Description of problem: SELinux blocks caddy from starting in Fedora 30. Version-Release number of selected component (if applicable): selinux-policy-3.14.3-32.fc30 caddy-0.11.4-1.fc30 How reproducible: always Steps to Reproduce: 1. systemctl start caddy Actual results: May 05 18:50:45 zeratul systemd[1]: Starting Caddy HTTP/2 web server... May 05 18:50:45 zeratul audit[20561]: AVC avc: denied { mounton } for pid=20561 comm="(caddy)" path="/run/systemd/unit-root/var/lib/caddy" dev="dm-0" ino=41163184 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:httpd_var_lib_t:s0 tclass=dir permissive=0 May 05 18:50:45 zeratul systemd[20561]: caddy.service: Failed to set up mount namespacing: Permission denied May 05 18:50:45 zeratul systemd[20561]: caddy.service: Failed at step NAMESPACE spawning /usr/bin/caddy: Permission denied May 05 18:50:45 zeratul systemd[1]: caddy.service: Control process exited, code=exited, status=226/NAMESPACE May 05 18:50:45 zeratul systemd[1]: caddy.service: Failed with result 'exit-code'. May 05 18:50:45 zeratul systemd[1]: Failed to start Caddy HTTP/2 web server. May 05 18:50:45 zeratul audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=caddy comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed' Expected results: successful start of service Additional info: The path /run/systemd/unit-root/var/lib/caddy doesn't exist on my system. I think this is related to these unit file directives. ProtectSystem=strict ReadWriteDirectories=/var/lib/caddy If I downgrade ProtectSystem to full and remove ReadWriteDirectories, caddy can start. I noticed bug 1648864 and bug 1636823 that look similar, but those are against Fedora 29. Caddy can start just fine in Fedora 29, this behavior is new in Fedora 30.
caddy-0.11.4-2.fc30 has been submitted as an update to Fedora 30. https://bodhi.fedoraproject.org/updates/FEDORA-2019-e561daacc5
caddy-0.11.4-2.fc30 has been pushed to the Fedora 30 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-e561daacc5
caddy-0.11.4-2.fc30 has been pushed to the Fedora 30 stable repository. If problems still persist, please make note of it in this bug report.
I opened this issue under the selinux-policy component to get feedback on the denial. The update I pushed just switches from ProtectSystem=strict to ProtectSystem=full. What is the correct way to use ProtectSystem=strict and ReadWriteDirectories with SELinux enforcing as it worked in F29?
Subscribing to this because I'm seeing the exact same effect, for a different unit file. Funnily enough, only for _some_ unit files, and I can't figure out what the difference between the working ones and the non-working ones is.
Carl, I added fixes in selinux-policy: https://github.com/fedora-selinux/selinux-policy-contrib/commit/99b1edeb1a7da9489bc2f4fc87b310ceafaf633e Feel free to move the bugzilla ticket to selinux-policy component.
Thanks Lukas.
FEDORA-2019-f83217e2bf has been submitted as an update to Fedora 30. https://bodhi.fedoraproject.org/updates/FEDORA-2019-f83217e2bf
selinux-policy-3.14.3-51.fc30 has been pushed to the Fedora 30 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-f83217e2bf
FEDORA-2019-70d80ad4bc has been submitted as an update to Fedora 30. https://bodhi.fedoraproject.org/updates/FEDORA-2019-70d80ad4bc
selinux-policy-3.14.3-52.fc30 has been pushed to the Fedora 30 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-70d80ad4bc
selinux-policy-3.14.3-52.fc30 has been pushed to the Fedora 30 stable repository. If problems still persist, please make note of it in this bug report.