Description of problem: selinux prevents systemd-journald services from running Version-Release number of selected component (if applicable): selinux-policy-3.13.1-270.fc27.noarch How reproducible: everytime Steps to Reproduce: 1. Install using compose Fedora-Rawhide-20170811.n.2 2. Reboot system, run systemctl --all --failed FAILED SERVICES: UNIT LOAD ACTIVE SUB DESCRIPTION ● systemd-journald.service loaded failed failed Journal Service ● systemd-journald-audit.socket loaded failed failed Journal Audit Socket ● systemd-journald-dev-log.socket loaded failed failed Journal Socket (/dev/log) ● systemd-journald.socket loaded failed failed Journal Socket [root@bpi ~]# systemctl start systemd-journald [ 197.384113] systemd-journald[970]: Failed to map sequential number file, ignoring: Permission denied [ 197.400993] systemd-journald[970]: Failed to open runtime journal: Permission denied Job for systemd-journald.service failed because the control process exited with error code. See "systemctl status systemd-journald.service" and "journalctl -xe" for details. [root@bpi ~]# [ 197.635997] systemd-journald[971]: Failed to map sequential number file, ignoring: Permission denied [ 197.650804] systemd-journald[971]: Failed to open runtime journal: Permission denied [ 197.846337] systemd-journald[972]: Failed to map sequential number file, ignoring: Permission denied [ 197.864907] systemd-journald[972]: Failed to open runtime journal: Permission denied [ 198.077638] systemd-journald[973]: Failed to map sequential number file, ignoring: Permission denied [ 198.092724] systemd-journald[973]: Failed to open runtime journal: Permission denied [ 198.297908] systemd-journald[974]: Failed to map sequential number file, ignoring: Permission denied [ 198.313391] systemd-journald[974]: Failed to open runtime journal: Permission denied ausearch -m avc -ts recent ---- time->Mon Aug 14 13:25:45 2017 type=AVC msg=audit(1502731545.199:626): avc: denied { map } for pid=1009 comm="plymouthd" path="/etc/ld.so.cache" dev="dm-0" ino=8949486 scontext=system_u:system_r:plymouthd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file permis0 ---- time->Mon Aug 14 13:29:12 2017 type=AVC msg=audit(1502731752.182:587): avc: denied { map } for pid=941 comm="unix_chkpwd" path="/etc/ld.so.cache" dev="dm-0" ino=8949489 scontext=system_u:system_r:chkpwd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:etc_t:s0 tclass=f0 ---- time->Mon Aug 14 13:29:13 2017 type=AVC msg=audit(1502731753.973:588): avc: denied { map } for pid=942 comm="unix_chkpwd" path="/etc/ld.so.cache" dev="dm-0" ino=8949489 scontext=system_u:system_r:chkpwd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:etc_t:s0 tclass=f0 ---- time->Mon Aug 14 13:29:14 2017 type=AVC msg=audit(1502731754.364:590): avc: denied { map } for pid=943 comm="unix_chkpwd" path="/etc/ld.so.cache" dev="dm-0" ino=8949489 scontext=system_u:system_r:chkpwd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:etc_t:s0 tclass=f0 ---- time->Mon Aug 14 13:29:15 2017 type=AVC msg=audit(1502731755.608:595): avc: denied { map } for pid=945 comm="unix_chkpwd" path="/etc/ld.so.cache" dev="dm-0" ino=8949489 scontext=system_u:system_r:chkpwd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file permissi0 ---- time->Mon Aug 14 13:29:32 2017 type=AVC msg=audit(1502731772.856:604): avc: denied { create } for pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:syslogd_t:s0 tclass=netlink_audit_socket permissive=0 ---- time->Mon Aug 14 13:29:33 2017 type=AVC msg=audit(1502731773.023:605): avc: denied { map } for pid=970 comm="systemd-journal" path="/run/systemd/journal/kernel-seqnum" dev="tmpfs" ino=12065 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:syslogd0 ---- time->Mon Aug 14 13:29:33 2017 type=AVC msg=audit(1502731773.040:606): avc: denied { map } for pid=970 comm="systemd-journal" path="/run/log/journal/fd21139a15904e3cbbc5706d680ad948/system.journal" dev="tmpfs" ino=12072 scontext=system_u:system_r:syslogd_t:s0 tcon0 ---- time->Mon Aug 14 13:29:33 2017 type=AVC msg=audit(1502731773.122:610): avc: denied { create } for pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:syslogd_t:s0 tclass=netlink_audit_socket permissive=0 ---- time->Mon Aug 14 13:29:33 2017 type=AVC msg=audit(1502731773.275:611): avc: denied { map } for pid=971 