Description of problem: Kernel update, may be. SELinux is preventing systemd-modules from 'read' accesses on the file SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that systemd-modules should be allowed read access on the SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'systemd-modules' --raw | audit2allow -M my-systemdmodules # semodule -X 300 -i my-systemdmodules.pp Additional Information: Source Context system_u:system_r:systemd_modules_load_t:s0 Target Context system_u:object_r:efivarfs_t:s0 Target Objects SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c [ file ] Source systemd-modules Source Path systemd-modules Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM <Unknown> Local Policy RPM selinux-policy-targeted-3.14.5-32.fc32.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 5.6.0-0.rc7.git0.2.fc32.x86_64 #1 SMP Mon Mar 23 18:38:45 UTC 2020 x86_64 x86_64 Alert Count 5 First Seen 2020-03-27 22:59:31 MSK Last Seen 2020-03-31 13:29:59 MSK Local ID 9631dd38-9ae6-4a3a-a6d9-80a1b68be940 Raw Audit Messages type=AVC msg=audit(1585650599.412:1966): avc: denied { read } for pid=211026 comm="systemd-modules" name="SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=16638 scontext=system_u:system_r:systemd_modules_load_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=0 Hash: systemd-modules,systemd_modules_load_t,efivarfs_t,file,read Additional info: component: selinux-policy reporter: libreport-2.12.0 hashmarkername: setroubleshoot kernel: 5.6.0-0.rc7.git0.2.fc32.x86_64 type: libreport
Alex, Thank you for reporting the issue. Are you aware at which moment this denial triggers? Did you also notice any command failing?
Well, I'm not sure. There no failing commands. I was doing `dnf update`. `dnf hist` tells me, that `kmod-VirtualBox` was involved: ID | Command line | Date and time --------------------------------------------------------------------------------------------------------------------------------------------------------------- 924 | -y install --disablerepo=* /tmp/akmods.isUns5pL/results/kmod-VirtualBox-5.6.0-300.fc32.x86_64-6.1.4-3.fc32.x86_64.rpm | 2020-03-31 923 | up -y | 2020-03-31
I would be glad to provide additional info, logs or command output, if needed.
I see it on Fedora Server. I'm not sure what systemd does with secure boot state, it might only affect sd-boot installations. $ sudo journalctl -b -o short-monotonic | grep AVC [ 10.867636] fnuc.local audit[513]: AVC avc: denied { read } for pid=513 comm="systemd-modules" name="SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=333 scontext=system_u:system_r:systemd_modules_load_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=0 [ 10.867984] fnuc.local audit[513]: AVC avc: denied { read } for pid=513 comm="systemd-modules" name="SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=333 scontext=system_u:system_r:systemd_modules_load_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=0 selinux-policy-3.14.5-36.fc32.noarch
Similar problem has been detected: dnf upgrade hashmarkername: setroubleshoot kernel: 5.6.6-300.fc32.x86_64 package: selinux-policy-targeted-3.14.5-32.fc32.noarch reason: SELinux is preventing systemd-modules from 'read' accesses on the file SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c. type: libreport
Similar problem has been detected: This happened on the first boot after upgrading Fedora 31 to 32. hashmarkername: setroubleshoot kernel: 5.6.6-300.fc32.x86_64 package: selinux-policy-targeted-3.14.5-32.fc32.noarch reason: SELinux is preventing systemd-modules from 'read' accesses on the file SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c. type: libreport
Similar problem has been detected: I was updating with dnf upgrade from a terminal, and among others, there were kernel updates being deinstalled/installed. The system was very recently upgraded from F30 via F31 to F32, using GNOME Software's new operating system proposal. hashmarkername: setroubleshoot kernel: 5.6.7-300.fc32.x86_64 reason: SELinux is preventing systemd-modules from 'read' accesses on the Datei SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c. type: libreport
Similar problem has been detected: Just pops in after booting hashmarkername: setroubleshoot kernel: 5.6.8-300.fc32.x86_64 reason: SELinux is preventing systemd-modules from 'read' accesses on the file SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c. type: libreport
Similar problem has been detected: Sussedio despues de haber actualizado Fedora 31 a 32 hashmarkername: setroubleshoot kernel: 5.6.8-300.fc32.x86_64 package: selinux-policy-targeted-3.14.5-32.fc32.noarch reason: SELinux is preventing systemd-modules from 'read' accesses on the archivo SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c. type: libreport
I have just noticed the same problem after upgrading to Fedora 32, but not immediately. I think that it may have been triggered by GNOME Software downloading update information (not the updates themselves), but I’m not even sure as I wasn’t doing anything special when the SELinux notification came up
*** This bug has been marked as a duplicate of bug 1824196 ***
*** Bug 1838933 has been marked as a duplicate of this bug. ***