Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: After update of bind-9.11.4-9.P2.fc29, /dev/urandom was added to bind-chroot directory. Bind however fails to use it, because it has not correct label. Check bug #1631515 for error messages. Version-Release number of selected component (if applicable): selinux-policy-3.14.1-44.fc28 How reproducible: always Steps to Reproduce: 1. dnf install bind-9.11.4-10.P2.fc29 bind-chroot-9.11.4-10.P2.fc29 2. ls -lZ /var/named/chroot*/dev/urandom 3. cat /dev/random > /dev/null # drop any gathered entropy 4. systemctl start named-chroot Actual results: Service fails to start type=AVC msg=audit(1538083144.528:217): avc: denied { open } for pid=1762 comm="named" path="/dev/urandom" dev="dm-3" ino=1183207 scontext=system_u:system_r:named_t:s0 tcontext=system_u:object_r:named_conf_t:s0 tclass=chr_file permissive=1 Expected results: Service can access /dev/urandom in chroot. Additional info:
I failed to spot the requirement for it before I added /dev/urandom in chroot and the requirement for it. Until fixed by selinux-policy, it makes bind-chroot unusable on F28, F29 and rawhide.
Created attachment 1492526 [details] Proposed fix
Thanks for report and fix. :) Author: Lukas Vrabec <lvrabec> Date: Mon Oct 15 13:21:00 2018 +0200 Label correctly /var/named/chroot*/dev/unrandom in bind chroot. Thanks Petr Mensik <pmensik> for proposed patch. BZ(1637931)
*** Bug 1639340 has been marked as a duplicate of this bug. ***
selinux-policy-3.14.2-39.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2018-ce273879ac
selinux-policy-3.14.2-40.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-ce273879ac
selinux-policy-3.14.2-40.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.