comm="systemd-journal" path="/run/systemd/journal/kernel-seqnum" dev="tmpfs" ino=12065 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:syslogd0 ---- time->Mon Aug 14 13:29:33 2017 type=AVC msg=audit(1502731773.290:612): avc: denied { map } for pid=971 comm="systemd-journal" path="/run/log/journal/fd21139a15904e3cbbc5706d680ad948/system.journal" dev="tmpfs" ino=12072 scontext=system_u:system_r:syslogd_t:s0 tcon0 ---- time->Mon Aug 14 13:29:33 2017 type=AVC msg=audit(1502731773.351:616): avc: denied { create } for pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:syslogd_t:s0 tclass=netlink_audit_socket permissive=0 ---- time->Mon Aug 14 13:29:33 2017 type=AVC msg=audit(1502731773.486:617): avc: denied { map } for pid=972 comm="systemd-journal" path="/run/systemd/journal/kernel-seqnum" dev="tmpfs" ino=12065 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:syslogd0 ---- time->Mon Aug 14 13:29:33 2017 type=AVC msg=audit(1502731773.503:618): avc: denied { map } for pid=972 comm="systemd-journal" path="/run/log/journal/fd21139a15904e3cbbc5706d680ad948/system.journal" dev="tmpfs" ino=12072 scontext=system_u:system_r:syslogd_t:s0 tcon0 ---- time->Mon Aug 14 13:29:33 2017 type=AVC msg=audit(1502731773.568:622): avc: denied { create } for pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:syslogd_t:s0 tclass=netlink_audit_socket permissive=0 ---- time->Mon Aug 14 13:29:33 2017 type=AVC msg=audit(1502731773.717:623): avc: denied { map } for pid=973 comm="systemd-journal" path="/run/systemd/journal/kernel-seqnum" dev="tmpfs" ino=12065 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:syslogd0 ---- time->Mon Aug 14 13:29:33 2017 type=AVC msg=audit(1502731773.732:624): avc: denied { map } for pid=973 comm="systemd-journal" path="/run/log/journal/fd21139a15904e3cbbc5706d680ad948/system.journal" dev="tmpfs" ino=12072 scontext=system_u:system_r:syslogd_t:s0 tcon0 ---- time->Mon Aug 14 13:29:33 2017 type=AVC msg=audit(1502731773.793:628): avc: denied { create } for pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:syslogd_t:s0 tclass=netlink_audit_socket permissive=0 ---- time->Mon Aug 14 13:29:33 2017 type=AVC msg=audit(1502731773.937:629): avc: denied { map } for pid=974 comm="systemd-journal" path="/run/systemd/journal/kernel-seqnum" dev="tmpfs" ino=12065 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:syslogd0 ---- time->Mon Aug 14 13:29:33 2017 type=AVC msg=audit(1502731773.953:630): avc: denied { map } for pid=974 comm="systemd-journal" path="/run/log/journal/fd21139a15904e3cbbc5706d680ad948/system.journal" dev="tmpfs" ino=12072 scontext=system_u:system_r:syslogd_t:s0 tcon0 When selinux is in permissive, systemd-journald starts as expected. [root@bpi ~]# setenforce 0 [root@bpi ~]# systemctl start systemd-journald [root@bpi ~]# systemctl status systemd-journald ��● systemd-journald.service - Journal Service Loaded: loaded (/usr/lib/systemd/system/systemd-journald.service; static; ven Active: active (running) since Mon 2017-08-14 13:31:28 EDT; 13s ago Docs: man:systemd-journald.service(8) man:journald.conf(5) Main PID: 979 (systemd-journal) Status: "Processing requests..." Tasks: 1 (limit: 4915) CGroup: /system.slice/systemd-journald.service ��└��─979 /usr/lib/systemd/systemd-journald Aug 14 13:31:28 bpi.friendly-neighbours.com systemd-journald[979]: Journal start Aug 14 13:31:28 bpi.friendly-neighbours.com systemd-journald[979]: Runtime journ
This bug appears to have been reported against 'rawhide' during the Fedora 27 development cycle. Changing version to '27'.
This is probably a dupe of one of the specific denials, likely the systemd-journal denial for its own log file.
The log file is one of them, also ---- time->Mon Aug 14 13:29:33 2017 type=AVC msg=audit(1502731773.937:629): avc: denied { map } for pid=974 comm="systemd-journal" path="/run/systemd/journal/kernel-seqnum" dev="tmpfs" ino=12065 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:syslogd0 ----
yeah, what I meant was I'm not so clear if that would prevent it running entirely. Still, definitely file that one on its own if it isn't filed yet.
This looks fixed with the latest selinux-policy build. Could somebody try it? Thanks, Lukas.
journal is working for me in f27 lately, but let's let Paul confirm for his case.
journal is working fine now, many thanks.
I think this can be closed, as the relevant fixes are in stable.