Bug 1756577 - SELinux is preventing (ogrotate) from 'mount' accesses on the Dateisystem /.
Summary: SELinux is preventing (ogrotate) from 'mount' accesses on the Dateisystem /.
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 30
Hardware: x86_64
OS: Unspecified
medium
medium
Target Milestone: ---
Assignee: Lukas Vrabec
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:f919c060172cfc7bd83c5e7286f...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-09-28 06:31 UTC by bugzilla
Modified: 2019-10-22 07:36 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-10-22 07:36:12 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description bugzilla 2019-09-28 06:31:16 UTC
Description of problem:
What is ogrotate?
SELinux is preventing (ogrotate) from 'mount' accesses on the Dateisystem /.

*****  Plugin catchall (100. confidence) suggests   **************************

Wenn Sie denken, dass es (ogrotate) standardmäßig erlaubt sein sollte, mount Zugriff auf  filesystem zu erhalten.
Then sie sollten dies als Fehler melden.
Um diesen Zugriff zu erlauben, können Sie ein lokales Richtlinien-Modul erstellen.
Do
zugriff jetzt erlauben, indem Sie die nachfolgenden Befehle ausführen:
# ausearch -c '(ogrotate)' --raw | audit2allow -M my-ogrotate
# semodule -X 300 -i my-ogrotate.pp

Additional Information:
Source Context                system_u:system_r:init_t:s0
Target Context                unconfined_u:object_r:locale_t:s0
Target Objects                / [ filesystem ]
Source                        (ogrotate)
Source Path                   (ogrotate)
Port                          <Unbekannt>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    <Unbekannt>
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 5.2.15-200.fc30.x86_64 #1 SMP Mon
                              Sep 16 15:17:36 UTC 2019 x86_64 x86_64
Alert Count                   3
First Seen                    2019-09-27 00:00:42 CEST
Last Seen                     2019-09-28 00:00:47 CEST
Local ID                      3c056ec2-0bc0-4f11-bffe-3ac7560d6cce

Raw Audit Messages
type=AVC msg=audit(1569621647.880:912): avc:  denied  { mount } for  pid=26570 comm="(ogrotate)" name="/" dev="tmpfs" ino=2036935 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:locale_t:s0 tclass=filesystem permissive=0


Hash: (ogrotate),init_t,locale_t,filesystem,mount


Additional info:
component:      selinux-policy
reporter:       libreport-2.10.1
hashmarkername: setroubleshoot
kernel:         5.2.15-200.fc30.x86_64
type:           libreport

Comment 1 Lukas Vrabec 2019-10-02 15:13:03 UTC
Hi, 

Are you able to reproduce it? If yes, could you please share it? 

THanks,
Lukas.

Comment 2 bugzilla 2019-10-22 04:28:09 UTC
Hi,

looks like my last answer didn't end up here.

Sorry, can't reproduce and it never happened again...

regards
Maik

Comment 3 Lukas Vrabec 2019-10-22 07:36:12 UTC
Thanks for your comment. 

Let's close it for now and if you catch it again, we could do some more investigation. 

Thanks,
Lukas.


Note You need to log in before you can comment on or make changes to this bug.