Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
+++ This bug was initially created as a clone of Bug #1932689 +++
Description of problem:
SELinux is preventing avahi-daemon from 'open' accesses on the file /proc/<pid>/environ.
***** Plugin catchall (100. confidence) suggests **************************
If you believe that avahi-daemon should be allowed open access on the environ file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'avahi-daemon' --raw | audit2allow -M my-avahidaemon
# semodule -X 300 -i my-avahidaemon.pp
Additional Information:
Source Context system_u:system_r:avahi_t:s0
Target Context system_u:system_r:init_t:s0
Target Objects /proc/<pid>/environ [ file ]
Source avahi-daemon
Source Path avahi-daemon
Port <Unknown>
Host (removed)
Source RPM Packages
Target RPM Packages
SELinux Policy RPM selinux-policy-targeted-3.14.8-3.fc35.noarch
Local Policy RPM selinux-policy-targeted-3.14.8-3.fc35.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Permissive
Host Name (removed)
Platform Linux (removed) 5.11.0-155.fc35.x86_64+debug #1
SMP Wed Feb 17 00:22:21 +05 2021 x86_64 x86_64
Alert Count 1
First Seen 2021-02-25 03:43:33 +05
Last Seen 2021-02-25 03:43:33 +05
Local ID b0c34966-2661-461f-9a34-9f66e1f6fa70
Raw Audit Messages
type=AVC msg=audit(1614206613.708:124): avc: denied { open } for pid=1113 comm="avahi-daemon" path="/proc/1/environ" dev="proc" ino=16997 scontext=system_u:system_r:avahi_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=file permissive=1
Hash: avahi-daemon,avahi_t,init_t,file,open
Version-Release number of selected component:
selinux-policy-targeted-3.14.8-3.fc35.noarch
Additional info:
component: selinux-policy
reporter: libreport-2.14.0
hashmarkername: setroubleshoot
kernel: 5.11.0-155.fc35.x86_64+debug
type: libreport
--- Additional comment from Zdenek Pytela on 2021-02-25 09:03:29 CET ---
--- Additional comment from Zdenek Pytela on 2021-02-25 09:04:45 CET ---
Mikhail,
Do you happen to know when this denial is triggered?
--- Additional comment from Zdenek Pytela on 2021-03-18 16:29:28 CET ---
--- Additional comment from Zdenek Pytela on 2021-03-18 16:30:24 CET ---
--- Additional comment from Peter Larsen on 2021-03-19 02:44:24 CET ---
Replicated - Fedora 34 preview.
@zdenek Pytela in my case it happens during boot/login. From the boot log:
Mar 18 21:25:04 boss.xxxx.org NetworkManager[1913]: <info> [1616117104.1124] device (enp6s0f0): state change: ip-check -> secondaries (reason 'none', sys-iface-state: 'managed')
Mar 18 21:25:04 boss.xxxx.org NetworkManager[1913]: <info> [1616117104.1128] device (enp6s0f0): state change: secondaries -> activated (reason 'none', sys-iface-state: 'managed')
Mar 18 21:25:04 boss.xxxx.org NetworkManager[1913]: <info> [1616117104.1133] manager: NetworkManager state is now CONNECTED_LOCAL
Mar 18 21:25:04 boss.xxxx.org NetworkManager[1913]: <info> [1616117104.1146] manager: NetworkManager state is now CONNECTED_SITE
Mar 18 21:25:04 boss.xxxx.org NetworkManager[1913]: <info> [1616117104.1147] policy: set 'Wired connection 2' (enp6s0f0) as default for IPv4 routing and DNS
Mar 18 21:25:04 boss.xxxx.org NetworkManager[1913]: <info> [1616117104.1155] device (enp6s0f0): Activation: successful, device activated.
Mar 18 21:25:04 boss.xxxx.org systemd-resolved[1454]: enp6s0f0: Bus client set search domain list to: peterlarsen.org, client.peterlarsen.org
Mar 18 21:25:04 boss.xxxx.org systemd-resolved[1454]: enp6s0f0: Bus client set default route setting: yes
Mar 18 21:25:04 boss.xxxx.org systemd-resolved[1454]: enp6s0f0: Bus client set DNS server list to: 192.168.11.23, 192.168.11.22
Mar 18 21:25:04 boss.xxxx.org nm-dispatcher[2171]: /etc/NetworkManager/dispatcher.d/00-netreport: line 9: do_netreport: command not found
Mar 18 21:25:04 boss.xxxx.org sssd_be[1619]: Backend is offline
Mar 18 21:25:05 boss.xxxx.org setroubleshoot[2163]: AnalyzeThread.run(): Cancel pending alarm
Mar 18 21:25:05 boss.xxxx.org systemd[1]: Created slice system-dbus\x2d:1.3\x2dorg.fedoraproject.SetroubleshootPrivileged.slice.
Mar 18 21:25:05 boss.xxxx.org systemd[1]: Started dbus-:1.3-org.fedoraproject.SetroubleshootPrivileged.
Mar 18 21:25:05 boss.xxxx.org audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=dbus-:1.3-org.fedoraproject.SetroubleshootPrivileged@0 comm="systemd" exe=>
Mar 18 21:25:05 boss.xxxx.org avahi-daemon[1483]: Joining mDNS multicast group on interface enp6s0f0.IPv6 with address fe80::21b:21ff:fe26:1633.
Mar 18 21:25:05 boss.xxxx.org avahi-daemon[1483]: New relevant interface enp6s0f0.IPv6 for mDNS.
Mar 18 21:25:05 boss.xxxx.org avahi-daemon[1483]: Registering new address record for fe80::21b:21ff:fe26:1633 on enp6s0f0.*.
