RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1892547 - [selinux-policy] SELinux is preventing /usr/bin/dbus-daemon from read access on the lnk_file direct:64707.
Summary: [selinux-policy] SELinux is preventing /usr/bin/dbus-daemon from read access ...
Keywords:
Status: CLOSED DUPLICATE of bug 1860924
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: selinux-policy
Version: CentOS Stream
Hardware: noarch
OS: Linux
unspecified
unspecified
Target Milestone: rc
: 8.0
Assignee: Zdenek Pytela
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-10-29 06:20 UTC by Joachim Frieben
Modified: 2020-11-20 20:52 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-11-09 22:16:48 UTC
Type: Bug
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)

Description Joachim Frieben 2020-10-29 06:20:39 UTC 
SELinux is preventing /usr/bin/dbus-daemon from read access on the lnk_file direct:64707.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that dbus-daemon should be allowed read access on the direct:64707 lnk_file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'dbus-daemon' --raw | audit2allow -M my-dbusdaemon
# semodule -X 300 -i my-dbusdaemon.pp

Additional Information:
Source Context                system_u:system_r:system_dbusd_t:s0-s0:c0.c1023
Target Context                system_u:object_r:init_var_run_t:s0
Target Objects                direct:64707 [ lnk_file ]
Source                        dbus-daemon
Source Path                   /usr/bin/dbus-daemon
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           dbus-daemon-1.12.8-11.el8.x86_64
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-3.14.3-54.el8.noarch
Local Policy RPM              selinux-policy-targeted-3.14.3-54.el8.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux localhost.localdomain 4.18.0-240.el8.x86_64
                              #1 SMP Fri Sep 25 19:48:47 UTC 2020 x86_64 x86_64
Alert Count                   35
First Seen                    2020-10-28 21:51:16 CET
Last Seen                     2020-10-29 05:40:27 CET
Local ID                      67056943-83f2-438d-b16f-bbe21a4a3eec

Raw Audit Messages
type=AVC msg=audit(1603946427.679:396): avc:  denied  { read } for  pid=1483 comm="dbus-daemon" name="direct:64707" dev="tmpfs" ino=104030 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:init_var_run_t:s0 tclass=lnk_file permissive=0


type=SYSCALL msg=audit(1603946427.679:396): arch=x86_64 syscall=readlinkat success=no exit=EACCES a0=ffffff9c a1=7ffd558d6a80 a2=556e79331b10 a3=63 items=0 ppid=1 pid=1483 auid=4294967295 uid=81 gid=81 euid=81 suid=81 fsuid=81 egid=81 sgid=81 fsgid=81 tty=(none) ses=4294967295 comm=dbus-daemon exe=/usr/bin/dbus-daemon subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 key=(null)

Hash: dbus-daemon,system_dbusd_t,init_var_run_t,lnk_file,read
Comment 1 Milos Malik 2020-11-06 12:07:16 UTC 
Happens on my RHEL-8.x VM too:
----
type=PROCTITLE msg=audit(11/06/2020 11:30:07.386:416) : proctitle=/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only 
type=PATH msg=audit(11/06/2020 11:30:07.386:416) : item=0 name=/run/systemd/dynamic-uid/direct:63761 inode=151590 dev=00:17 mode=link,777 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:init_var_run_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(11/06/2020 11:30:07.386:416) : cwd=/ 
type=SYSCALL msg=audit(11/06/2020 11:30:07.386:416) : arch=x86_64 syscall=readlinkat success=no exit=EACCES(Permission denied) a0=0xffffff9c a1=0x7ffe42696160 a2=0x561889309df0 a3=0x63 items=1 ppid=1 pid=1121 auid=unset uid=dbus gid=dbus euid=dbus suid=dbus fsuid=dbus egid=dbus sgid=dbus fsgid=dbus tty=(none) ses=unset comm=dbus-daemon exe=/usr/bin/dbus-daemon subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(11/06/2020 11:30:07.386:416) : avc:  denied  { read } for  pid=1121 comm=dbus-daemon name=direct:63761 dev="tmpfs" ino=151590 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:init_var_run_t:s0 tclass=lnk_file permissive=0 
----

# find /run/ -name direct:63761
/run/systemd/dynamic-uid/direct:63761
# ls -Z /run/systemd/dynamic-uid/
system_u:object_r:init_var_run_t:s0 63761
system_u:object_r:init_var_run_t:s0 direct:63761
system_u:object_r:init_var_run_t:s0 direct:nispor
# ls -il /run/systemd/dynamic-uid/
total 4
151589 -rw-------. 1 root root 7 Nov  6 11:26 63761
151590 lrwxrwxrwx. 1 root root 6 Nov  6 11:26 direct:63761 -> nispor
151591 lrwxrwxrwx. 1 root root 5 Nov  6 11:26 direct:nispor -> 63761
#
Comment 2 Milos Malik 2020-11-09 22:11:42 UTC 
I believe this bug is a duplicate of BZ#1860924.
Comment 3 Zdenek Pytela 2020-11-09 22:16:48 UTC 

*** This bug has been marked as a duplicate of bug 1860924 ***
Note You need to log in before you can comment on or make changes to this bug.