Description of problem: SELinux is preventing cjdroute from 'search' accesses on the directory /var/lib/sss/mc. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that cjdroute should be allowed search access on the mc directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'cjdroute' --raw | audit2allow -M my-cjdroute # semodule -X 300 -i my-cjdroute.pp Additional Information: Source Context system_u:system_r:cjdns_t:s0 Target Context system_u:object_r:sssd_public_t:s0 Target Objects /var/lib/sss/mc [ dir ] Source cjdroute Source Path cjdroute Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages sssd-common-2.1.0-2.fc30.x86_64 Policy RPM selinux-policy-3.14.3-35.fc30.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 5.0.9-301.fc30.x86_64 #1 SMP Tue Apr 23 23:57:35 UTC 2019 x86_64 x86_64 Alert Count 76 First Seen 2019-02-20 04:58:54 EST Last Seen 2019-05-09 02:17:54 EDT Local ID 1c4c0014-675a-4749-8f0b-4e5336b8c40d Raw Audit Messages type=AVC msg=audit(1557382674.697:162071): avc: denied { search } for pid=3157586 comm="cjdroute" name="mc" dev="dm-0" ino=653005 scontext=system_u:system_r:cjdns_t:s0 tcontext=system_u:object_r:sssd_public_t:s0 tclass=dir permissive=0 Hash: cjdroute,cjdns_t,sssd_public_t,dir,search Version-Release number of selected component: selinux-policy-3.14.3-35.fc30.noarch Additional info: component: selinux-policy reporter: libreport-2.10.0 hashmarkername: setroubleshoot kernel: 5.0.9-301.fc30.x86_64 type: libreport
*** Bug 1708080 has been marked as a duplicate of this bug. ***
cjdns folks, Is it ok that "cjdroute" reads sssd files? Thanks, Lukas.
There is no legitimate reason for cjdroute to read sssd files, and cjdroute itself does not do so. One of the dynamically linked Fedora libraries began doing so a year ago, and I have not figured out what standard library call is triggering the search. This is a duplicate of bz#1589395
Oh, to address your question, the access is probably harmless, and I should probably just silence the report (without enabling the access). I need to learn how to mute an access violation in the selinux policy supplied with a package.
*** This bug has been marked as a duplicate of bug 1589395 ***