Bug 1478973 - SELinux denial of systemd-journal writing to /var
SELinux denial of systemd-journal writing to /var
Status: NEW
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
25
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Lukas Vrabec
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2017-08-07 11:27 EDT by Micah Abbott
Modified: 2017-08-07 12:22 EDT (History)
10 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Micah Abbott 2017-08-07 11:27:51 EDT
After booting up Fedora 25 Atomic Host, the following SELinux denial was observed:

audit[623]: AVC avc:  denied  { write } for  pid=623 comm="systemd-journal" name="var" dev="dm-0" ino=2708768 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=dir permissive=0


I understand that F25 is considered old now, but I wanted to report this for posterity.


# rpm-ostree status
State: idle
Deployments:
● fedora-atomic:fedora-atomic/25/x86_64/testing/docker-host
                   Version: 25.188 (2017-08-04 21:35:28)
                    Commit: ddc19e4bf6d88faaa4019b5e530051d9ac4a41e82178e4e107706bc6f97b44c8

# rpm -q selinux-policy
selinux-policy-3.13.1-225.19.fc25.noarch
Comment 1 Daniel Walsh 2017-08-07 11:39:56 EDT
Is your /var empty?  Why would syslog be writing to /var and not to /var/log?
Comment 2 Micah Abbott 2017-08-07 12:22:51 EDT
/var does not appear to be empty; not sure why it is not writing to /var/log

# cd /var
# ls -la
total 12
drwxr-xr-x. 24 root root 4096 Aug  1 20:05 .
drwxr-xr-x. 11 root root  253 Aug  7 14:12 ..
drwxr-xr-x.  2 root root    6 Aug  1 20:05 adm
drwxr-xr-x.  4 root root   36 Aug  1 20:08 cache
drwxr-xr-x.  3 root root   18 Aug  1 20:05 db
drwxr-xr-x.  3 root root   18 Aug  1 20:05 empty
drwxr-xr-x.  2 root root    6 Aug  1 20:05 ftp
drwxr-xr-x.  2 root root    6 Aug  1 20:05 games
drwxr-xr-x.  2 root root    6 Aug  1 20:05 gopher
drwxr-xr-x.  3 root root   21 Jul  5 07:13 home
drwxr-xr-x.  3 root root   18 Aug  1 20:05 kerberos
drwxr-xr-x. 31 root root 4096 Aug  1 20:05 lib
drwxr-xr-x.  2 root root    6 Aug  1 20:05 local
lrwxrwxrwx.  1 root root   11 Jul  5 07:13 lock -> ../run/lock
drwxr-xr-x.  9 root root  159 Aug  7 15:15 log
lrwxrwxrwx.  1 root root   10 Aug  1 20:05 mail -> spool/mail
drwxr-xr-x.  2 root root    6 Jul  5 07:13 mnt
drwxr-xr-x.  2 root root    6 Aug  1 20:05 nis
drwxr-xr-x.  2 root root    6 Jul  5 07:13 opt
-rw-r--r--.  1 root root    0 Jul  5 07:13 .ostree-selabeled
drwxr-xr-x.  2 root root    6 Aug  1 20:05 preserve
drwx------.  2 root root  129 Aug  1 20:09 roothome
lrwxrwxrwx.  1 root root    6 Jul  5 07:13 run -> ../run
drwxr-xr-x.  5 root root   45 Aug  1 20:05 spool
drwxr-xr-x.  2 root root    6 Jul  5 07:13 srv
drwxrwxrwt.  2 root root    6 Jul  5 07:13 tmp
-rw-r--r--.  1 root root  163 Jan  1  1970 .updated
drwxr-xr-x. 11 root root  114 Jul  5 07:13 usrlocal
drwxr-xr-x.  2 root root    6 Aug  1 20:05 yp


The contextual log messages around the denial show that it happens after 'ostree-remount' runs:



# journalctl -b | grep -C 10 'avc:  denied'
Aug 07 15:15:16 fedora25ah-dev audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-journald comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Aug 07 15:15:16 fedora25ah-dev audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-journald comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Aug 07 15:15:16 fedora25ah-dev audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-fsck-root comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Aug 07 15:15:16 fedora25ah-dev audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-fsck-root comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Aug 07 15:15:16 fedora25ah-dev audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=kmod-static-nodes comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Aug 07 15:15:16 fedora25ah-dev audit: CONFIG_CHANGE audit_enabled=1 old=1 auid=4294967295 ses=4294967295 subj=system_u:system_r:syslogd_t:s0 res=1
Aug 07 15:15:16 fedora25ah-dev audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-remount-fs comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Aug 07 15:15:16 fedora25ah-dev audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-sysctl comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Aug 07 15:15:16 fedora25ah-dev audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=ostree-remount comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Aug 07 15:15:16 fedora25ah-dev audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=ostree-remount comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Aug 07 15:15:16 fedora25ah-dev audit[623]: AVC avc:  denied  { write } for  pid=623 comm="systemd-journal" name="var" dev="dm-0" ino=2708768 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=dir permissive=0
Aug 07 15:15:16 fedora25ah-dev audit[623]: SYSCALL arch=c000003e syscall=83 success=no exit=-13 a0=7ffdeace8cc0 a1=1ed a2=8 a3=75b69a680 items=0 ppid=1 pid=623 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
Aug 07 15:15:16 fedora25ah-dev audit: PROCTITLE proctitle="/usr/lib/systemd/systemd-journald"
Aug 07 15:15:16 fedora25ah-dev audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=lvm2-lvmetad comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Aug 07 15:15:16 fedora25ah-dev audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-journald comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Aug 07 15:15:15 fedora25ah-dev systemd[1]: systemd 231 running in system mode. (+PAM +AUDIT +SELINUX +IMA -APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD +IDN)
Aug 07 15:15:15 fedora25ah-dev systemd[1]: Detected virtualization qemu.
Aug 07 15:15:15 fedora25ah-dev systemd[1]: Detected architecture x86-64.
Aug 07 15:15:15 fedora25ah-dev systemd[1]: Set hostname to <fedora25ah-dev>.
Aug 07 15:15:16 fedora25ah-dev systemd[1]: tmp.mount: Cannot add dependency job, ignoring: Unit tmp.mount is masked.
Aug 07 15:15:16 fedora25ah-dev systemd[1]: tmp.mount: Cannot add dependency job, ignoring: Unit tmp.mount is masked.

Note You need to log in before you can comment on or make changes to this bug.