Bug 1645331 - SELinux is preventing systemd-logind from 'read' accesses on the blk_file sda2.
Summary: SELinux is preventing systemd-logind from 'read' accesses on the blk_file sda2.
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 29
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Lukas Vrabec
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:d47be636967be3a1d2983e1186d...
: 1645859 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-11-02 00:31 UTC by ep
Modified: 2020-04-14 17:00 UTC (History)
16 users (show)

Fixed In Version: selinux-policy-3.14.2-41.fc29
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-11-07 02:41:46 UTC
Type: ---


Attachments (Terms of Use)

Description ep 2018-11-02 00:31:46 UTC
Description of problem:
SELinux is preventing systemd-logind from 'read' accesses on the blk_file sda2.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that systemd-logind should be allowed read access on the sda2 blk_file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'systemd-logind' --raw | audit2allow -M my-systemdlogind
# semodule -X 300 -i my-systemdlogind.pp

Additional Information:
Source Context                system_u:system_r:systemd_logind_t:s0
Target Context                system_u:object_r:fixed_disk_device_t:s0
Target Objects                sda2 [ blk_file ]
Source                        systemd-logind
Source Path                   systemd-logind
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.14.2-40.fc29.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 4.18.16-300.fc29.x86_64 #1 SMP Sat
                              Oct 20 23:24:08 UTC 2018 x86_64 x86_64
Alert Count                   2
First Seen                    2018-11-02 01:30:41 CET
Last Seen                     2018-11-02 01:30:41 CET
Local ID                      4270ec21-c418-4670-8019-ce8ecd7027b2

Raw Audit Messages
type=AVC msg=audit(1541118641.379:553): avc:  denied  { read } for  pid=972 comm="systemd-logind" name="sda2" dev="devtmpfs" ino=14395 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file permissive=0


Hash: systemd-logind,systemd_logind_t,fixed_disk_device_t,blk_file,read

Version-Release number of selected component:
selinux-policy-3.14.2-40.fc29.noarch

Additional info:
component:      selinux-policy
reporter:       libreport-2.9.6
hashmarkername: setroubleshoot
kernel:         4.18.16-300.fc29.x86_64
type:           libreport

Comment 1 Cyber Trekker 2018-11-02 01:43:56 UTC
Description of problem:
Booted into the operating system, logged into my user account and immediately after gaining desktop access I was confronted with the alert.


Additional info:
reporter:       libreport-2.9.6
hashmarkername: setroubleshoot
kernel:         4.18.16-300.fc29.x86_64
type:           libreport

Comment 2 Jonathon Poppleton 2018-11-02 13:40:43 UTC
Description of problem:
Opened the power setting in mate desktop when the error appeared.

Version-Release number of selected component:
selinux-policy-3.14.2-40.fc29.noarch

Additional info:
reporter:       libreport-2.9.6
hashmarkername: setroubleshoot
kernel:         4.18.16-300.fc29.x86_64
type:           libreport

Comment 3 Lukas Vrabec 2018-11-03 13:14:49 UTC
commit 5a103fd1d605fb1195fbfb02361a723d0f7669aa (HEAD -> rawhide, origin/rawhide)
Author: Lukas Vrabec <lvrabec@redhat.com>
Date:   Sat Nov 3 13:06:47 2018 +0100

    Allow systemd_logind_t to read fixed dist device BZ(1645631)

Comment 4 Fedora Update System 2018-11-04 10:07:33 UTC
selinux-policy-3.14.2-41.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2018-506e97bb9b

Comment 5 Lucas 2018-11-04 12:50:00 UTC
*** Bug 1645859 has been marked as a duplicate of this bug. ***

Comment 6 Fedora Update System 2018-11-05 04:19:50 UTC
selinux-policy-3.14.2-41.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-506e97bb9b

Comment 7 Fedora Update System 2018-11-07 02:41:46 UTC
selinux-policy-3.14.2-41.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.

Comment 8 Andrey 2020-04-12 15:05:58 UTC
(In reply to Lukas Vrabec from comment #3)
> commit 5a103fd1d605fb1195fbfb02361a723d0f7669aa (HEAD -> rawhide,
> origin/rawhide)
> Author: Lukas Vrabec <lvrabec@redhat.com>
> Date:   Sat Nov 3 13:06:47 2018 +0100
> 
>     Allow systemd_logind_t to read fixed dist device BZ(1645631)

I couldn't find that commit online, could you help?

Comment 9 Andrey 2020-04-14 17:00:26 UTC
Related bug #1823201


Note You need to log in before you can comment on or make changes to this bug.