Mar 18 21:25:06 boss.xxxx.org setroubleshoot[2163]: SELinux is preventing avahi-daemon from read access on the file environ. For complete SELinux messages run: sealert -l 1447ae04-f35a-49ce-a421-4cf5161b7e83
Mar 18 21:25:06 boss.xxxx.org setroubleshoot[2163]: SELinux is preventing avahi-daemon from read access on the file environ.
***** Plugin catchall (100. confidence) suggests **************************
If you believe that avahi-daemon should be allowed read access on the environ file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'avahi-daemon' --raw | audit2allow -M my-avahidaemon
# semodule -X 300 -i my-avahidaemon.pp
--- Additional comment from Zdenek Pytela on 2021-03-19 13:26:58 CET ---
Peter,
Thank you for the boottime log. Have you modified the avahi configuration, or have some service registered with it?
--- Additional comment from Peter Larsen on 2021-03-19 15:09:29 CET ---
(In reply to Zdenek Pytela from comment #6)
> Peter,
>
> Thank you for the boottime log. Have you modified the avahi configuration,
> or have some service registered with it?
[peter@boss avahi]$ rpm --verify $(rpm -qa avahi\*)
.....UG.. g /var/run/avahi-daemon
[peter@boss avahi]$ rpm -qa avahi\*
avahi-libs-0.8-9.fc34.x86_64
avahi-glib-0.8-9.fc34.x86_64
avahi-0.8-9.fc34.x86_64
avahi-gobject-0.8-9.fc34.x86_64
avahi-compat-libdns_sd-0.8-9.fc34.x86_64
avahi-tools-0.8-9.fc34.x86_64
avahi-ui-gtk3-0.8-9.fc34.x86_64
avahi-libs-0.8-9.fc34.i686
No custom settings. Note, mdns is definitely in use on the network:
$ avahi-browse -a
+ enp6s0f0 IPv6 HP OfficeJet 4650 series [E1CF65] _ipps._tcp local
+ enp6s0f0 IPv4 HP OfficeJet 4650 series [E1CF65] _ipps._tcp local
+ enp6s0f0 IPv6 HP OfficeJet 4650 series [E1CF65] _ipp._tcp local
+ enp6s0f0 IPv4 HP OfficeJet 4650 series [E1CF65] _ipp._tcp local
+ enp6s0f0 IPv4 soundtouch _soundtouch._tcp local
+ enp6s0f0 IPv4 Chromecast-bd2063722a520XXXXXXXXXXXXXXXXXXX _googlecast._tcp local
+ enp6s0f0 IPv4 amzn.dmgr:2537661XXXXXXXXXXXXXXXXXXXXXXXXX:XXXX9LxhBX:158657 _amzn-wplay._tcp local
+ enp6s0f0 IPv4 amzn.dmgr:4DAF0B9XXXXXXXXXXXXXXXXXXXXXXXXX:XXXXMM+4u1:767684 _amzn-wplay._tcp local
+ enp6s0f0 IPv4 amzn.dmgr:F3291DXXXXXXXXXXXXXXXXXXXXXXXXXX:XXXXMM+4u1:695611 _amzn-wplay._tcp local
[...]
Etc. and mdns lookups work.
--- Additional comment from Mikhail on 2021-03-22 22:58:08 CET ---
(In reply to Zdenek Pytela from comment #2)
> Mikhail,
>
> Do you happen to know when this denial is triggered?
I just boot my system.
--- Additional comment from Ian Laurie on 2021-04-02 00:59:14 CEST ---
Similar problem has been detected:
Boot up and log into Xfce.
hashmarkername: setroubleshoot
kernel: 5.11.11-300.fc34.x86_64
package: selinux-policy-targeted-3.14.7-29.fc34.noarch
reason: SELinux is preventing avahi-daemon from 'read' accesses on the file environ.
type: libreport
--- Additional comment from Kamil Páral on 2021-04-06 08:17:21 CEST ---
Similar problem has been detected:
Just logged in.
hashmarkername: setroubleshoot
kernel: 5.11.11-300.fc34.x86_64
package: selinux-policy-targeted-34-1.fc34.noarch
reason: SELinux is preventing avahi-daemon from 'open' accesses on the file /proc/<pid>/environ.
type: libreport
--- Additional comment from Zdenek Pytela on 2021-04-06 21:38:33 CEST ---
Kamile,
Does your system run in SELinux enforcing or permissive?
This denial can appear since access to the parent directory is dontaudited:
# sesearch --dontaudit -s avahi_t -t init_t -c dir
dontaudit daemon init_t:dir { getattr open search };
--- Additional comment from Kamil Páral on 2021-04-07 08:05:18 CEST ---
Hi Zdenek, I'm running as permissive.
--- Additional comment from Zdenek Pytela on 2021-04-07 09:43:32 CEST ---
I've submitted a Fedora PR to dontaudit the file access:
https://github.com/fedora-selinux/selinux-policy/pull/684
--- Additional comment from Zdenek Pytela on 2021-04-07 09:45:06 CEST ---
--- Additional comment from Zdenek Pytela on 2021-04-07 09:45:17 CEST ---
--- Additional comment from Fedora Update System on 2021-04-12 09:45:35 CEST ---
FEDORA-2021-4382020175 has been submitted as an update to Fedora 34. https://bodhi.fedoraproject.org/updates/FEDORA-2021-4382020175
--- Additional comment from Fedora Update System on 2021-04-12 17:09:50 CEST ---
FEDORA-2021-4382020175 has been pushed to the Fedora 34 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2021-4382020175`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2021-4382020175
See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
--- Additional comment from Fedora Update System on 2021-04-24 22:09:30 CEST ---
FEDORA-2021-4382020175 has been pushed to the Fedora 34 stable repository.
If problem still persists, please make note of it in this bug report.