Description of problem: Cron jobs don't run. I see the messages below. I ran a restorecon on etc and /usr/bin with no improvement. This has been working, but a recent update causes it to now fail. There have been several updates of Name : container-selinux Epoch : 2 Version : 2.142.0 Release : 1.fc31 Architecture: noarch Install Date: Sat 25 Jul 2020 12:25:29 PM MST if that matters. Version-Release number of selected component (if applicable): Name : selinux-policy-targeted Version : 3.14.4 Release : 53.fc31 Architecture: noarch Install Date: Fri 12 Jun 2020 09:11:14 AM MST How reproducible: Every boot Steps to Reproduce: 1. Not sure, as I don't know what triggered the problem. The only other thing that might have done this is a glibc update. 2. 3. Actual results: No cron jobs run. Expected results: cron jobs run as usual. Additional info: Jul 28 10:07:09 localhost.localdomain crond[1192]: (CRON) INFO (running with inotify support) Jul 28 10:07:09 localhost.localdomain crond[1192]: (root) FAILED (loading cron table) Jul 28 10:07:09 localhost.localdomain crond[1192]: ((null)) No SELinux security context (/etc/cron.d/0hourly) Jul 28 10:07:08 localhost.localdomain crond[1192]: (root) FAILED (loading cron table) Jul 28 10:07:08 localhost.localdomain crond[1192]: ((null)) No SELinux security context (/etc/cron.d/atop) Jul 28 10:07:08 localhost.localdomain crond[1192]: (root) FAILED (loading cron table) Jul 28 10:07:08 localhost.localdomain crond[1192]: ((null)) No SELinux security context (/etc/cron.d/dwatch) Jul 28 10:07:08 localhost.localdomain crond[1192]: (root) FAILED (loading cron table) Jul 28 10:07:08 localhost.localdomain crond[1192]: ((null)) No SELinux security context (/etc/cron.d/moodle) Jul 28 10:07:08 localhost.localdomain crond[1192]: (root) FAILED (loading cron table) Jul 28 10:07:08 localhost.localdomain crond[1192]: ((null)) No SELinux security context (/etc/cron.d/mailman) Jul 28 10:07:08 localhost.localdomain crond[1192]: (root) FAILED (loading cron table) Jul 28 10:07:08 localhost.localdomain crond[1192]: ((null)) No SELinux security context (/etc/cron.d/rear) Jul 28 10:07:08 localhost.localdomain crond[1192]: (root) FAILED (loading cron table) Jul 28 10:07:08 localhost.localdomain crond[1192]: ((null)) No SELinux security context (/etc/crontab)
It is not container-selinux. I removed it, and the problem persisted. However, I did see extra messages after I re-installed it. I wonder if the segno=6 is significant from the dbus-daemon. Jul 28 12:32:10 localhost.localdomain dbus-daemon[3513]: [session uid=9999 pid=3511] Reloaded configuration Jul 28 12:32:10 localhost.localdomain audit: MAC_POLICY_LOAD auid=0 ses=3 lsm=selinux res=1 Jul 28 12:32:10 localhost.localdomain dbus-daemon[3513]: avc: received policyload notice (seqno=6) Jul 28 12:32:10 localhost.localdomain kernel: SELinux: policy capability genfs_seclabel_symlinks=0 Jul 28 12:32:10 localhost.localdomain kernel: SELinux: policy capability nnp_nosuid_transition=1 Jul 28 12:32:10 localhost.localdomain kernel: SELinux: policy capability cgroup_seclabel=1 Jul 28 12:32:10 localhost.localdomain kernel: SELinux: policy capability always_check_network=0 Jul 28 12:32:10 localhost.localdomain kernel: SELinux: policy capability extended_socket_class=1 Jul 28 12:32:10 localhost.localdomain kernel: SELinux: policy capability open_perms=1 Jul 28 12:32:10 localhost.localdomain kernel: SELinux: policy capability network_peer_controls=1 Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Converting 2799 SID table entries... Jul 28 12:32:10 localhost.localdomain kernel: SELinux: the above unknown classes and permissions will be allowed Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Class lockdown not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Class perf_event not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission bpf in class cap2_userns not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission perfmon in class cap2_userns not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission bpf in class capability2 not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission perfmon in class capability2 