Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: SELinux is preventing avahi-daemon from 'open' accesses on the file /proc/<pid>/environ. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that avahi-daemon should be allowed open access on the environ file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'avahi-daemon' --raw | audit2allow -M my-avahidaemon # semodule -X 300 -i my-avahidaemon.pp Additional Information: Source Context system_u:system_r:avahi_t:s0 Target Context system_u:system_r:init_t:s0 Target Objects /proc/<pid>/environ [ file ] Source avahi-daemon Source Path avahi-daemon Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-3.14.8-3.fc35.noarch Local Policy RPM selinux-policy-targeted-3.14.8-3.fc35.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 5.11.0-155.fc35.x86_64+debug #1 SMP Wed Feb 17 00:22:21 +05 2021 x86_64 x86_64 Alert Count 1 First Seen 2021-02-25 03:43:33 +05 Last Seen 2021-02-25 03:43:33 +05 Local ID b0c34966-2661-461f-9a34-9f66e1f6fa70 Raw Audit Messages type=AVC msg=audit(1614206613.708:124): avc: denied { open } for pid=1113 comm="avahi-daemon" path="/proc/1/environ" dev="proc" ino=16997 scontext=system_u:system_r:avahi_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=file permissive=1 Hash: avahi-daemon,avahi_t,init_t,file,open Version-Release number of selected component: selinux-policy-targeted-3.14.8-3.fc35.noarch Additional info: component: selinux-policy reporter: libreport-2.14.0 hashmarkername: setroubleshoot kernel: 5.11.0-155.fc35.x86_64+debug type: libreport
*** Bug 1932691 has been marked as a duplicate of this bug. ***
Mikhail, Do you happen to know when this denial is triggered?
*** Bug 1932696 has been marked as a duplicate of this bug. ***
*** Bug 1932697 has been marked as a duplicate of this bug. ***
Replicated - Fedora 34 preview. @zdenek Pytela in my case it happens during boot/login. From the boot log: Mar 18 21:25:04 boss.xxxx.org NetworkManager[1913]: <info> [1616117104.1124] device (enp6s0f0): state change: ip-check -> secondaries (reason 'none', sys-iface-state: 'managed') Mar 18 21:25:04 boss.xxxx.org NetworkManager[1913]: <info> [1616117104.1128] device (enp6s0f0): state change: secondaries -> activated (reason 'none', sys-iface-state: 'managed') Mar 18 21:25:04 boss.xxxx.org NetworkManager[1913]: <info> [1616117104.1133] manager: NetworkManager state is now CONNECTED_LOCAL Mar 18 21:25:04 boss.xxxx.org NetworkManager[1913]: <info> [1616117104.1146] manager: NetworkManager state is now CONNECTED_SITE Mar 18 21:25:04 boss.xxxx.org NetworkManager[1913]: <info> [1616117104.1147] policy: set 'Wired connection 2' (enp6s0f0) as default for IPv4 routing and DNS Mar 18 21:25:04 boss.xxxx.org NetworkManager[1913]: <info> [1616117104.1155] device (enp6s0f0): Activation: successful, device activated. Mar 18 21:25:04 boss.xxxx.org systemd-resolved[1454]: enp6s0f0: Bus client set search domain list to: peterlarsen.org, client.peterlarsen.org Mar 18 21:25:04 boss.xxxx.org systemd-resolved[1454]: enp6s0f0: Bus client set default route setting: yes Mar 18 21:25:04 boss.xxxx.org systemd-resolved[1454]: enp6s0f0: Bus client set DNS server list to: 192.168.11.23, 192.168.11.22 Mar 18 21:25:04 boss.xxxx.org nm-dispatcher[2171]: /etc/NetworkManager/dispatcher.d/00-netreport: line 9: do_netreport: command not found Mar 18 21:25:04 boss.xxxx.org sssd_be[1619]: Backend is offline Mar 18 21:25:05 boss.xxxx.org setroubleshoot[2163]: AnalyzeThread.run(): Cancel pending alarm Mar 18 21:25:05 boss.xxxx.org systemd[1]: Created slice system-dbus\x2d:1.3\x2dorg.fedoraproject.SetroubleshootPrivileged.slice. Mar 18 21:25:05 boss.xxxx.org systemd[1]: Started dbus-:1.3-org.fedoraproject.SetroubleshootPrivileged. Mar 18 21:25:05 boss.xxxx.org audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=dbus-:1.3-org.fedoraproject.SetroubleshootPrivileged@0 comm="systemd" exe=> Mar 18 21:25:05 boss.xxxx.org avahi-daemon[1483]: Joining mDNS multicast group on interface enp6s0f0.IPv6 with address fe80::21b:21ff:fe26:1633. Mar 18 21:25:05 boss.xxxx.org avahi-daemon[1483]: New relevant interface enp6s0f0.IPv6 for mDNS. Mar 18 21:25:05 boss.xxxx.org avahi-daemon[1483]: Registering new address record for fe80::21b:21ff:fe26:1633 on enp6s0f0.*. Mar 18 21:25:06 boss.xxxx.org setroubleshoot[2163]: SELinux is preventing avahi-daemon from read access on the file environ. For complete SELinux messages run: sealert -l 1447ae04-f35a-49ce-a421-4cf5161b7e83 Mar 18 21:25:06 boss.xxxx.org setroubleshoot[2163]: SELinux is preventing avahi-daemon from read access on the file environ. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that avahi-daemon should be allowed read access on the environ file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'avahi-daemon' --raw | audit2allow -M my-avahidaemon # semodule -X 300 -i my-avahidaemon.pp
Peter, Thank you for the boottime log. Have you modified the avahi configuration, or have some service registered with it?
