1816383 – SELinux is preventing /usr/lib/systemd/systemd-journald from 'search' accesses on the directory /run/user/1000/systemd/units/invocation:tracker-store.service.

Bug 1816383 - SELinux is preventing /usr/lib/systemd/systemd-journald from 'search' accesses on the directory /run/user/1000/systemd/units/invocation:tracker-store.service.

Summary: SELinux is preventing /usr/lib/systemd/systemd-journald from 'search' accesse...

Keywords:
Status:	CLOSED ERRATA
Alias:	None
Product:	Fedora
Classification:	Fedora
Component:	selinux-policy
Sub Component:
Version:	32
Hardware:	x86_64
OS:	Unspecified
Priority:	medium
Severity:	high
Target Milestone:	---
Assignee:	Lukas Vrabec
QA Contact:	Fedora Extras Quality Assurance
Docs Contact:
URL:
Whiteboard:	abrt_hash:b1577935bb7039839b7d37ba2f4...
Duplicates (1):	1816840 (view as bug list)
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2020-03-23 22:04 UTC by Ankur Sinha (FranciscoD)
Modified:	2020-03-30 00:17 UTC (History)
CC List:	8 users (show)
Fixed In Version:	selinux-policy-3.14.5-32.fc32
Doc Type:	If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:	2020-03-30 00:17:07 UTC
Type:	---
Embargoed:
Dependent Products:

Attachments	(Terms of Use)

Description Ankur Sinha (FranciscoD) 2020-03-23 22:04:37 UTC

Description of problem:
SELinux is preventing /usr/lib/systemd/systemd-journald from 'search' accesses on the directory /run/user/1000/systemd/units/invocation:tracker-store.service.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that systemd-journald should be allowed search access on the invocation:tracker-store.service directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'systemd-journal' --raw | audit2allow -M my-systemdjournal
# semodule -X 300 -i my-systemdjournal.pp

Additional Information:
Source Context                system_u:system_r:syslogd_t:s0
Target Context                unconfined_u:object_r:session_dbusd_tmp_t:s0
Target Objects                /run/user/1000/systemd/units/invocation:tracker-
                              store.service [ dir ]
Source                        systemd-journal
Source Path                   /usr/lib/systemd/systemd-journald
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           systemd-245.2-1.fc32.x86_64
Target RPM Packages           
SELinux Policy RPM            selinux-policy-3.14.5-31.fc32.noarch
Local Policy RPM              selinux-policy-targeted-3.14.5-31.fc32.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     (removed)
Platform                      Linux (removed) 5.6.0-0.rc5.git0.2.fc32.x86_64 #1
                              SMP Tue Mar 10 19:09:42 UTC 2020 x86_64 x86_64
Alert Count                   6
First Seen                    2020-03-23 21:52:41 GMT
Last Seen                     2020-03-23 21:56:52 GMT
Local ID                      0ed0c417-477f-45d0-a426-7ab8ced63802

Raw Audit Messages
type=AVC msg=audit(1585000612.469:348): avc:  denied  { search } for  pid=577 comm="systemd-journal" name="systemd" dev="tmpfs" ino=26953 scontext=system_u:system_r:syslogd_t:s0 tcontext=unconfined_u:object_r:session_dbusd_tmp_t:s0 tclass=dir permissive=1


type=AVC msg=audit(1585000612.469:348): avc:  denied  { read } for  pid=577 comm="systemd-journal" name="invocation:tracker-store.service" dev="tmpfs" ino=91133 scontext=system_u:system_r:syslogd_t:s0 tcontext=unconfined_u:object_r:session_dbusd_tmp_t:s0 tclass=lnk_file permissive=1


type=SYSCALL msg=audit(1585000612.469:348): arch=x86_64 syscall=readlinkat success=yes exit=EPIPE a0=ffffff9c a1=557cfec5ce00 a2=557cfec8ad20 a3=1000 items=1 ppid=1 pid=577 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=systemd-journal exe=/usr/lib/systemd/systemd-journald subj=system_u:system_r:syslogd_t:s0 key=(null)

type=CWD msg=audit(1585000612.469:348): cwd=/

type=PATH msg=audit(1585000612.469:348): item=0 name=/run/user/1000/systemd/units/invocation:tracker-store.service inode=91133 dev=00:27 mode=0120777 ouid=1000 ogid=1000 rdev=00:00 obj=unconfined_u:object_r:session_dbusd_tmp_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0

Hash: systemd-journal,syslogd_t,session_dbusd_tmp_t,dir,search

Version-Release number of selected component:
selinux-policy-3.14.5-31.fc32.noarch

Additional info:
component:      selinux-policy
reporter:       libreport-2.12.0
hashmarkername: setroubleshoot
kernel:         5.6.0-0.rc5.git0.2.fc32.x86_64
type:           libreport

