Bug 1892556 - SELinux is preventing NetworkManager from 'write' accesses on the fifo_file /var/tmp/dracut.818Oxc/systemd-cat.
Summary: SELinux is preventing NetworkManager from 'write' accesses on the fifo_file /...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 33
Hardware: x86_64
OS: Unspecified
low
low
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:afb851bf52067b5be08ad4fab61...
Depends On:
Blocks: 1963162
TreeView+ depends on / blocked
 
Reported: 2020-10-29 07:27 UTC by koleesch
Modified: 2021-05-21 15:37 UTC (History)
8 users (show)

Fixed In Version: selinux-policy-3.14.6-36.fc33
Clone Of:
: 1963162 (view as bug list)
Environment:
Last Closed: 2021-03-29 01:19:37 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description koleesch 2020-10-29 07:27:19 UTC
Description of problem:
SELinux is preventing NetworkManager from 'write' accesses on the fifo_file /var/tmp/dracut.818Oxc/systemd-cat.

*****  Plugin catchall (100. confidence) suggests   **************************

Wenn Sie denken, dass es NetworkManager standardmäßig erlaubt sein sollte, write Zugriff auf systemd-cat fifo_file zu erhalten.
Then sie sollten dies als Fehler melden.
Um diesen Zugriff zu erlauben, können Sie ein lokales Richtlinien-Modul erstellen.
Do
zugriff jetzt erlauben, indem Sie die nachfolgenden Befehle ausführen:
# ausearch -c 'NetworkManager' --raw | audit2allow -M my-NetworkManager
# semodule -X 300 -i my-NetworkManager.pp

Additional Information:
Source Context                system_u:system_r:NetworkManager_t:s0
Target Context                system_u:object_r:initrc_tmp_t:s0
Target Objects                /var/tmp/dracut.818Oxc/systemd-cat [ fifo_file ]
Source                        NetworkManager
Source Path                   NetworkManager
Port                          <Unbekannt>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-3.14.6-29.fc33.noarch
Local Policy RPM              selinux-policy-targeted-3.14.6-29.fc33.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 5.8.16-300.fc33.x86_64 #1 SMP Mon
                              Oct 19 13:18:33 UTC 2020 x86_64 x86_64
Alert Count                   2
First Seen                    2020-10-24 11:59:10 CEST
Last Seen                     2020-10-24 11:59:40 CEST
Local ID                      ac502477-84f2-481f-9270-3c16da794103

Raw Audit Messages
type=AVC msg=audit(1603533580.621:260): avc:  denied  { write } for  pid=12109 comm="NetworkManager" path="/var/tmp/dracut.818Oxc/systemd-cat" dev="nvme0n1p4" ino=250578 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=fifo_file permissive=0


Hash: NetworkManager,NetworkManager_t,initrc_tmp_t,fifo_file,write

Version-Release number of selected component:
selinux-policy-targeted-3.14.6-29.fc33.noarch

Additional info:
component:      selinux-policy
reporter:       libreport-2.14.0
hashmarkername: setroubleshoot
kernel:         5.8.16-300.fc33.x86_64
type:           libreport

Potential duplicate: bug 1768951

Comment 2 Philipp Raich 2020-12-18 09:48:43 UTC
Similar problem has been detected:

Logging in after reboot

hashmarkername: setroubleshoot
kernel:         5.9.14-200.fc33.x86_64
package:        selinux-policy-targeted-3.14.6-33.fc33.noarch
reason:         SELinux is preventing NetworkManager from 'write' accesses on the fifo_file /var/tmp/dracut.JqjNFT/systemd-cat.
type:           libreport

Comment 3 Philipp Raich 2021-01-07 10:39:31 UTC
Similar problem has been detected:

Starting gnome session

hashmarkername: setroubleshoot
kernel:         5.9.16-200.fc33.x86_64
package:        selinux-policy-targeted-3.14.6-33.fc33.noarch
reason:         SELinux is preventing NetworkManager from 'write' accesses on the fifo_file /var/tmp/dracut.MDca2y/systemd-cat.
type:           libreport

Comment 4 Zdenek Pytela 2021-02-19 20:31:07 UTC
I've submitted a Fedora PR to address the issue:
https://github.com/fedora-selinux/selinux-policy/pull/604

Comment 5 Fedora Update System 2021-03-26 20:32:36 UTC
FEDORA-2021-4d5b1e1f06 has been submitted as an update to Fedora 33. https://bodhi.fedoraproject.org/updates/FEDORA-2021-4d5b1e1f06

Comment 6 Fedora Update System 2021-03-27 01:30:51 UTC
FEDORA-2021-4d5b1e1f06 has been pushed to the Fedora 33 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2021-4d5b1e1f06`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2021-4d5b1e1f06

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2021-03-29 01:19:37 UTC
FEDORA-2021-4d5b1e1f06 has been pushed to the Fedora 33 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.