Bug 1645825 - SELinux preventing crond from access to crontab and cron.d contents
Summary: SELinux preventing crond from access to crontab and cron.d contents
Keywords:
Status: CLOSED DUPLICATE of bug 1639381
Alias: None
Product: Fedora
Classification: Fedora
Component: crontabs
Version: 29
Hardware: Unspecified
OS: Linux
unspecified
high
Target Milestone: ---
Assignee: Tomas Mraz
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-11-04 04:04 UTC by dan
Modified: 2018-11-05 07:59 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-11-05 07:59:13 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description dan 2018-11-04 04:04:07 UTC
After upgrading to FC29, I noticed that several cron jobs were not running.  In checking the journal I found:

Nov 03 23:51:32 zzz.com crond[4261]: (CRON) STARTUP (1.5.2)
Nov 03 23:51:32 zzz.com crond[4261]: (CRON) INFO (RANDOM_DELAY will be scaled with factor 56% if used.)
Nov 03 23:51:32 zzz.com crond[4261]: ((null)) Unauthorized SELinux context=system_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 file_context=unconfined_u:object_r:system_cron_spool_t:s0 (/etc/cron.d/suncron)
Nov 03 23:51:32 zzz.com crond[4261]: (root) FAILED (loading cron table)
Nov 03 23:51:32 zzz.com crond[4261]: ((null)) Unauthorized SELinux context=system_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 file_context=unconfined_u:object_r:system_cron_spool_t:s0 (/etc/cron.d/clamav-update)
Nov 03 23:51:32 zzz.com crond[4261]: (root) FAILED (loading cron table)
Nov 03 23:51:32 zzz.com crond[4261]: ((null)) Unauthorized SELinux context=system_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 file_context=unconfined_u:object_r:system_cron_spool_t:s0 (/etc/cron.d/0hourly)
Nov 03 23:51:32 zzz.com crond[4261]: (root) FAILED (loading cron table)
Nov 03 23:51:32 zzz.com crond[4261]: ((null)) Unauthorized SELinux context=system_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 file_context=unconfined_u:object_r:system_cron_spool_t:s0 (/etc/cron.d/raid-check)
Nov 03 23:51:32 zzz.com crond[4261]: (root) FAILED (loading cron table)

crontab and cron.d are labeled as: unconfined_u:object_r:system_cron_spool_t:s0

However, I noticed that the cron.daily, weeekly, monthly files were labeled as:

system_u:object_r:bin_t:s0

So as I workaround, I relabeled crontab and cron.d contents and then crond succeeded.

This needs to be reconciled as to what the files should be labeled and what SELinux expects.

Comment 1 Tomas Mraz 2018-11-05 07:59:13 UTC

*** This bug has been marked as a duplicate of bug 1639381 ***


Note You need to log in before you can comment on or make changes to this bug.