Comment 1 Ankur Sinha (FranciscoD) 2020-03-23 22:14:24 UTC

Hrm, lots of wrong contexts here, which is weird because I've just done a whole system relabel to ensure that everything was correctly labelled:

```
$ sudo /sbin/restorecon -Rv /run/user/1000/systemd/*                                                                                                                                                           [16/2487]
Relabeled /run/user/1000/systemd/notify from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0                                                                                                              
Relabeled /run/user/1000/systemd/private from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0                                                                                                             
Relabeled /run/user/1000/systemd/transient from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0                                                                                                           
Relabeled /run/user/1000/systemd/transient/vte-spawn-08717913-d57e-4585-ba43-a349517f8a3c.scope from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0                                                      
Relabeled /run/user/1000/systemd/transient/dbus-:1.2-org.gnome.Calendar from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0                                                                    
Relabeled /run/user/1000/systemd/transient/dbus-:1.2-org.freedesktop.portal.IBus from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0                                                           
Relabeled /run/user/1000/systemd/transient/gnome-launched-org.gnome.SettingsDaemon.DiskUtilityNotify.desktop-1960.scope from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0                              
Relabeled /run/user/1000/systemd/transient/gnome-launched-tracker-miner-fs.desktop-1959.scope from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0                                                        
Relabeled /run/user/1000/systemd/transient/gnome-launched-sealertauto.desktop-1958.scope from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0                                                             
Relabeled /run/user/1000/systemd/transient/gnome-launched-dropbox.desktop-1948.scope from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0                                                                 
Relabeled /run/user/1000/systemd/transient/gnome-launched-gnome-software-service.desktop-1939.scope from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0                                                  
Relabeled /run/user/1000/systemd/transient/gnome-launched-org.gnome.Evolution-alarm-notify.desktop-1891.scope from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0                                        
Relabeled /run/user/1000/systemd/transient/dbus-:1.2-org.freedesktop.problems.applet from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0                                                       
Relabeled /run/user/1000/systemd/transient/dbus-:1.19-org.a11y.atspi.Registry from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0                                                              
Relabeled /run/user/1000/systemd/transient/dbus-:1.2-org.gnome.Pomodoro from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0                                                                    
Relabeled /run/user/1000/systemd/transient/dbus-:1.2-org.gnome.Identity from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0                                                                    
Relabeled /run/user/1000/systemd/transient/dbus-:1.2-ca.desrt.dconf from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/transient/dbus-:1.2-org.gnome.OnlineAccounts from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/transient/dbus-:1.2-org.gnome.Shell.CalendarServer from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:vte-spawn-08717913-d57e-4585-ba43-a349517f8a3c.scope from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:dbus-:1.2-org.gnome.Calendar from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:dbus-:1.2-org.freedesktop.portal.IBus from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gsd-xsettings.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gnome-launched-tracker-miner-fs.desktop-1959.scope from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gnome-launched-sealertauto.desktop-1958.scope from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gnome-launched-org.gnome.SettingsDaemon.DiskUtilityNotify.desktop-1960.scope from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gnome-launched-org.gnome.Evolution-alarm-notify.desktop-1891.scope from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gnome-launched-gnome-software-service.desktop-1939.scope from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gnome-launched-dropbox.desktop-1948.scope from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:evolution-addressbook-factory.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:dbus-:1.2-org.freedesktop.problems.applet from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gsd-wwan.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gsd-wacom.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gsd-usb-protection.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gsd-sound.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gsd-smartcard.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gsd-sharing.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gsd-screensaver-proxy.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gsd-rfkill.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gsd-print-notifications.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gsd-power.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gsd-media-keys.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gsd-keyboard.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gsd-housekeeping.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gsd-datetime.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gsd-color.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gsd-a11y-settings.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:evolution-calendar-factory.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:dbus-:1.19-org.a11y.atspi.Registry from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:dbus-:1.2-org.gnome.Pomodoro from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gvfs-mtp-volume-monitor.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gvfs-gphoto2-volume-monitor.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gvfs-afc-volume-monitor.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:dbus-:1.2-org.gnome.Identity from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gvfs-goa-volume-monitor.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gvfs-metadata.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:dbus-:1.2-ca.desrt.dconf from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gvfs-udisks2-volume-monitor.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:dbus-:1.2-org.gnome.OnlineAccounts from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:evolution-source-registry.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:dbus-:1.2-org.gnome.Shell.CalendarServer from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:xdg-permission-store.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gvfs-daemon.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:at-spi-dbus-bus.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gnome-shell-wayland.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gnome-session-manager from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:pulseaudio.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:gnome-session-monitor.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:dbus-broker.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:syncthing.service from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
Relabeled /run/user/1000/systemd/units/invocation:dbus.socket from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:session_dbusd_tmp_t:s0
```

Comment 2 Adam Williamson 2020-03-24 19:45:21 UTC

I think this is a dupe of https://bugzilla.redhat.com/show_bug.cgi?id=1800927 , but not sure about the types being changed by restorecon - Zdenek? Lukas?

Comment 3 Lukas Vrabec 2020-03-24 20:46:52 UTC

I see the issue and I prepared bug fix, patches should be in selinux-policy package soon.

Comment 4 Lukas Vrabec 2020-03-24 20:48:23 UTC

commit 08e08c88a33fe909c140d8d2c91e63aaff99c3b9 (HEAD -> rawhide, origin/rawhide, origin/HEAD)
Author: Lukas Vrabec <lvrabec>
Date:   Tue Mar 24 11:39:14 2020 +0100

    Remove label session_dbusd_tmp_t for /run/user/USERID/systemd
    
    In path /run/user/USERID/systemd/ are stored files used by user service
    manager to start user services in custom namespaces. These files are not
    related to systemd. New Label should be user_tmp_t.
    
    Related:  rhbz#1798912
    Resolves: rhbz#1816383

Comment 5 Zdenek Pytela 2020-03-25 15:23:32 UTC

*** Bug 1816840 has been marked as a duplicate of this bug. ***

Comment 6 Fedora Update System 2020-03-27 15:58:27 UTC

FEDORA-2020-32711482f7 has been pushed to the Fedora 32 testing repository.
In short time you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2020-32711482f7`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2020-32711482f7

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2020-03-30 00:17:07 UTC

FEDORA-2020-32711482f7 has been pushed to the Fedora 32 stable repository.
If problem still persists, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.