Mar 5 09:29:23 island systemd[1]: Starting IPv4 firewall with iptables... Mar 5 09:29:23 island audit[1153]: AVC avc: denied { read } for pid=1153 comm="iptables-restor" name="xtables.lock" dev="tmpfs" ino=19364 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0 Mar 5 09:29:23 island iptables.init[1146]: iptables: Applying firewall rules: Fatal: can't open lock file /run/xtables.lock: Permission denied Mar 5 09:29:23 island iptables.init[1146]: [FAILED] # ls -lZ /run/xtables.lock /usr/libexec/iptables/ip* -rw-------. 1 root root system_u:object_r:var_run_t:s0 0 5. bře 09.21 /run/xtables.lock -rwxr-xr-x. 1 root root system_u:object_r:iptables_exec_t:s0 10185 1. bře 18.10 /usr/libexec/iptables/iptables.init -rwxr-xr-x. 1 root root system_u:object_r:bin_t:s0 10313 1. bře 18.10 /usr/libexec/iptables/ip6tables.init I have: kernel-4.15.7-200.fc26.x86_64 iptables-services-1.6.2-2.fc26.x86_64 selinux-policy-3.13.1-260.18.fc26.noarch The bug just appeared when I restarted the machine today after an upgrade. The up-to-date system started on March 1st successfully. Only kernel and iptables packages has changed in the mean time. Since iptables packages do not deliver a SELinux policy, I believe this is a bug in the SELinux policy packages that took effect when installing files from updated iptables-services package. This is quite serious bug because it leaves the system wihout loaded IPv4 firewall rules. Please not that ip6tables works because /usr/libexec/iptables/ip6tables.init has bin_t label.
selinux-policy-3.13.1-260.20.fc26 has been submitted as an update to Fedora 26. https://bodhi.fedoraproject.org/updates/FEDORA-2018-1969794434
It does not help. I can still see the same issue with selinux-policy-3.13.1-260.20.fc26.noarch. Do I need to relabel some files or reboot the machine?
(In reply to Petr Pisar from comment #2) > Do I need to relabel some files or > reboot the machine? It also does not help. selinux-policy-3.13.1-283.27.fc27.noarch kernel-4.15.9-300.fc27.x86_64 iptables-1.6.2-2.fc27.x86_64 my workoraund: cat /etc/systemd/system/iptables.service.d/override.conf [Service] ExecStartPre=-/usr/libexec/iptables/iptables.init start ExecStartPre=-/usr/sbin/restorecon -F /run/xtables.lock
(In reply to liva from comment #3) > ExecStartPre=-/usr/sbin/restorecon -F /run/xtables.lock parameter "-F" not required )
https://bugzilla.redhat.com/show_bug.cgi?id=1417323
My workaround is changing /usr/libexec/iptables/iptables.init label back to bin_t by adding a file context rule that overrides the existing one in the policy: # semanage fcontext -a -t bin_t -f f '/usr/libexec/iptables/ip.*' Then I reset the label on that file: # restorecon -Fv /usr/libexec/iptables/iptables.init And that's all. Still I don't understand why /usr/libexec/iptables/iptables.init and /usr/libexec/iptables/ip6tables.init have different label in the policy. It is inconsistent.
(In reply to Petr Pisar from comment #6) > Still I don't understand why /usr/libexec/iptables/iptables.init and > /usr/libexec/iptables/ip6tables.init have different label in the policy. It > is inconsistent. Ah, hah... that's the bug. That's what needs fixing here. :)
@Lukas, the /usr/libexec/iptables/iptables.init and /usr/libexec/iptables/ip6tables.init files need the same context. I'm guessing 'iptables_exec_t' is correct and 'bin_t' is not.
selinux-policy-3.13.1-260.20.fc26 has been pushed to the Fedora 26 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-1969794434
selinux-policy-3.13.1-260.20.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.
@Petr, ping. Any update?
https://github.com/fedora-selinux/selinux-policy/commit/3e5932977b5b5e0b0bcd4811395fda1ddded30df Should be fixed now.
