Description of problem: Confined users trigger AVC denial when screen is run and tries to access wtmp Version-Release number of selected component (if applicable): selinux-policy-3.14.5-11.fc32.noarch How reproducible: always Steps to Reproduce: 1. log in as a confined user user_u, staff_u, sysadm_t 2. execute screen or tmux Actual results: Screen/tmux is working, but wtmp is not updated AVC's are logged Expected results: wtmp updated, no AVC's. Additional info:
List of denials gathered in permissive mode: ---- type=PROCTITLE msg=audit(1.11.2019 11:08:23.636:248) : proctitle=/usr/libexec/utempter/utempter add :tty5:S.0 type=PATH msg=audit(1.11.2019 11:08:23.636:248) : item=1 name=/lib64/ld-linux-x86-64.so.2 inode=273424 dev=fd:00 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:ld_so_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(1.11.2019 11:08:23.636:248) : item=0 name=/usr/libexec/utempter/utempter inode=275058 dev=fd:00 mode=file,sgid,711 ouid=root ogid=utmp rdev=00:00 obj=system_u:object_r:utempter_exec_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(1.11.2019 11:08:23.636:248) : cwd=/home/user type=EXECVE msg=audit(1.11.2019 11:08:23.636:248) : argc=3 a0=/usr/libexec/utempter/utempter a1=add a2=:tty5:S.0 type=SYSCALL msg=audit(1.11.2019 11:08:23.636:248) : arch=x86_64 syscall=execve success=yes exit=0 a0=0x7fef73c6d000 a1=0x7ffe016d63f0 a2=0x7ffe016d7f38 a3=0x7fef739f4b80 items=2 ppid=1538 pid=1540 auid=user uid=user gid=user euid=user suid=user fsuid=user egid=utmp sgid=utmp fsgid=utmp tty=(none) ses=6 comm=utempter exe=/usr/libexec/utempter/utempter subj=user_u:user_r:user_screen_t:s0 key=(null) type=AVC msg=audit(1.11.2019 11:08:23.636:248) : avc: denied { map } for pid=1540 comm=utempter path=/usr/libexec/utempter/utempter dev="dm-0" ino=275058 scontext=user_u:user_r:user_screen_t:s0 tcontext=system_u:object_r:utempter_exec_t:s0 tclass=file permissive=1 type=AVC msg=audit(1.11.2019 11:08:23.636:248) : avc: denied { read open } for pid=1540 comm=screen path=/usr/libexec/utempter/utempter dev="dm-0" ino=275058 scontext=user_u:user_r:user_screen_t:s0 tcontext=system_u:object_r:utempter_exec_t:s0 tclass=file permissive=1 ---- type=PROCTITLE msg=audit(1.11.2019 11:08:23.647:249) : proctitle=/usr/libexec/utempter/utempter add :tty5:S.0 type=PATH msg=audit(1.11.2019 11:08:23.647:249) : item=0 name=/var/log/wtmp inode=130135 dev=fd:00 mode=file,664 ouid=root ogid=utmp rdev=00:00 obj=system_u:object_r:wtmp_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(1.11.2019 11:08:23.647:249) : cwd=/home/user type=SYSCALL msg=audit(1.11.2019 11:08:23.647:249) : arch=x86_64 syscall=openat success=yes exit=7 a0=0xffffff9c a1=0x5615ecd42012 a2=O_WRONLY a3=0x0 items=1 ppid=1538 pid=1540 auid=user uid=user gid=user euid=user suid=user fsuid=user egid=utmp sgid=utmp fsgid=utmp tty=(none) ses=6 comm=utempter exe=/usr/libexec/utempter/utempter subj=user_u:user_r:user_screen_t:s0 key=(null) type=AVC msg=audit(1.11.2019 11:08:23.647:249) : avc: denied { open } for pid=1540 comm=utempter path=/var/log/wtmp dev="dm-0" ino=130135 scontext=user_u:user_r:user_screen_t:s0 tcontext=system_u:object_r:wtmp_t:s0 tclass=file permissive=1 type=AVC msg=audit(1.11.2019 11:08:23.647:249) : avc: denied { write } for pid=1540 comm=utempter name=wtmp dev="dm-0" ino=130135 scontext=user_u:user_r:user_screen_t:s0 tcontext=system_u:object_r:wtmp_t:s0 tclass=file permissive=1 Likewise for staff_u and sysadm_u.
This bug appears to have been reported against 'rawhide' during the Fedora 32 development cycle. Changing version to 32.
https://github.com/fedora-selinux/selinux-policy-contrib/pull/359
FEDORA-2021-8d26207af7 has been submitted as an update to Fedora 34. https://bodhi.fedoraproject.org/updates/FEDORA-2021-8d26207af7
FEDORA-2021-8d26207af7 has been pushed to the Fedora 34 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2021-8d26207af7` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2021-8d26207af7 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2021-8d26207af7 has been pushed to the Fedora 34 stable repository. If problem still persists, please make note of it in this bug report.