not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch_reads in class fifo_file not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch_with_perm in class fifo_file not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch_sb in class fifo_file not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch_mount in class fifo_file not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch in class fifo_file not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch_reads in class sock_file not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch_with_perm in class sock_file not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch_sb in class sock_file not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch_mount in class sock_file not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch in class sock_file not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch_reads in class blk_file not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch_with_perm in class blk_file not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch_sb in class blk_file not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch_mount in class blk_file not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch in class blk_file not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch_reads in class chr_file not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch_with_perm in class chr_file not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch_sb in class chr_file not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch_mount in class chr_file not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch in class chr_file not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch_reads in class lnk_file not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch_with_perm in class lnk_file not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch_sb in class lnk_file not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch_mount in class lnk_file not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch in class lnk_file not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch_reads in class dir not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch_with_perm in class dir not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch_sb in class dir not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch_mount in class dir not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch in class dir not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch_reads in class file not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch_with_perm in class file not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch_sb in class file not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch_mount in class file not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch in class file not defined in policy. Jul 28 12:32:10 localhost.localdomain kernel: SELinux: Permission watch in class filesystem not defined in policy.
After a suggestion from Ed Greshko on the users list, I tried adding the enforcing=0 parameter to the kernel boot line. And it now works. I see two additional lines in journalctl, both the same, when crond runs. crond[2977]: (*system*) NULL security context for user, but SELinux in permissive mode, continuing () The other messages also changed. crond[1169]: ((null)) No security context but SELinux in permissive mode, continuing (/etc/crontab) crond[1169]: ((null)) No security context but SELinux in permissive mode, continuing (/etc/cron.d/rear) crond[1169]: ((null)) No security context but SELinux in permissive mode, continuing (/etc/cron.d/mailman) crond[1169]: ((null)) No security context but SELinux in permissive mode, continuing (/etc/cron.d/moodle) crond[1169]: ((null)) No security context but SELinux in permissive mode, continuing (/etc/cron.d/dwatch) crond[1169]: ((null)) No security context but SELinux in permissive mode, continuing (/etc/cron.d/atop) crond[1169]: ((null)) No security context but SELinux in permissive mode, continuing (/etc/cron.d/0hourly) I tried some older kernels that used to work, but they now also have the issue, so this is not a kernel problem.
