Bug 1727887
| Summary: | systemd user instance does not start for SELinux restricted accounts | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Martin Pitt <mpitt> |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | medium | Docs Contact: | Jan Fiala <jafiala> |
| Priority: | medium | ||
| Version: | 8.1 | CC: | amore, lvrabec, mmalik, plautrba, sgrubb, ssekidde, zpytela |
| Target Milestone: | rc | Keywords: | AutoVerified, Patch |
| Target Release: | 8.2 | Flags: | pm-rhel:
mirror+
|
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-3.14.3-22.el8 | Doc Type: | Enhancement |
| Doc Text: |
.Confined users in SELinux can now manage user session services
Previously, confined users were not able to manage user session services. As a result, they could not execute `systemctl --user` or `busctl --user` commands or work in the RHEL web console. With this update, confined users can manage user sessions.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-04-28 16:40:41 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1727382, 1755139, 1761915, 1778780 | ||
|
Description
Martin Pitt
2019-07-08 12:58:52 UTC
*** Bug 1754476 has been marked as a duplicate of this bug. *** I tested this on a reasonably current RHEL 8.2 nightly instance with selinux-policy-3.14.3-24.el8.noarch, and the test case still fails in exactly the same way. This also still happens on latest Fedora 31. When I say "test case" I meant the reproducer in the bug description. I tested this with 'user_u' instead of 'guest_u', and that works. But you said in comment #1 that guest_u should be able to do this as well. If that shouldn't be the case any more, please feel free to reset to verified, of course. Thanks! The problem with guest_u is that systemctl and busctl do not work in permissive mode: $ id uid=1000(guest-user) gid=1000(guest-user) groups=1000(guest-user) context=guest_u:guest_r:guest_t:s0 $ sestatus SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: permissive Mode from config file: enforcing Policy MLS status: enabled Policy deny_unknown status: allowed Memory protection checking: actual (secure) Max kernel policy version: 31 $ /usr/bin/systemctl --user status Failed to connect to bus: No such file or directory $ /usr/bin/busctl --user Failed to set address: No such file or directory $ Some changes need to be done in systemd package. # rpm -qa selinux\* systemd\* | sort selinux-policy-3.14.3-24.el8.noarch selinux-policy-targeted-3.14.3-24.el8.noarch systemd-239-19.el8.x86_64 systemd-libs-239-19.el8.x86_64 systemd-pam-239-19.el8.x86_64 systemd-udev-239-19.el8.x86_64 # Lukas said in bug 1718814 that guest_u is a really restricted role that shouldn't even have network access. So it sounds like the current implementation is fine, and this working with user_u and sysadm_u is sufficient. So I drop the FailedQA again, and I create cockpit test cases for user_u and sysadm_u. Thanks! Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:1773 |