Description of problem: On clean boot SELinux is preventing sealert from 'read' accesses on the chr_file random. ***** Plugin catchall_boolean (89.3 confidence) suggests ****************** Si vous souhaitez allow authlogin to nsswitch use ldap Then vous devez en informer SELinux en activant le booléen « authlogin_nsswitch_use_ldap ». Do setsebool -P authlogin_nsswitch_use_ldap 1 ***** Plugin catchall (11.6 confidence) suggests ************************** Si vous pensez que sealert devrait être autorisé à accéder read sur random chr_file par défaut. Then vous devriez rapporter ceci en tant qu'anomalie. Vous pouvez générer un module de stratégie local pour autoriser cet accès. Do autoriser cet accès pour le moment en exécutant : # ausearch -c "sealert" --raw | audit2allow -M my-sealert # semodule -X 300 -i my-sealert.pp Additional Information: Source Context system_u:system_r:setroubleshoot_fixit_t:s0-s0:c0. c1023 Target Context system_u:object_r:random_device_t:s0 Target Objects random [ chr_file ] Source sealert Source Path sealert Port <Inconnu> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.14.2-32.fc29.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 4.19.0-0.rc0.git10.1.fc30.x86_64 #1 SMP Thu Aug 23 14:22:05 UTC 2018 x86_64 x86_64 Alert Count 2 First Seen 2018-08-24 15:24:26 CEST Last Seen 2018-08-24 15:25:44 CEST Local ID 5af900d2-4570-4e2d-bffe-1aa3eb63d461 Raw Audit Messages type=AVC msg=audit(1535117144.148:282): avc: denied { read } for pid=3135 comm="sealert" name="random" dev="devtmpfs" ino=44 scontext=system_u:system_r:setroubleshoot_fixit_t:s0-s0:c0.c1023 tcontext=system_u:object_r:random_device_t:s0 tclass=chr_file permissive=1 Hash: sealert,setroubleshoot_fixit_t,random_device_t,chr_file,read Version-Release number of selected component: selinux-policy-3.14.2-32.fc29.noarch Additional info: component: selinux-policy reporter: libreport-2.9.5 hashmarkername: setroubleshoot kernel: 4.19.0-0.rc0.git10.1.fc30.x86_64 type: libreport
*** Bug 1622114 has been marked as a duplicate of this bug. ***
*** Bug 1622113 has been marked as a duplicate of this bug. ***
This bug appears to have been reported against 'rawhide' during the Fedora 31 development cycle. Changing version to '31'.
This bug appears to have been reported against 'rawhide' during the Fedora 31 development cycle. Changing version to 31.
PR for Fedora: https://github.com/fedora-selinux/selinux-policy-contrib/pull/149
commit 89235da6dbd4fe2c33a7bc1f91fdcc057b62014e (HEAD -> rawhide, origin/rawhide, origin/HEAD) Author: Nikola Knazekova <nknazeko> Date: Mon Oct 7 12:40:24 2019 +0200 Allow setroubleshoot_fixit_t to read random_device_t Allow setroubleshoot_fixit_t to to read from random number generator devices Fixed Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1622115 PR merged.
FEDORA-2019-7ef1fde499 has been submitted as an update to Fedora 31. https://bodhi.fedoraproject.org/updates/FEDORA-2019-7ef1fde499
selinux-policy-3.14.4-38.fc31 has been pushed to the Fedora 31 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-7ef1fde499
FEDORA-2019-7d65c50fd6 has been submitted as an update to Fedora 31. https://bodhi.fedoraproject.org/updates/FEDORA-2019-7d65c50fd6
selinux-policy-3.14.4-39.fc31 has been pushed to the Fedora 31 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-7d65c50fd6
selinux-policy-3.14.4-39.fc31 has been pushed to the Fedora 31 stable repository. If problems still persist, please make note of it in this bug report.