SELinux is preventing /usr/bin/abrt-dump-journal-core from create access on the udp_socket port None. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that abrt-dump-journal-core should be allowed create access on the port None udp_socket by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'abrt-dump-journ' --raw | audit2allow -M my-abrtdumpjourn # semodule -X 300 -i my-abrtdumpjourn.pp Additional Information: Source Context system_u:system_r:abrt_dump_oops_t:s0 Target Context system_u:system_r:abrt_dump_oops_t:s0 Target Objects port None [ udp_socket ] Source abrt-dump-journ Source Path /usr/bin/abrt-dump-journal-core Port <Unknown> Host hpe-dl380pgen8-02-vm-8.hpe2.lab.eng.bos.redhat.com Source RPM Packages abrt-addon-ccpp-2.13.0-1.fc31.x86_64 Target RPM Packages Policy RPM selinux-policy-3.14.4-43.fc31.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name host.example.com Platform Linux host.example.com 5.4.10-200.fc31.x86_64 #1 SMP Thu Jan 9 19:58:12 UTC 2020 x86_64 x86_64 Alert Count 2 First Seen 2020-01-18 10:45:40 EST Last Seen 2020-01-18 10:50:35 EST Local ID 88f42590-2f99-4d72-8554-57ba633573e8 Raw Audit Messages type=AVC msg=audit(1579362635.337:36432): avc: denied { create } for pid=163020 comm="abrt-dump-journ" scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:system_r:abrt_dump_oops_t:s0 tclass=udp_socket permissive=0 type=SYSCALL msg=audit(1579362635.337:36432): arch=x86_64 syscall=socket success=no exit=EACCES a0=a a1=2 a2=0 a3=12 items=0 ppid=1 pid=163020 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=abrt-dump-journ exe=/usr/bin/abrt-dump-journal-core subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null) Hash: abrt-dump-journ,abrt_dump_oops_t,abrt_dump_oops_t,udp_socket,create
sh-5.0# journalctl | grep -C3 171272 | sed -e 's/hpe-dl380pgen8-02-vm-8.hpe2.lab.eng.bos.redhat.com/host.example.com/g' Jan 18 10:59:38 host.example.com systemd[1]: Started Creates ABRT problems from coredumpctl messages. Jan 18 10:59:38 host.example.com audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=abrt-journal-core comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' Jan 18 10:59:38 host.example.com sssd[171269]: Starting up Jan 18 10:59:39 host.example.com audit[171272]: AVC avc: denied { create } for pid=171272 comm="abrt-dump-journ" scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:system_r:abrt_dump_oops_t:s0 tclass=udp_socket permissive=0 Jan 18 10:59:39 host.example.com audit[171272]: SYSCALL arch=c000003e syscall=41 success=no exit=-13 a0=a a1=2 a2=0 a3=12 items=0 ppid=1 pid=171272 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="abrt-dump-journ" exe="/usr/bin/abrt-dump-journal-core" subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null) Jan 18 10:59:39 host.example.com audit: PROCTITLE proctitle=2F7573722F62696E2F616272742D64756D702D6A6F75726E616C2D636F7265002D44002D54002D66002D65 Jan 18 10:59:39 host.example.com setroubleshoot[170740]: SELinux is preventing /usr/bin/abrt-dump-journal-core from create access on the udp_socket port None. For complete SELinux messages run: sealert -l 88f42590-2f99-4d72-8554-57ba633573e8 Jan 18 10:59:39 host.example.com python3[170740]: SELinux is preventing /usr/bin/abrt-dump-journal-core from create access on the udp_socket port None. -- Jan 18 10:59:53 host.example.com restraintd[689]: ** Cleanup-for-Member-of-dereferencing PASS Score:0 Jan 18 10:59:56 host.example.com systemd[1]: Started dbus-:1.2-org.freedesktop.problems. Jan 18 10:59:56 host.example.com audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=dbus-:1.2-org.freedesktop.problems@20 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' Jan 18 10:59:56 host.example.com abrt-dump-journal-core[171272]: Cannot save journal watch's position Jan 18 10:59:56 host.example.com systemd[1]: Stopping Creates ABRT problems from coredumpctl messages... Jan 18 10:59:56 host.example.com systemd[1]: abrt-journal-core.service: Succeeded. Jan 18 10:59:56 host.example.com systemd[1]: Stopped Creates ABRT problems from coredumpctl messages. sh-5.0# grep -C10 EACCES strace.log.171272 stat("/etc/crypto-policies/back-ends/opensslcnf.config", {st_dev=makedev(0xfd, 0), st_ino=25389279, st_mode=S_IFREG|0644, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=313, st_atime=1579443783 /* 2020-01-19T09:23:03.534143893-0500 */, st_atime_nsec=534143893, st_mtime=1576518873 /* 2019-12-16T12:54:33-0500 */, st_mtime_nsec=0, st_ctime=1579353855 /* 2020-01-18T08:24:15.971326498-0500 */, st_ctime_nsec=971326498}) = 0 openat(AT_FDCWD, "/etc/crypto-policies/back-ends/opensslcnf.config", O_RDONLY) = 4</usr/share/crypto-policies/DEFAULT/opensslcnf.txt> fstat(4</usr/share/crypto-policies/DEFAULT/opensslcnf.txt>, {st_dev=makedev(0xfd, 0), st_ino=25389279, st_mode=S_IFREG|0644, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=313, st_atime=1579443783 /* 2020-01-19T09:23:03.534143893-0500 */, st_atime_nsec=534143893, st_mtime=1576518873 /* 2019-12-16T12:54:33-0500 */, st_mtime_nsec=0, st_ctime=1579353855 /* 2020-01-18T08:24:15.971326498-0500 */, st_ctime_nsec=971326498}) = 0 read(4</usr/share/crypto-policies/DEFAULT/opensslcnf.txt>, "CipherString = @SECLEVEL=1:kEECD"..., 4096) = 313 read(4</usr/share/crypto-policies/DEFAULT/opensslcnf.txt>, "", 4096) = 0 close(4</usr/share/crypto-policies/DEFAULT/opensslcnf.txt>) = 0 read(3</etc/pki/tls/openssl.cnf>, "ng, T61String, BMPString.\n# pkix"..., 4096) = 4096 read(3</etc/pki/tls/openssl.cnf>, "rityKeyIdentifier=keyid:always\n\n"..., 4096) = 3035 read(3</etc/pki/tls/openssl.cnf>, "", 4096) = 0 close(3</etc/pki/tls/openssl.cnf>) = 0 socket(AF_INET6, SOCK_DGRAM, IPPROTO_IP) = -1 EACCES (Permission denied) munmap(0x7fe3a917b000, 60360) = 0 gettimeofday({tv_sec=1579363179, tv_usec=76218}, NULL) = 0 futex(0x7fe3a9072fb8, FUTEX_WAKE_PRIVATE, 2147483647) = 0 futex(0x7fe3a9072fb8, FUTEX_WAKE_PRIVATE, 2147483647) = 0 access("/etc/system-fips", F_OK) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/share/locale/locale.alias", O_RDONLY|O_CLOEXEC) = 3</usr/share/locale/locale.alias> fstat(3</usr/share/locale/locale.alias>, {st_dev=makedev(0xfd, 0), st_ino=25290116, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2997, st_atime=1579443780 /* 2020-01-19T09:23:00.001000040-0500 */, st_atime_nsec=1000040, st_mtime=1575478368 /* 2019-12-04T11:52:48-0500 */, st_mtime_nsec=0, st_ctime=1579353836 /* 2020-01-18T08:23:56.691136506-0500 */, st_ctime_nsec=691136506}) = 0 brk(NULL) = 0x55a30e6a8000 brk(0x55a30e6c9000) = 0x55a30e6c9000
It looks like the same issue as in rawhide 1778030 and is fixed by selinux-policy-3.14.4-44.fc31.noarch *** This bug has been marked as a duplicate of bug 1778030 ***