Description of problem: PCP pmie service does not start with enabled selinux. Version-Release number of selected component (if applicable): [root@hypervisor ~]# cat /etc/redhat-release Fedora release 29 (Twenty Nine) pcp-selinux-4.3.1-2.fc29.x86_64 How reproducible: dnf install pcp-selinux pcp pcp-conf pcp-doc start pmie service via systemd Steps to Reproduce: 1. dnf install pcp-selinux pcp pcp-conf pcp-doc 2. systemctl start pmie 3. Actual results: pmie does not start Expected results: pmie starts Additional info: ● pmie.service - Performance Metrics Inference Engine Loaded: loaded (/usr/lib/systemd/system/pmie.service; enabled; vendor preset: enabled) Active: activating (start) since Wed 2019-04-24 09:54:05 CEST; 1min 10s ago Docs: man:pmie(1) Process: 29285 ExecStart=/usr/share/pcp/lib/pmie start (code=exited, status=0/SUCCESS) Tasks: 0 (limit: 4583) Memory: 2.8M CGroup: /system.slice/pmie.service Apr 24 09:54:05 hypervisor systemd[1]: Starting Performance Metrics Inference Engine... Apr 24 09:54:05 hypervisor pmie[29285]: Starting pmie ... Apr 24 09:54:05 hypervisor systemd[1]: pmie.service: Can't open PID file /run/pcp/pmie.pid (yet?) after start: No such file or directory Apr 24 09:54:05 hypervisor pmie[29285]: mv: cannot move '/var/tmp/pcp.zCPr8AKkQ/pmie' to '/var/log/pcp/pmie/pmie_check.log': Permission denied Apr 24 09:54:05 hypervisor root[29394]: pmie_check start failed in /usr/share/pcp/lib/pmie, see /var/log/pcp/pmie/pmie_check.log Apr 24 09:54:05 hypervisor pmie[29285]: pmpost: cannot open or create file "/var/log/pcp/NOTICES": Permission denied Apr 24 09:54:05 hypervisor pmie[29285]: pmpost: unposted message: [Wed Apr 24 09:54:05 2019] pmie_check start failed in /usr/share/pcp/lib/pmie, see /var/log/pcp/pmie/pmie_check.log [root@hypervisor ~]# journalctl -r | grep audit | head Apr 24 10:00:11 hypervisor audit[30918]: AVC avc: denied { dac_override } for pid=30918 comm="pmpost" capability=1 scontext=system_u:system_r:pcp_pmie_t:s0 tcontext=system_u:system_r:pcp_pmie_t:s0 tclass=capability permissive=0 Apr 24 10:00:11 hypervisor audit[30918]: AVC avc: denied { dac_override } for pid=30918 comm="pmpost" capability=1 scontext=system_u:system_r:pcp_pmie_t:s0 tcontext=system_u:system_r:pcp_pmie_t:s0 tclass=capability permissive=0 Apr 24 10:00:11 hypervisor audit[30916]: AVC avc: denied { dac_override } for pid=30916 comm="mv" capability=1 scontext=system_u:system_r:pcp_pmie_t:s0 tcontext=system_u:system_r:pcp_pmie_t:s0 tclass=capability permissive=0 Apr 24 10:00:11 hypervisor audit[30890]: AVC avc: denied { dac_override } for pid=30890 comm="pmie_check" capability=1 scontext=system_u:system_r:pcp_pmie_t:s0 tcontext=system_u:system_r:pcp_pmie_t:s0 tclass=capability permissive=0 Apr 24 10:00:11 hypervisor audit[30909]: AVC avc: denied { dac_override } for pid=30909 comm="touch" capability=1 scontext=system_u:system_r:pcp_pmie_t:s0 tcontext=system_u:system_r:pcp_pmie_t:s0 tclass=capability permissive=0 If you disable selinux everything works.
I've verified this issue does not happen with pcp-4.3.2 - being released upstream today, will arrive in all current Fedora versions shortly. And I can see the pcp selinux policy contains... allow pcp_pmie_t self:capability { chown fowner dac_override kill net_admin sys_ptrace }; ... which will be why it works now. cheers.
pcp-4.3.2-1.fc30 has been submitted as an update to Fedora 30. https://bodhi.fedoraproject.org/updates/FEDORA-2019-89ed2e2383
pcp-4.3.2-1.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2019-30c683f0ae
pcp-4.3.2-1.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2019-2f04e77d53
pcp-4.3.2-1.fc30 has been pushed to the Fedora 30 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-89ed2e2383
pcp-4.3.2-1.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-2f04e77d53
pcp-4.3.2-1.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-30c683f0ae
This message is a reminder that Fedora 28 is nearing its end of life. On 2019-May-28 Fedora will stop maintaining and issuing updates for Fedora 28. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a Fedora 'version' of '28'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora 28 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior this bug is closed as described in the policy above. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete.
pcp-4.3.2-1.fc30 has been pushed to the Fedora 30 stable repository. If problems still persist, please make note of it in this bug report.
pcp-4.3.2-1.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.
pcp-4.3.2-1.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.