Bug 1917507

Does the client machine encountered any SELinux denials?

# ausearch -m avc -m user_avc -m selinux_err -m user_selinux_err -i -ts today

The policy.linked file shown in comment#0 has zero length, which is weird.

# ls -l /var/lib/selinux/targeted/active/
total 17584
-rw-------. 1 root root     113 Jan 18 13:51 booleans.local
-rw-------. 1 root root      32 Jan 18 13:52 commit_num
-rw-------. 1 root root  398429 Jan 18 13:52 file_contexts
-rw-------. 1 root root   95792 Jan 18 13:52 file_contexts.homedirs
-rw-------. 1 root root      70 Jan 18 13:51 file_contexts.local
-rw-------. 1 root root   12456 Jan 18 13:52 homedir_template
drwx------. 6 root root      55 Jan 18 13:51 modules
-rw-------. 1 root root 8722281 Jan 18 13:52 policy.kern
-rw-------. 1 root root 8722281 Jan 18 13:52 policy.linked
-rw-------. 1 root root     323 Jan 18 13:52 seusers
-rw-------. 1 root root      73 Jan 18 13:52 seusers.linked
-rw-------. 1 root root     250 Jan 18 13:51 seusers.local
-rw-------. 1 root root     101 Jan 18 13:52 users_extra
-rw-------. 1 root root     101 Jan 18 13:52 users_extra.linked
#

Switching the component to libselinux based on:

(2021-01-18 14:36:54): [selinux_child[1024078]] [libsemanage] (0x0020): Error while reading kernel policy from /var/lib/selinux/targeted/active/policy.linked.

Particularly refer to

-rw-------. 1 root root       0 Dec  8 10:13 policy.linked

If such a situation happened on my machine, I would be thinking about:
 * rebuild of SELinux policy, or
 * reinstall of SELinux-policy packages

Hi Milos, Zdenek, 

Client has run into same problems on a second server, what should we perform on the client side to restore connectivity? This behavior is present even after setenforce 0, they can see:

# semodule -l
libsemanage.semanage_direct_get_module_info: Unable to read pcpupstream module lang ext file.

Thanks!

SELinux store is probably broken. Can you see empty - 0 file size - files when you list /var/lib/selinux/targeted/active/modules?

    # ls -lh /var/lib/selinux/targeted/active/modules/*

If you see empty files, it would be helpful to check their modification time and check logs what happened in this time. Was there unexpected reboot, package update, file system problem, ...?

SELinux policy reinstall should fix it:

    # dnf reinstall selinux-policy-targeted

The pcpupstream module comes from the pcp-selinux package. I would recommend reinstalling the pcp-selinux package.

Hi Team!

Last option something updated selinux packages seem to be 2020-12-15 :

ID     | Command line                                                 | Date and time    | Action(s)      | Altered
-------------------------------------------------------------------------------------------------------------------
    88 | erase sqldeveloper-20.2.0-175.1842.noarch                    | 2021-01-11 11:56 | Removed        |    1 EE
    87 | install /usr/lib64/dri                                       | 2021-01-04 13:53 | Install        |    1
    86 |                                                              | 2020-12-23 08:48 | Install        |    1 EE
    85 | -y update                                                    | 2020-12-15 16:57 | E, I, U        |    9
    84 | remove kernel-4.18.0-240.1.1.el8_3.x86_64                    | 2020-12-14 11:03 | Removed        |    1
    83 | install mtr                                                  | 2020-12-10 14:50 | Install        |    1
    82 | -y update                                                    | 2020-12-07 19:55 | E, I, U        |  389 EE

Uptime is 43 days, the files in  /var/lib/selinux/targeted/active/modules/ were modified December 8th, 2020 at 17:16 - probably on startup.

Question is, what caused it - it was working OK until last weekend?.. On the second server, even policy.kern is empty:

[gwubs@vsupc00089 /nfs/home/gwubs]$ sudo ls -l /var/lib/selinux/targeted/active/
First Factor:
Second Factor (optional):
total 2328
-rw-------. 1 root root      32 Dec  8 17:16 commit_num
-rw-------. 1 root root       0 Dec  8 17:16 file_contexts
-rw-------. 1 root root 2360544 Dec  8 17:16 file_contexts.homedirs
-rw-------. 1 root root       0 Dec  8 17:16 file_contexts.local
-rw-------. 1 root root       0 Dec  8 17:16 homedir_template
drwx------. 6 root root      55 Dec  8 17:16 modules
-rw-------. 1 root root       0 Dec  8 17:16 policy.kern                   <<
-rw-------. 1 root root       0 Dec  8 17:16 policy.linked                 <<
-rw-------. 1 root root    6251 Dec  8 17:16 seusers
-rw-------. 1 root root       0 Dec  8 17:16 seusers.linked
-rw-------. 1 root root    6178 Dec  8 17:16 seusers.local
-rw-------. 1 root root       0 Dec  8 17:16 users_extra
-rw-------. 1 root root       0 Dec  8 17:16 users_extra.linked

Any ideas?

Thank you!

What about:

    # find /var/lib/selinux/targeted/active/modules -type f -size 0 -exec ls -l \{\} \;

Please share also libsemanage version:

    # rpm -q libsemanage

I'd suggest to backup whole /var/lib/selinux for future investigation

    # sudo tar -c -f selinux.backup.tar --selinux /var/lib/selinux

And fix the problem reinstalling the selinux-policy-targeted and pcp-selinux

    # dnf reinstall selinux-policy-targeted pcp-selinux

Anyway, it looks like something broke SELinux store - /var/lib/selinux - on weekend. It could be update of some package like pcp-selinux package, or filesystem problem, ... So it's important to know what happened on the weekend. 

Also I'd suggest to add `save-previous = true` to /etc/selinux/semanage.conf. It would preserve previous module directory after succesful commit, see `man semanage.conf`

Hi! 

All of them are empty:

root@vsupc00089 ~ # find /var/lib/selinux/targeted/active/modules -type f -exec ls -l \{\} \; | wc -l
   1268

root@vsupc00089 ~ # find /var/lib/selinux/targeted/active/modules -type f -size 0 -exec ls -l \{\} \; | wc -l
   1268

Client's trying reinstalling the packages.

This patch https://lore.kernel.org/selinux/20210128104231.102470-1-plautrba@redhat.com/T/#u should prevent some issues with empty files in the module store after policy rebuild. It waits for upstream review now.

*** This bug has been marked as a duplicate of bug 1913224 ***