Bug 1422121 - [restorecond] Don't throw error if /root/.ssh/ doesn't exist or it gets a SIGTERM
Summary: [restorecond] Don't throw error if /root/.ssh/ doesn't exist or it gets a SIG...
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: policycoreutils
Version: 7.4
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Petr Lautrbach
QA Contact: Dalibor Pospíšil
URL:
Whiteboard:
Keywords: Reopened
Depends On: 1264505
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-02-14 14:06 UTC by Petr Sklenar ⛄
Modified: 2017-08-01 16:16 UTC (History)
9 users (show)

(edit)
Clone Of: 1264505
(edit)
Last Closed: 2017-08-01 16:16:12 UTC


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:1883 normal SHIPPED_LIVE policycoreutils bug fix update 2017-08-01 17:53:54 UTC

Description Petr Sklenar ⛄ 2017-02-14 14:06:05 UTC
+++ This bug was initially created as a clone of Bug #1264505 +++

Description of problem:
On every reboot, restorecond logs this error message to syslog:
`restorecond[695]: Unable to watch (/root/.ssh/*) No such file or directory`
And /root/.ssh/ doesn't exist. I don't think restorecond should throw an error in this case. I find it completely normal to not have a /root/.ssh/ folder thus restorecon should not even warn about that.

When restorecond is receiving a SIGTERM (e.g. on shutdown) it throws an error too:
`restorecond[709]: terminated`
I don't see why this should be an error message. If you need this message at all, a INFO loglevel should be enough.


Version-Release number of selected component (if applicable):
policycoreutils-restorecond-2.3-18.fc22.x86_64
policycoreutils-restorecond-2.3-17.fc22.x86_64

How reproducible:
on every reboot

Additional info:
restorecond might throw more errors, I haven't tested the whole codebase.

--- Additional comment from Fedora End Of Life on 2016-07-19 19:56:47 CEST ---

Fedora 22 changed to end-of-life (EOL) status on 2016-07-19. Fedora 22 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.

--- Additional comment from Christian Stadelmann on 2016-07-20 13:31:14 CEST ---

Still present.

--- Additional comment from Vit  Mojzis on 2017-01-05 12:39:00 CET ---

Thank you for reporting the issue. 
There is a pull request to decrease loglevel of the termination message.
https://github.com/fedora-selinux/selinux/pull/36

As for the "watch" error, please edit your /etc/selinux/restorecond.conf (paths to be watched) accordingly.

--- Additional comment from Christian Stadelmann on 2017-01-17 00:43:49 CET ---

(In reply to Vit  Mojzis from comment #3)
> Thank you for reporting the issue. 
> There is a pull request to decrease loglevel of the termination message.
> https://github.com/fedora-selinux/selinux/pull/36
> 
> As for the "watch" error, please edit your /etc/selinux/restorecond.conf
> (paths to be watched) accordingly.

Thank you!

Comment 1 Petr Sklenar ⛄ 2017-02-14 14:06:39 UTC
I tried today's rhel74.nightly:

[root@localhost ~]# systemctl restart restorecond
[root@localhost ~]# systemctl status restorecond
● restorecond.service - Restorecon maintaining path file context
   Loaded: loaded (/usr/lib/systemd/system/restorecond.service; enabled; vendor preset: enabled)
   Active: active (running) since Tue 2017-02-14 15:05:36 CET; 2s ago
  Process: 9922 ExecStart=/usr/sbin/restorecond (code=exited, status=0/SUCCESS)
 Main PID: 9923 (restorecond)
   CGroup: /system.slice/restorecond.service
           └─9923 /usr/sbin/restorecond

Feb 14 15:05:36 localhost.localdomain systemd[1]: Starting Restorecon maintaining path file context...
Feb 14 15:05:36 localhost.localdomain restorecond[9922]: Unable to watch (/root/.ssh/*) No such file or directory
Feb 14 15:05:36 localhost.localdomain systemd[1]: Started Restorecon maintaining path file context.
[root@localhost ~]# rpm -qf /usr/lib/systemd/system/restorecond.service
policycoreutils-restorecond-2.5-12.el7.x86_64

Comment 6 Petr Lautrbach 2017-03-30 15:51:48 UTC
Note that we fixed only `restorecond[709]: terminated` part.

If you see messages like `restorecond[695]: Unable to watch (/root/.ssh/*) No such file or directory` please change your configuration in /etc/selinux/restorecond.conf

Changing the default during a product lifecycle could introduce regressions on users systems.

Comment 8 errata-xmlrpc 2017-08-01 16:16:12 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:1883


Note You need to log in before you can comment on or make changes to this bug.