Description of problem: I upgraded from Fedora 29 to 30. After the upgrade dhcpd was not starting. setroubleshoot[5744]: SELinux is preventing dhcpd from map access on the file /etc/rndc.key # ls -lZ /etc/rndc.key -rw-r-----. 1 root named system_u:object_r:dnssec_t:s0 112 Jun 9 19:54 /etc/rndc.key Version-Release number of selected component (if applicable): selinux-policy-3.14.3-37.fc30.noarch How reproducible: Always Steps to Reproduce: 1. Install dhcp-server 2. Add a dynamic dns key (rndc key) 3. systemctl start dhcpd Actual results: Fails to start Expected results: DHCPd Starts Additional info: SELinux recommends to turn on the following bool: setsebool -P domain_can_mmap_files 1 Setting this bool does allow dhcpd to start, but I don't think that is a proper fix. The dhcpd versions between Fedora 29 and 30 are the same. It's the SELinux policy that has changed.
Hi, Could you please reproduce the scenario and then attach output of: # ausearch -m AVC -ts recent Thanks, Lukas.
# ausearch -m AVC -ts recent ---- time->Tue Jun 11 08:22:34 2019 type=AVC msg=audit(1560259354.598:1807): avc: denied { map } for pid=18541 comm="dhcpd" path="/etc/rndc.key" dev="dm-0" ino=53871458 scontext=system_u:system_r:dhcpd_t:s0 tcontext=system_u:object_r:dnssec_t:s0 tclass=file permissive=0
commit e8298ee57267c9f3d4592b8feb76fc81fffbe155 (HEAD -> rawhide) Author: Lukas Vrabec <lvrabec> Date: Wed Jun 12 17:47:41 2019 +0200 Allow dhcpd_t domain to mmap dnssec_t files BZ(1718701)
FEDORA-2019-9da5c35472 has been submitted as an update to Fedora 30. https://bodhi.fedoraproject.org/updates/FEDORA-2019-9da5c35472
selinux-policy-3.14.3-39.fc30 has been pushed to the Fedora 30 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-9da5c35472
selinux-policy-3.14.3-39.fc30 has been pushed to the Fedora 30 stable repository. If problems still persist, please make note of it in this bug report.