedia Version-Release number of selected component: selinux-policy-3.13.1-207.fc25.noarch Additional info: reporter: libreport-2.7.2 hashmarkername: setroubleshoot kernel: 4.8.0-0.rc1.git0.1.fc25.x86_64 type: libreport
Discussed during the 2016-08-22 blocker review meeting: [1] The decision to classify this bug as an AcceptedBlocker was made as it is a clear violation of "There must be no SELinux denial notifications or crash notifications on boot of or during installation from a release-blocking live image, or at first login after a default install of a release-blocking desktop." [1] https://meetbot.fedoraproject.org/fedora-blocker-review/2016-08-22/f25-blocker-review.2016-08-22-16.00.txt
Description of problem: Alert appears after booting from Fedora-Workstation-Live-x86_64-25_Alpha-1.1 media. Version-Release number of selected component: selinux-policy-3.13.1-208.fc25.noarch Additional info: reporter: libreport-2.7.2 hashmarkername: setroubleshoot kernel: 4.8.0-0.rc2.git3.1.fc25.x86_64 type: libreport
selinux-policy-3.13.1-211.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-cbdde50ec4
Description of problem: I booted a Fedora 25 Workstation iso compose (2016-08-27) in a virtual machine using virt-manager and got this selinux alert after boot. Version-Release number of selected component: selinux-policy-3.13.1-208.fc25.noarch Additional info: reporter: libreport-2.7.2 hashmarkername: setroubleshoot kernel: 4.8.0-0.rc2.git3.1.fc25.x86_64 type: libreport
Description of problem: Just run Fedora from live USB Version-Release number of selected component: selinux-policy-3.13.1-208.fc25.noarch Additional info: reporter: libreport-2.7.2 hashmarkername: setroubleshoot kernel: 4.8.0-0.rc2.git3.1.fc25.x86_64 type: libreport
selinux-policy-3.13.1-211.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.
*** Bug 1380849 has been marked as a duplicate of this bug. ***