Bug 1832234
| Summary: | SELinux is preventing /usr/lib/systemd/systemd from mounton access on the directory /run/systemd/unit-root/run/motd.d. | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Martin Krajnak <mkrajnak> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED DUPLICATE | QA Contact: | Milos Malik <mmalik> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 8.3 | CC: | lvrabec, mmalik, plautrba, ssekidde |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | 8.3 | Flags: | pm-rhel:
mirror+
|
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-06-10 13:46:53 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Our automated TC triggers the same SELinux denial in permissive mode:
----
type=PROCTITLE msg=audit(05/07/2020 10:46:46.954:1895) : proctitle=(fwupd)
type=PATH msg=audit(05/07/2020 10:46:46.954:1895) : item=1 name=/run/motd.d inode=258614 dev=00:17 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:pam_var_run_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=PATH msg=audit(05/07/2020 10:46:46.954:1895) : item=0 name=/run/systemd/unit-root/run/motd.d inode=258614 dev=00:17 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:pam_var_run_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(05/07/2020 10:46:46.954:1895) : cwd=/
type=SYSCALL msg=audit(05/07/2020 10:46:46.954:1895) : arch=x86_64 syscall=mount success=yes exit=0 a0=0x5592eb8bbf80 a1=0x5592eb716e50 a2=0x0 a3=MS_BIND|MS_REC items=2 ppid=1 pid=81205 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=(fwupd) exe=/usr/lib/systemd/systemd subj=system_u:system_r:init_t:s0 key=(null)
type=AVC msg=audit(05/07/2020 10:46:46.954:1895) : avc: denied { mounton } for pid=81205 comm=(fwupd) path=/run/systemd/unit-root/run/motd.d dev="tmpfs" ino=258614 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:pam_var_run_t:s0 tclass=dir permissive=1
----
The automated TC also shows that file contexts patterns are not correct:
# restorecon -Rv /run /var
Relabeled /var/cache/fwupd/motd.d from system_u:object_r:fwupd_cache_t:s0 to system_u:object_r:var_t:s0
Relabeled /var/cache/fwupd/motd.d/85-fwupd from system_u:object_r:fwupd_cache_t:s0 to system_u:object_r:var_t:s0
This bug is in NEW state. There is no selinux-policy build for RHEL-8 which would contain the fix. This bug has not been fully acknowledged for resolving during RHEL 8.3 development and testing phase yet. If you want to pursue this issue further, please explain what makes the severity urgent: https://bugzilla.redhat.com/page.cgi?id=fields.html#bug_severity urgent catastrophic issues which severely impact the mission-critical operations of an organization. This may mean that the operational servers, development systems or customer applications are down or not functioning and no procedural workaround exists. so that we can respond appropriately. A new build should be ready later this week. To work around the problem, create and load a custom policy file: # cat local_init_mounton.cil (allow init_t non_security_file_type (dir (write setattr mounton))) # semodule -i local_init_mounton.cil Hi Zdenek, thnaks you for you comment, I am setting the Severity accordingly. If see this issue correctly, it is also conected to the fwupd and explatation I provided in the other bug (BZ 1832231), if not please correct me. Milosi, I am for closing this bugzilla as a dup as the fix is more general. Is there some further action needed to ensure the test attached to this bz will be included in test runs? *** This bug has been marked as a duplicate of bug 1832231 *** The needinfo request[s] on this closed bug have been removed as they have been unresolved for 1000 days |
Description of problem: SELinux is preventing /usr/lib/systemd/systemd from mounton access on the directory /run/systemd/unit-root/run/motd.d. ***** Plugin restorecon (99.5 confidence) suggests ************************ If you want to fix the label. /run/systemd/unit-root/run/motd.d default label should be init_var_run_t. Then you can run restorecon. The access attempt may have been stopped due to insufficient permissions to access a parent directory in which case try to change the following command accordingly. Do # /sbin/restorecon -v /run/systemd/unit-root/run/motd.d ***** Plugin catchall (1.49 confidence) suggests ************************** If you believe that systemd should be allowed mounton access on the motd.d directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c '(fwupd)' --raw | audit2allow -M my-fwupd # semodule -X 300 -i my-fwupd.pp Additional Information: Source Context system_u:system_r:init_t:s0 Target Context system_u:object_r:pam_var_run_t:s0 Target Objects /run/systemd/unit-root/run/motd.d [ dir ] Source (fwupd) Source Path /usr/lib/systemd/systemd Port <Unknown> Host localhost.localdomain Source RPM Packages systemd-239-30.el8_2.x86_64 Target RPM Packages Policy RPM selinux-policy-3.14.3-43.el8.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name localhost.localdomain Platform Linux localhost.localdomain 4.18.0-195.el8.x86_64 #1 SMP Tue May 5 16:21:51 UTC 2020 x86_64 x86_64 Alert Count 1 First Seen 2020-05-06 13:12:52 CEST Last Seen 2020-05-06 13:12:52 CEST Local ID 1996b422-7a70-48ce-8349-d01e6b829802 Raw Audit Messages type=AVC msg=audit(1588763572.481:90): avc: denied { mounton } for pid=2173 comm="(fwupd)" path="/run/systemd/unit-root/run/motd.d" dev="tmpfs" ino=39784 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:pam_var_run_t:s0 tclass=dir permissive=1 type=SYSCALL msg=audit(1588763572.481:90): arch=x86_64 syscall=mount success=yes exit=0 a0=556e565f26a0 a1=556e565e0d50 a2=0 a3=5000 items=1 ppid=1 pid=2173 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=(fwupd) exe=/usr/lib/systemd/systemd subj=system_u:system_r:init_t:s0 key=(null) type=CWD msg=audit(1588763572.481:90): cwd=/ type=PATH msg=audit(1588763572.481:90): item=0 name=/run/motd.d inode=39784 dev=00:18 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:pam_var_run_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 Hash: (fwupd),init_t,pam_var_run_t,dir,mounton