This problem began after a reboot on July 26, 2020. There were the following updates on July 25, 2020: 2020-07-25T19:24:40Z SUBDEBUG Upgrade: claws-mail-3.17.6-1.fc31.x86_64 2020-07-25T19:24:42Z SUBDEBUG Upgrade: php-symfony3-common-3.4.43-1.fc31.noarch 2020-07-25T19:24:42Z SUBDEBUG Upgrade: claws-mail-plugins-pgp-3.17.6-1.fc31.x86_64 2020-07-25T19:24:43Z SUBDEBUG Upgrade: claws-mail-plugins-smime-3.17.6-1.fc31.x86_64 2020-07-25T19:24:43Z SUBDEBUG Upgrade: php-symfony3-debug-3.4.43-1.fc31.noarch 2020-07-25T19:24:44Z SUBDEBUG Upgrade: php-symfony3-filesystem-3.4.43-1.fc31.noarch 2020-07-25T19:24:44Z SUBDEBUG Upgrade: php-symfony3-config-3.4.43-1.fc31.noarch 2020-07-25T19:24:45Z SUBDEBUG Upgrade: php-symfony3-finder-3.4.43-1.fc31.noarch 2020-07-25T19:24:46Z SUBDEBUG Upgrade: php-symfony3-process-3.4.43-1.fc31.noarch 2020-07-25T19:24:46Z SUBDEBUG Upgrade: claws-mail-plugins-acpi-notifier-3.17.6-1.fc31.x86_64 2020-07-25T19:24:46Z SUBDEBUG Upgrade: claws-mail-plugins-address-keeper-3.17.6-1.fc31.x86_64 2020-07-25T19:24:47Z SUBDEBUG Upgrade: claws-mail-plugins-archive-3.17.6-1.fc31.x86_64 2020-07-25T19:24:47Z SUBDEBUG Upgrade: claws-mail-plugins-att-remover-3.17.6-1.fc31.x86_64 2020-07-25T19:24:48Z SUBDEBUG Upgrade: claws-mail-plugins-attachwarner-3.17.6-1.fc31.x86_64 2020-07-25T19:24:48Z SUBDEBUG Upgrade: claws-mail-plugins-bogofilter-3.17.6-1.fc31.x86_64 2020-07-25T19:24:48Z SUBDEBUG Upgrade: claws-mail-plugins-bsfilter-3.17.6-1.fc31.x86_64 2020-07-25T19:24:49Z SUBDEBUG Upgrade: claws-mail-plugins-clamd-3.17.6-1.fc31.x86_64 2020-07-25T19:24:49Z SUBDEBUG Upgrade: claws-mail-plugins-dillo-3.17.6-1.fc31.x86_64 2020-07-25T19:24:50Z SUBDEBUG Upgrade: claws-mail-plugins-fetchinfo-3.17.6-1.fc31.x86_64 2020-07-25T19:24:50Z SUBDEBUG Upgrade: claws-mail-plugins-gdata-3.17.6-1.fc31.x86_64 2020-07-25T19:24:51Z SUBDEBUG Upgrade: claws-mail-plugins-libravatar-3.17.6-1.fc31.x86_64 2020-07-25T19:24:51Z SUBDEBUG Upgrade: claws-mail-plugins-litehtml-viewer-3.17.6-1.fc31.x86_64 2020-07-25T19:24:52Z SUBDEBUG Upgrade: claws-mail-plugins-mailmbox-3.17.6-1.fc31.x86_64 2020-07-25T19:24:52Z SUBDEBUG Upgrade: claws-mail-plugins-managesieve-3.17.6-1.fc31.x86_64 2020-07-25T19:24:53Z SUBDEBUG Upgrade: claws-mail-plugins-newmail-3.17.6-1.fc31.x86_64 2020-07-25T19:24:53Z SUBDEBUG Upgrade: claws-mail-plugins-notification-3.17.6-1.fc31.x86_64 2020-07-25T19:24:54Z SUBDEBUG Upgrade: claws-mail-plugins-pdf-viewer-3.17.6-1.fc31.x86_64 2020-07-25T19:24:54Z SUBDEBUG Upgrade: claws-mail-plugins-perl-3.17.6-1.fc31.x86_64 2020-07-25T19:24:55Z SUBDEBUG Upgrade: claws-mail-plugins-rssyl-3.17.6-1.fc31.x86_64 2020-07-25T19:24:55Z SUBDEBUG Upgrade: claws-mail-plugins-spam-report-3.17.6-1.fc31.x86_64 2020-07-25T19:24:56Z SUBDEBUG Upgrade: claws-mail-plugins-spamassassin-3.17.6-1.fc31.x86_64 2020-07-25T19:24:57Z SUBDEBUG Upgrade: claws-mail-plugins-tnef-3.17.6-1.fc31.x86_64 2020-07-25T19:24:58Z SUBDEBUG Upgrade: claws-mail-plugins-vcalendar-3.17.6-1.fc31.x86_64 2020-07-25T19:24:58Z SUBDEBUG Upgrade: btrfs-progs-5.7-4.fc31.x86_64 2020-07-25T19:24:59Z SUBDEBUG Upgrade: java-latest-openjdk-headless-1:14.0.2.12-1.rolling.fc31.x86_64 2020-07-25T19:25:03Z SUBDEBUG Upgrade: geoclue2-2.5.6-2.fc31.x86_64 2020-07-25T19:25:04Z SUBDEBUG Upgrade: