Description of problem: Booted Workstation Live 20160815.n.2 and started anaconda. SELinux is preventing (ostnamed) from 'mounton' accesses on the directory /dev. ***** Plugin restorecon (94.8 confidence) suggests ************************ If you want to fix the label. /dev default label should be device_t. Then you can run restorecon. Do # /sbin/restorecon -v /dev ***** Plugin catchall_labels (5.21 confidence) suggests ******************* If you want to allow (ostnamed) to have mounton access on the dev directory Then you need to change the label on /dev Do # semanage fcontext -a -t FILE_TYPE '/dev' where FILE_TYPE is one of the following: admin_home_t, anon_inodefs_t, audit_spool_t, auditd_log_t, autofs_t, automount_tmp_t, bacula_store_t, binfmt_misc_fs_t, boot_t, capifs_t, cephfs_t, cgroup_t, cifs_t, container_image_t, debugfs_t, default_t, device_t, devpts_t, dnssec_t, dosfs_t, ecryptfs_t, efivarfs_t, etc_t, fusefs_t, home_root_t, hugetlbfs_t, ifconfig_var_run_t, init_var_run_t, initrc_tmp_t, iso9660_t, kdbusfs_t, mail_spool_t, mnt_t, mqueue_spool_t, named_conf_t, news_spool_t, nfs_t, nfsd_fs_t, onload_fs_t, openshift_tmp_t, openshift_var_lib_t, oracleasmfs_t, proc_t, proc_xen_t, pstore_t, public_content_rw_t, public_content_t, ramfs_t, random_seed_t, removable_t, root_t, rpc_pipefs_t, security_t, spufs_t, src_t, svirt_sandbox_file_t, sysctl_fs_t, sysctl_t, sysfs_t, sysv_t, tmp_t, tmpfs_t, usbfs_t, user_home_dir_t, user_home_t, user_tmp_t, usr_t, var_lib_nfs_t, var_lib_t, var_lock_t, var_log_t, var_run_t, var_t, virt_image_t, virt_var_lib_t, vmblock_t, vxfs_t, xend_var_lib_t, xend_var_run_t, xenfs_t, xenstored_var_lib_t. Then execute: restorecon -v '/dev' ***** Plugin catchall (1.44 confidence) suggests ************************** If you believe that (ostnamed) should be allowed mounton access on the dev directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c '(ostnamed)' --raw | audit2allow -M my-ostnamed # semodule -X 300 -i my-ostnamed.pp Additional Information: Source Context system_u:system_r:init_t:s0 Target Context system_u:object_r:unlabeled_t:s0 Target Objects /dev [ dir ] Source (ostnamed) Source Path (ostnamed) Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages filesystem-3.2-37.fc24.x86_64 Policy RPM selinux-policy-3.13.1-207.fc25.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 4.8.0-0.rc1.git0.1.fc25.x86_64 #1 SMP Mon Aug 8 16:20:07 UTC 2016 x86_64 x86_64 Alert Count 2 First Seen 2016-08-16 02:52:42 EDT Last Seen 2016-08-16 06:52:28 EDT Local ID 04483d0f-d7be-4d23-a350-9680f29664e6 Raw Audit Messages type=AVC msg=audit(1471330362.288:193): avc: denied { mounton } for pid=1972 comm="(-localed)" path="/dev" dev="dm-3" ino=262657 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir permissive=0 Hash: (ostnamed),init_t,unlabeled_t,dir,mounton Version-Release number of selected component: selinux-policy-3.13.1-207.fc25.noarch Additional info: reporter: libreport-2.7.2 hashmarkername: setroubleshoot kernel: 4.8.0-0.rc1.git0.1.fc25.x86_64 type: libreport Potential duplicate: bug 1347942
Proposing as a Final blocker: "There must be no SELinux denial notifications or crash notifications on boot of or during installation from a release-blocking live image, or at first login after a default install of a release-blocking desktop. " https://fedoraproject.org/wiki/Fedora_25_Final_Release_Criteria#SELinux_and_crash_notifications
I cannot reproduce this issue on fresh F25 system.
I reproduced again with Fedora-Workstation-Live-x86_64-25-20160816.n.0.iso. It happens before anaconda is started - just booting into the desktop triggers this.
Discussed during the 2016-08-22 blocker review meeting: [1] The decision to classify this bug as an AcceptedBlocker was made as it is a clear violation of "There must be no SELinux denial notifications or crash notifications on boot of or during installation from a release-blocking live image, or at first login after a default install of a release-blocking desktop." [1] https://meetbot.fedoraproject.org/fedora-blocker-review/2016-08-22/f25-blocker-review.2016-08-22-16.00.txt
Description of problem: Alert appears after booting from Fedora-Workstation-Live-x86_64-25_Alpha-1.1 media. Version-Release number of selected component: selinux-policy-3.13.1-208.fc25.noarch Additional info: reporter: libreport-2.7.2 hashmarkername: setroubleshoot kernel: 4.8.0-0.rc2.git3.1.fc25.x86_64 type: libreport
Description of problem: I booted a Fedora 25 Workstation iso compose (2016-08-27) and got this selinux alert after boot. Version-Release number of selected component: selinux-policy-3.13.1-208.fc25.noarch Additional info: reporter: libreport-2.7.2 hashmarkername: setroubleshoot kernel: 4.8.0-0.rc2.git3.1.fc25.x86_64 type: libreport
Description of problem: Just start Fedora from live USB Version-Release number of selected component: selinux-policy-3.13.1-208.fc25.noarch Additional info: reporter: libreport-2.7.2 hashmarkername: setroubleshoot kernel: 4.8.0-0.rc2.git3.1.fc25.x86_64 type: libreport
Description of problem: install Fedora 25 Alpha Version-Release number of selected component: selinux-policy-3.13.1-208.fc25.noarch Additional info: reporter: libreport-2.7.2 hashmarkername: setroubleshoot kernel: 4.8.0-0.rc2.git3.1.fc25.x86_64 type: libreport
Do this denial break anything or you just see AVC?
I still see this with Fedora-Workstation-Live-x86_64-25-20160919.n.0.iso, directly after boot. I don't know whether it breaks anything, the installation proceeds fine (but then again, anaconda switches the system to permissive, so that doesn't mean much).
We should dontaudit this.
selinux-policy-3.13.1-215.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-2b3bdc207c
*** Bug 1361809 has been marked as a duplicate of this bug. ***
With -216, I no longer see this AVC, and automount works...
selinux-policy-3.13.1-215.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.