This message is a reminder that Fedora 26 is nearing its end of life. Approximately 4 (four) weeks from now Fedora will stop maintaining and issuing updates for Fedora 26. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a Fedora 'version' of '26'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora 26 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior this bug is closed as described in the policy above. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete.
Fedora 26 changed to end-of-life (EOL) status on 2018-05-29. Fedora 26 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of Fedora please feel free to reopen this bug against that version. If you are unable to reopen this bug, please file a new report against the current release. If you experience problems, please add a comment to this bug. Thank you for reporting this bug and we are sorry it could not be fixed.
I still experience this issue on Fedora 27: # systemctl status iptables.service ● iptables.service - IPv4 firewall with iptables Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled; vendor preset: disabled) Active: failed (Result: exit-code) since Thu 2018-06-07 08:40:53 CEST; 6min ago Process: 1734 ExecStart=/usr/libexec/iptables/iptables.init start (code=exited, status=1/FAILURE) Main PID: 1734 (code=exited, status=1/FAILURE) čen 07 08:40:53 island systemd[1]: Starting IPv4 firewall with iptables... čen 07 08:40:53 island iptables.init[1734]: iptables: Applying firewall rules: Fatal: can't open lock file /run/xtables.lock: Permission denied čen 07 08:40:53 island iptables.init[1734]: [FAILED] čen 07 08:40:53 island systemd[1]: iptables.service: Main process exited, code=exited, status=1/FAILURE čen 07 08:40:53 island systemd[1]: Failed to start IPv4 firewall with iptables. čen 07 08:40:53 island systemd[1]: iptables.service: Unit entered failed state. čen 07 08:40:53 island systemd[1]: iptables.service: Failed with result 'exit-code'. # ls -lZ /run/xtables.lock /usr/libexec/iptables/ip* -rw-------. 1 root root system_u:object_r:var_run_t:s0 0 7. čen 08.37 /run/xtables.lock -rwxr-xr-x. 1 root root system_u:object_r:iptables_exec_t:s0 10185 7. kvě 10.33 /usr/libexec/iptables/iptables.init -rwxr-xr-x. 1 root root system_u:object_r:iptables_exec_t:s0 10313 7. kvě 10.33 /usr/libexec/iptables/ip6tables.init # semanage fcontext -l | grep xtables /sbin/xtables-multi regular file system_u:object_r:iptables_exec_t:s0 /usr/sbin/xtables-multi regular file system_u:object_r:iptables_exec_t:s0 /var/run/xtables.* regular file system_u:object_r:iptables_var_run_t:s0 # rpm -q selinux-policy iptables iptables-services selinux-policy-3.13.1-283.35.fc27.noarch iptables-1.6.2-3.fc27.x86_64 iptables-services-1.6.2-3.fc27.x86_64 The bugs seems to be that the policy sets /var/run/xtables.* symlink rather than /run/xtables.* file. # readlink -f /var/run/xtables.lock /run/xtables.lock # ls -lZ /var/run lrwxrwxrwx. 1 root root system_u:object_r:var_run_t:s0 6 8. úno 2012 /var/run -> ../run
Well, the /var/run symlink is somehow handled: # semanage fcontext -a -t iptables_var_run_t -f f '/run/xtables.lock' ValueError: File spec /run/xtables.lock conflicts with equivalency rule '/run /var/run'; Try adding '/var/run/xtables.lock' instead but the original rule does not take any effect. Isn't there some kind of race condition in when the file is created and the label is applied? # mount |grep run tmpfs on /run type tmpfs (rw,nosuid,nodev,seclabel,mode=755) tmpfs on /run/user/0 type tmpfs (rw,nosuid,nodev,relatime,seclabel,size=402200k,mode=700) Please note that I start both iptables.service and ip6tables.service.
This message is a reminder that Fedora 27 is nearing its end of life. On 2018-Nov-30 Fedora will stop maintaining and issuing updates for Fedora 27. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a Fedora 'version' of '27'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora 27 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior this bug is closed as described in the policy above. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete.
Fedora 28 seems to be fine.