Description of problem: SELinux is preventing mdadm from 'read' accesses on the file /var/lib/pcp/pmdas/linux/help.pag. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that mdadm should be allowed read access on the help.pag file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'mdadm' --raw | audit2allow -M my-mdadm # semodule -X 300 -i my-mdadm.pp Additional Information: Source Context system_u:system_r:mdadm_t:s0 Target Context system_u:object_r:pcp_var_lib_t:s0 Target Objects /var/lib/pcp/pmdas/linux/help.pag [ file ] Source mdadm Source Path mdadm Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages pcp-4.3.2-1.fc29.x86_64 Policy RPM selinux-policy-3.14.2-60.fc29.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 5.1.9-200.fc29.x86_64 #1 SMP Tue Jun 11 17:42:24 UTC 2019 x86_64 x86_64 Alert Count 52 First Seen 2019-06-18 20:58:42 CEST Last Seen 2019-06-18 21:23:59 CEST Local ID 140168a4-3477-4d33-825a-2c827edfaab7 Raw Audit Messages type=AVC msg=audit(1560885839.260:1420): avc: denied { read } for pid=12616 comm="mdadm" path="/var/lib/pcp/pmdas/linux/help.pag" dev="dm-1" ino=68745179 scontext=system_u:system_r:mdadm_t:s0 tcontext=system_u:object_r:pcp_var_lib_t:s0 tclass=file permissive=0 Hash: mdadm,mdadm_t,pcp_var_lib_t,file,read Version-Release number of selected component: selinux-policy-3.14.2-60.fc29.noarch Additional info: component: selinux-policy reporter: libreport-2.10.0 hashmarkername: setroubleshoot kernel: 5.1.9-200.fc29.x86_64 type: libreport
This also happens on Fedora 30. ``` avc: denied { read } for pid=7311 comm="mdadm" path="/var/lib/pcp/pmdas/linux/help.dir" dev="dm-0" ino=21025540 scontext=system_u:system_r:mdadm_t:s0 tcontext=system_u:object_r:pcp_var_lib_t:s0 tclass=file permissive=0 ``` $ rpm -q selinux-policy selinux-policy-3.14.3-39.fc30.noarch $ rpm -q pcp pcp-4.3.2-1.fc30.x86_64
Description of problem: as far as i can tell, my method is: (0. install fedora 29) 1. mount a software raid disk 2. install cockpit, cockpit-pcp and pcp 3. start cockpit service 4. update software I _think_ this has only started happening since my most recent software update. Version-Release number of selected component: selinux-policy-3.14.2-60.fc29.noarch Additional info: reporter: libreport-2.10.1 hashmarkername: setroubleshoot kernel: 5.1.18-200.fc29.x86_64 type: libreport
This also occurs in Fedora 30.
*** Bug 1725137 has been marked as a duplicate of this bug. ***
*** Bug 1733677 has been marked as a duplicate of this bug. ***
I'm testing a fix for this now ... should be in pcp-4.3.4 (scheduled for release Friday next week). cheers.
commit bd08dfd4e1b0d7130db558333fed363cb5344676 Author: Nathan Scott <nathans> Date: Mon Jul 29 13:53:32 2019 +1000 libpcp_pmda: close help files after mmap'ing contents There have been a number of reports of an selinux AVC where mdadm (which is run from pmdalinux) is blocked from 'read' access on /var/lib/pcp/pmdas/linux/help.pag (local context is also possibly in play). The help text files are opened and mapped in pmdaOpenHelp(3) but there is no reason for us to keep them open after that, propogating the 2 descriptors across fork/exec for subsequent accidental access by other utilities like mdadm. This resolves Fedora BZ 1721644 (and several duplicate BZs).
Description of problem: After bootup/login the alert was waiting to greet me. Version-Release number of selected component: selinux-policy-3.14.3-42.fc30.noarch Additional info: reporter: libreport-2.10.0 hashmarkername: setroubleshoot kernel: 5.1.20-300.fc30.x86_64 type: libreport
FEDORA-2019-97183bed56 has been submitted as an update to Fedora 30. https://bodhi.fedoraproject.org/updates/FEDORA-2019-97183bed56
FEDORA-2019-44b383ec91 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2019-44b383ec91
pcp-4.3.4-1.fc30 has been pushed to the Fedora 30 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-97183bed56
pcp-4.3.4-1.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-44b383ec91
pcp-4.3.4-1.fc30 has been pushed to the Fedora 30 stable repository. If problems still persist, please make note of it in this bug report.
pcp-4.3.4-1.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.
Description of problem: Just booted the system. Version-Release number of selected component: selinux-policy-3.14.3-43.fc30.noarch Additional info: reporter: libreport-2.10.1 hashmarkername: setroubleshoot kernel: 5.2.13-200.fc30.x86_64 type: libreport