Bug 1474593 - SELinux is denying rpcbind from creating a direcory in /run
SELinux is denying rpcbind from creating a direcory in /run
Status: NEW
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
26
x86_64 Linux
unspecified Severity medium
: ---
: ---
Assigned To: Lukas Vrabec
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2017-07-24 22:09 EDT by louisgtwo
Modified: 2017-07-31 13:17 EDT (History)
10 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description louisgtwo 2017-07-24 22:09:38 EDT
Just installed f26 server and nfs-server failed to start. Think it's a selinux problem.

 audit[2875]: AVC avc:  denied  { create } for  pid=2875 comm="systemd-tmpfile" name="rpcbind" scontext=system_u:system_r:rpcbind_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=dir per
 systemd-tmpfiles[2875]: Failed to create directory or subvolume "/run/rpcbind": Permission denied
 rpcbind[2874]: rpcbind: /run/rpcbind/rpcbind.lock: No such file or directory
 systemd[1]: rpcbind.service: Main process exited, code=exited, status=1/FAILURE
Comment 1 Daniel Walsh 2017-07-25 08:41:40 EDT
Is rpcbind running systemd-tmpfile?
Comment 2 louisgtwo 2017-07-25 11:16:15 EDT
I think so. F26 has 3.13.1-260.1 and the changelog has this: 

* Mon Jun 19 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-258 - Allow rpcbind_t to execute systemd_tmpfiles_exec_t binary files.
Comment 3 louisgtwo 2017-07-25 23:46:29 EDT
This only happens on fresh installs. When /run/rpcbind does not yet exist. I placed the system in permissive mode, started the service and everything started fine. /run/rpcbind was created. Back in enforcing mode the service starts and stops fine, even through reboots.
Comment 4 Joe Doss 2017-07-31 13:17:25 EDT
(In reply to louisgtwo from comment #3)
> This only happens on fresh installs. When /run/rpcbind does not yet exist. I
> placed the system in permissive mode, started the service and everything
> started fine. /run/rpcbind was created. Back in enforcing mode the service
> starts and stops fine, even through reboots.

I can confirm what louisgtwo has said. This issue totally breaks the Fedora 26 Cloud Base Images for Vagrant. You can't use NFS out of the box.

Note You need to log in before you can comment on or make changes to this bug.