Bug 155184 - SELinux and Cron Daily Issue
SELinux and Cron Daily Issue
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Daniel Walsh
Depends On:
  Show dependency treegraph
Reported: 2005-04-17 15:26 EDT by Ryan Skadberg
Modified: 2007-11-30 17:11 EST (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2005-04-20 11:00:05 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Ryan Skadberg 2005-04-17 15:26:12 EDT
Installed FC3 cleanly and then did a yum update to development.  Now, I get this
in my e-mail:

From: root@machine (Cron Daemon)
To: root@machine
Subject: Cron <root@codewarrior> run-parts /etc/cron.hourly
X-Cron-Env: <SHELL=/bin/bash>
X-Cron-Env: <PATH=/sbin:/bin:/usr/sbin:/usr/bin>
X-Cron-Env: <MAILTO=root>
X-Cron-Env: <HOME=/>
X-Cron-Env: <LOGNAME=root>
X-Cron-Env: <USER=root>

execl: couldn't exec `/bin/bash'
execl: Permission denied

And see this in /var/log/messages:

Apr 17 15:01:01 machine kernel: audit(1113764461.774:0): avc:  denied  {
transition } for  pid=3559 exe=/usr/sbin/crond path=/bin/bash dev=dm-0 ino=1769565
scontext=user_u:system_r:initrc_t tcontext=system_u:system_r:unconfined_t
Comment 1 Ryan Skadberg 2005-04-17 16:13:32 EDT
Actually, seeing this in cron.hourly, cron.daily and cron.weekly
Comment 2 Daniel Walsh 2005-04-19 11:45:50 EDT
This looks like a labeling problem.  cron should be running under crond_t.

What is /usr/sbin/crond context?

ls -lZ /usr/sbin/crond
-rwxr-xr-x  root     root     system_u:object_r:crond_exec_t   /usr/sbin/crond

If it is not this, restorecon -v /usr/sbin/crond should fix it.  If you want to
relabel the system

touch /.autorelabel 
Comment 3 Ryan Skadberg 2005-04-19 19:50:07 EDT
This seems to have been the issue.  Doing the restorecon fixed things.  I did a
relabel just in case other things were broken and all seems well now.

Someone probably needs to look in to why this permission got changed for me.  Or
maybe any selinux upgrade should automatically add a /.autorelabel?
Comment 4 Daniel Walsh 2005-04-20 11:00:05 EDT
Did you ever turn off SELinux?

Comment 5 Ryan Skadberg 2005-04-20 11:06:04 EDT
Nope.  Process was:

Installed FC3
Yum Update to Development
Problem started
Comment 6 Daniel Walsh 2005-04-20 11:18:09 EDT
Well the rpm is supposed to figure out what requires a relabel and relabel on
the fly.  Something must have gone wrong during the upgrade.  Did you see lots
of restorecon messages during the upgrade?

Note You need to log in before you can comment on or make changes to this bug.