(In reply to Zdenek Pytela from comment #6) > Peter, > > Thank you for the boottime log. Have you modified the avahi configuration, > or have some service registered with it? [peter@boss avahi]$ rpm --verify $(rpm -qa avahi\*) .....UG.. g /var/run/avahi-daemon [peter@boss avahi]$ rpm -qa avahi\* avahi-libs-0.8-9.fc34.x86_64 avahi-glib-0.8-9.fc34.x86_64 avahi-0.8-9.fc34.x86_64 avahi-gobject-0.8-9.fc34.x86_64 avahi-compat-libdns_sd-0.8-9.fc34.x86_64 avahi-tools-0.8-9.fc34.x86_64 avahi-ui-gtk3-0.8-9.fc34.x86_64 avahi-libs-0.8-9.fc34.i686 No custom settings. Note, mdns is definitely in use on the network: $ avahi-browse -a + enp6s0f0 IPv6 HP OfficeJet 4650 series [E1CF65] _ipps._tcp local + enp6s0f0 IPv4 HP OfficeJet 4650 series [E1CF65] _ipps._tcp local + enp6s0f0 IPv6 HP OfficeJet 4650 series [E1CF65] _ipp._tcp local + enp6s0f0 IPv4 HP OfficeJet 4650 series [E1CF65] _ipp._tcp local + enp6s0f0 IPv4 soundtouch _soundtouch._tcp local + enp6s0f0 IPv4 Chromecast-bd2063722a520XXXXXXXXXXXXXXXXXXX _googlecast._tcp local + enp6s0f0 IPv4 amzn.dmgr:2537661XXXXXXXXXXXXXXXXXXXXXXXXX:XXXX9LxhBX:158657 _amzn-wplay._tcp local + enp6s0f0 IPv4 amzn.dmgr:4DAF0B9XXXXXXXXXXXXXXXXXXXXXXXXX:XXXXMM+4u1:767684 _amzn-wplay._tcp local + enp6s0f0 IPv4 amzn.dmgr:F3291DXXXXXXXXXXXXXXXXXXXXXXXXXX:XXXXMM+4u1:695611 _amzn-wplay._tcp local [...] Etc. and mdns lookups work.
(In reply to Zdenek Pytela from comment #2) > Mikhail, > > Do you happen to know when this denial is triggered? I just boot my system.
Similar problem has been detected: Boot up and log into Xfce. hashmarkername: setroubleshoot kernel: 5.11.11-300.fc34.x86_64 package: selinux-policy-targeted-3.14.7-29.fc34.noarch reason: SELinux is preventing avahi-daemon from 'read' accesses on the file environ. type: libreport
Similar problem has been detected: Just logged in. hashmarkername: setroubleshoot kernel: 5.11.11-300.fc34.x86_64 package: selinux-policy-targeted-34-1.fc34.noarch reason: SELinux is preventing avahi-daemon from 'open' accesses on the file /proc/<pid>/environ. type: libreport
Kamile, Does your system run in SELinux enforcing or permissive? This denial can appear since access to the parent directory is dontaudited: # sesearch --dontaudit -s avahi_t -t init_t -c dir dontaudit daemon init_t:dir { getattr open search };
Hi Zdenek, I'm running as permissive.
I've submitted a Fedora PR to dontaudit the file access: https://github.com/fedora-selinux/selinux-policy/pull/684
*** Bug 1937871 has been marked as a duplicate of this bug. ***
*** Bug 1937664 has been marked as a duplicate of this bug. ***
FEDORA-2021-4382020175 has been submitted as an update to Fedora 34. https://bodhi.fedoraproject.org/updates/FEDORA-2021-4382020175
FEDORA-2021-4382020175 has been pushed to the Fedora 34 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2021-4382020175` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2021-4382020175 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2021-4382020175 has been pushed to the Fedora 34 stable repository. If problem still persists, please make note of it in this bug report.