chromium-common-84.0.4147.89-1.fc31.x86_64 2020-07-25T19:25:07Z SUBDEBUG Upgrade: chromium-84.0.4147.89-1.fc31.x86_64 2020-07-25T19:25:20Z SUBDEBUG Upgrade: geoclue2-libs-2.5.6-2.fc31.x86_64 2020-07-25T19:25:21Z SUBDEBUG Upgrade: java-latest-openjdk-1:14.0.2.12-1.rolling.fc31.x86_64 2020-07-25T19:25:22Z SUBDEBUG Upgrade: appliance-tools-010.0-2.fc31.noarch 2020-07-25T19:25:23Z SUBDEBUG Upgrade: claws-mail-plugins-3.17.6-1.fc31.x86_64 2020-07-25T19:25:23Z SUBDEBUG Upgrade: php-symfony3-console-3.4.43-1.fc31.noarch 2020-07-25T19:25:24Z SUBDEBUG Upgrade: php-symfony3-dependency-injection-3.4.43-1.fc31.noarch 2020-07-25T19:25:25Z SUBDEBUG Upgrade: php-symfony3-translation-3.4.43-1.fc31.noarch 2020-07-25T19:25:26Z SUBDEBUG Upgrade: php-symfony3-options-resolver-3.4.43-1.fc31.noarch 2020-07-25T19:25:27Z SUBDEBUG Upgrade: vdr-markad-2.3.4-1.fc31.x86_64 2020-07-25T19:25:28Z SUBDEBUG Upgrade: libbtrfs-5.7-4.fc31.x86_64 2020-07-25T19:25:28Z SUBDEBUG Upgrade: xxhash-libs-0.7.4-2.fc31.x86_64 2020-07-25T19:25:29Z SUBDEBUG Upgrade: container-selinux-2:2.142.0-1.fc31.noarch 2020-07-25T19:26:10Z SUBDEBUG Upgrade: claws-mail-devel-3.17.6-1.fc31.x86_64 Nothing seems like it should be causing this problem.
I reinstalled all the selinux related packages, and cronie (crond package), as well as running restorecon -r on /usr and /etc. Still have the problem when in enforcing mode.
Does this help? # restorecon -Rv /var/spool/cron
No, it doesn't. I actually did a restorecon -R on /var after yesterday's message just in case. I see on the mailing list that Ed has some further suggestions that I will look into.
The good thing is that I have the work around. If I setenforce=0, everything runs as normal, so I can just manually get things going. The other thing I'm going to look into is searching the selinux audit and error messages. I got instructions on how to search them on another bugzilla recently, so I will be looking at that to figure out how to see them. Selinux should be logging the denial, so I can see why there, I hope.
In bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=1309108 I found the following recommended command, # sesearch -A -s unconfined_t -t user_cron_spool_t -c file though there it had a -C on the end that was considered an invalid option, so I removed it. It gave the follow output: allow application_domain_type user_cron_spool_t:file { append getattr ioctl lock read write }; allow crontab_domain user_cron_spool_t:file { append create getattr ioctl link lock open read rename setattr unlink write }; allow domain file_type:file map; [ domain_can_mmap_files ]:True allow files_unconfined_type file_type:file execmod; [ selinuxuser_execmod ]:True allow files_unconfined_type file_type:file { append audit_access create execute execute_no_trans getattr ioctl link lock map mounton open quotaon read relabelfrom relabelto rename setattr swapon unlink write }; allow unconfined_t user_cron_spool_t:file entrypoint; [ cron_userdomain_transition ]:True allow unconfined_t user_cron_spool_t:file { getattr ioctl read write }; It seems that the second from the bottom is the rule that was added in bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=1298192 to deal with this problem when it occurred then.
