Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: On a new Fedora 31 install /dev/net/tun does not exist. This is a static device node that systemd creates on startup regardless of whether the kmod is loaded or not. This is done by the kmod-static-nodes.service unit but it is failing to start: # systemctl status kmod-static-nodes.service ● kmod-static-nodes.service - Create list of required static device nodes for the current kernel Loaded: loaded (/usr/lib/systemd/system/kmod-static-nodes.service; static; vendor preset: disabled) Active: inactive (dead) since Mon 2019-03-18 14:26:46 GMT; 1min 11s ago Condition: start condition failed at Mon 2019-03-18 14:27:56 GMT; 1s ago └─ ConditionFileNotEmpty=/lib/modules/5.1.0-0.rc0.git9.1.fc31.x86_64/modules.devname was not met Main PID: 331 (code=exited, status=0/SUCCESS) The file /lib/modules/5.1.0-0.rc0.git9.1.fc31.x86_64/modules.devname does exist with non-zero size. Audit.log reveals that SELinux is blocking this acess type=AVC msg=audit(1552919426.997:335): avc: denied { getattr } for pid=1 comm="systemd" path="/usr/lib/modules/5.1.0-0.rc0.git9.1.fc31.x86_64/modules.devname" dev="dm-0" ino=753068 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:modules_dep_t:s0 tclass=file permissive=1 The file is labelled with modules_dep_t type, which is different from what was used in previous Fedora which was modules_object_t Either the type needs to go back to modules_object_t as in previous Fedora, or the policy needs to grant modules_dep_t read access to systemd via the init_t type. Version-Release number of selected component (if applicable): kernel-5.1.0-0.rc0.git9.1.fc31.x86_64 systemd-241-2.gita09c170.fc31.x86_64 selinux-policy-3.14.4-4.fc31.noarch How reproducible: Always Steps to Reproduce: 1. Install fresh Fedora 31 x86_64 2. 3. Actual results: /dev/net/tun doesn't exist and kmod-static-nodes.service failed to run Expected results: /dev/net/tun exists & kmod-static-nodes.service runs Additional info:
I suppose might be related to either https://github.com/fedora-selinux/selinux-policy/commit/aa6253cf8dbcff8d0d73a94c95b22a4813481bd8 or https://git.kernel.org/pub/scm/utils/kernel/kmod/kmod.git/commit/?id=a06bacf500d56b72b5f9b121ebf7f6af9e3df185 The ironic thing is that the labeling is now actually correct. Type module_object_t is for kernel modules only AFAIK.
FTR. there seems to be more fall out, e.g. with jmtpfs: # jmtpfs /mnt/card > [...] > fuse: device not found, try 'modprobe fuse' first # rpm -q selinux-policy jmtpfs > selinux-policy-3.14.4-4.fc31.noarch > jmtpfs-0.4-10.fc30.x86_64 (shout out to both libvirt and jmtpfs/fuse library? for these informed suggestions the users would be easily lost without)
Thanks for investigation. Adding patch: commit b28842ef918897da153800b2df47bb991250c421 (HEAD -> rawhide) Author: Lukas Vrabec <lvrabec> Date: Tue Mar 19 09:26:57 2019 +0100 Update file context for modutils rhbz#1689975 - label /lib/modules/<KERNEL_VERSION>/modules.devname as modules_dep_t instead of modules_object_t - Allow init_t domain to read modules_dep_t files
Not sure about this but my policy seems to imply that systemd also maps module dependency files. https://github.com/DefenSec/dssp2-standard/blob/master/policy/systemd/s/systemd.cil#L3358
Yes looks like you have traces of that as well: https://github.com/fedora-selinux/selinux-policy/blob/b28842ef918897da153800b2df47bb991250c421/policy/modules/system/init.te#L569 I suspect these two should be removed (provided that module dependency files are labeled properly): files_read_kernel_modules(init_t) files_map_kernel_modules(init_t) And instead i suppose you would need to add: modutils_map_module_deps_files(init_t)