Hello, got the same problem here. I have updated two F31 hosts yesterday (2020-08-03). After the update I have rebooted them and since that, one of them (kitty) don't run cron jobs anymore and logs the same error stan has reported: Aug 3 09:01:01 kitty CROND[91012]: (root) CMD (run-parts /etc/cron.hourly) Aug 3 09:01:01 kitty run-parts[91012]: (/etc/cron.hourly) starting 0anacron Aug 3 09:01:01 kitty run-parts[91012]: (/etc/cron.hourly) finished 0anacron [...] <update and reboot> [...] Aug 3 09:51:43 kitty crond[91654]: (CRON) INFO (Shutting down) Aug 3 09:52:10 kitty crond[1145]: (CRON) STARTUP (1.5.4) Aug 3 09:52:10 kitty crond[1145]: (CRON) INFO (RANDOM_DELAY will be scaled with factor 77% if used.) Aug 3 09:52:10 kitty crond[1145]: ((null)) No SELinux security context (/etc/crontab) Aug 3 09:52:10 kitty crond[1145]: (root) FAILED (loading cron table) Aug 3 09:52:11 kitty crond[1145]: ((null)) No SELinux security context (/etc/cron.d/logrotate) Aug 3 09:52:11 kitty crond[1145]: (root) FAILED (loading cron table) Aug 3 09:52:11 kitty crond[1145]: ((null)) No SELinux security context (/etc/cron.d/duplicity) Aug 3 09:52:11 kitty crond[1145]: (root) FAILED (loading cron table) Aug 3 09:52:11 kitty crond[1145]: ((null)) No SELinux security context (/etc/cron.d/0hourly) Aug 3 09:52:11 kitty crond[1145]: (root) FAILED (loading cron table) 'fixfiles -F onboot' and rebooting did not change the behaviour. The other host (fez) does fine - cron jobs are executed as the should be. One fundamental difference between the two hosts is that kitty is a virtual server and fez is a physical one. Greetings Jens
Unlike stan I belive it is container-selinux. My second host (fez) did not have that package installed. After installing it and rebooting the same errors showed up. Uninstalling container-selinux and rebooting fixed the problem for both hosts. On my first host the problem occured after upgrading fom container-selinux 2:2.138.0-1.fc31 to 2:2.142.0-1.fc31. Maybe the bug came with https://github.com/containers/container-selinux/commit/965c7fb488ccec2c623d1b71e665f70c8ef3db11 Greetings Jens
Thank you Jens! It was indeed container-selinux. When I downgraded to, 2:2.138.0-1.fc31, https://koji.fedoraproject.org/koji/buildinfo?buildID=1541263 2:2.138.0-1.fc31, crond started working again. I had tried removing container-selinux, and that did *not* fix the problem. So, it has to be present, but in the earlier version without the problem. I will change the target of the bugzilla to container-selinux. I notice that there have been a lot of releases in a short time, a sign that it is being developed. That probably introduced the problem as a side effect somehow.
I just tried updating to the latest container-selinux in fc31, 2:2.144.0-1, and it still has the problem. Reverting to 2:2.138.0-1 still fixed the problem.
This message is a reminder that Fedora 31 is nearing its end of life. Fedora will stop maintaining and issuing updates for Fedora 31 on 2020-11-24. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a Fedora 'version' of '31'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora 31 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior this bug is closed as described in the policy above. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete.
Fedora 31 changed to end-of-life (EOL) status on 2020-11-24. Fedora 31 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of Fedora please feel free to reopen this bug against that version. If you are unable to reopen this bug, please file a new report against the current release. If you experience problems, please add a comment to this bug. Thank you for reporting this bug and we are sorry it could not be fixed.