RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1966492 - SELinux prevents systemd-hostnamed from removing the /run/systemd/default-hostname file
Summary: SELinux prevents systemd-hostnamed from removing the /run/systemd/default-hos...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 9
Classification: Red Hat
Component: selinux-policy
Version: 9.0
Hardware: All
OS: Linux
medium
medium
Target Milestone: beta
: 9.0 Beta
Assignee: Zdenek Pytela
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks: 1942219
TreeView+ depends on / blocked
 
Reported: 2021-06-01 09:32 UTC by Jan Stodola
Modified: 2021-12-07 21:37 UTC (History)
6 users (show)

Fixed In Version: selinux-policy-34.1.7-1.el9
Doc Type: No Doc Update
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-12-07 21:35:16 UTC
Type: Bug
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 1953060 1 high CLOSED SELinux is preventing systemd-hostnam from write access on the directory systemd 2021-10-19 02:30:44 UTC

Internal Links: 1978507

Description Jan Stodola 2021-06-01 09:32:41 UTC 
Description of problem:
The following AVC is found on the system after the default package set installation (Server with GUI) and booting the installed system:

type=AVC msg=audit(1622539307.512:194): avc:  denied  { write } for  pid=885 comm="systemd-hostnam" name="systemd" dev="tmpfs" ino=2 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=dir permissive=0


Version-Release number of selected component (if applicable):
RHEL-9.0.0-20210531.2
selinux-policy-34.1.5-1.el9
systemd-248-5.el9

How reproducible:
always

Steps to Reproduce:
1. Run the default package set installation
2. Login to the installed system, check /var/log/audit/audit.log

Actual results:
avc:  denied  { write } for  pid=885 comm="systemd-hostnam"

Expected results:
No "systemd-hostnam" related denial.
Comment 2 Zdenek Pytela 2021-06-01 09:48:25 UTC 
A commit to backport:
commit 517e50b36175e3ded1b195ec589e6bbe6f905797
Author: Zdenek Pytela <zpytela>
Date:   Tue May 18 19:17:59 2021 +0200

    Label /run/systemd/default-hostname with hostname_etc_t
    
    The /run/systemd/default-hostname file is created by systemd
    during boot time and can be removed later by systemd-hostnamed.
    Accordingly, the file transition is defined for systemd and
    systemd-hostnamed is allowed to delete pid dir entries.
    
    Resolves: rhbz#1953060
Comment 3 Milos Malik 2021-06-02 06:38:52 UTC 
Here is the complete SELinux denial caught in enforcing mode:
----
type=PROCTITLE msg=audit(06/02/2021 02:36:16.136:131) : proctitle=/usr/lib/systemd/systemd-hostnamed 
type=PATH msg=audit(06/02/2021 02:36:16.136:131) : item=1 name=/run/systemd/default-hostname inode=12 dev=00:19 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:init_var_run_t:s0 nametype=DELETE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=PATH msg=audit(06/02/2021 02:36:16.136:131) : item=0 name=/run/systemd/ inode=2 dev=00:19 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:init_var_run_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(06/02/2021 02:36:16.136:131) : cwd=/ 
type=SYSCALL msg=audit(06/02/2021 02:36:16.136:131) : arch=x86_64 syscall=unlink success=no exit=EACCES(Permission denied) a0=0x7f54da792445 a1=0x1 a2=0x7f54da7aff9d a3=0x7f54da5003e0 items=2 ppid=1 pid=580 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=systemd-hostnam exe=/usr/lib/systemd/systemd-hostnamed subj=system_u:system_r:systemd_hostnamed_t:s0 key=(null) 
type=AVC msg=audit(06/02/2021 02:36:16.136:131) : avc:  denied  { write } for  pid=580 comm=systemd-hostnam name=systemd dev="tmpfs" ino=2 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=dir permissive=0 
----

# ls -lZ /run/systemd/default-hostname 
-rw-r--r--. 1 root root system_u:object_r:init_var_run_t:s0 10 Jun  2 02:36 /run/systemd/default-hostname
#
Comment 4 Milos Malik 2021-06-02 06:43:16 UTC 
Here are SELinux denials caught in permissive mode:
----
type=PROCTITLE msg=audit(06/02/2021 02:41:36.291:130) : proctitle=/usr/lib/systemd/systemd-hostnamed 
type=PATH msg=audit(06/02/2021 02:41:36.291:130) : item=1 name=/run/systemd/default-hostname inode=12 dev=00:19 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:init_var_run_t:s0 nametype=DELETE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=PATH msg=audit(06/02/2021 02:41:36.291:130) : item=0 name=/run/systemd/ inode=2 dev=00:19 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:init_var_run_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(06/02/2021 02:41:36.291:130) : cwd=/ 
type=SYSCALL msg=audit(06/02/2021 02:41:36.291:130) : arch=x86_64 syscall=unlink success=yes exit=0 a0=0x7f334a5ac445 a1=0x1 a2=0x7f334a5c9f9d a3=0x7f334a31a3e0 items=2 ppid=1 pid=580 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=systemd-hostnam exe=/usr/lib/systemd/systemd-hostnamed subj=system_u:system_r:systemd_hostnamed_t:s0 key=(null) 
type=AVC msg=audit(06/02/2021 02:41:36.291:130) : avc:  denied  { unlink } for  pid=580 comm=systemd-hostnam name=default-hostname dev="tmpfs" ino=12 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=file permissive=1 
type=AVC msg=audit(06/02/2021 02:41:36.291:130) : avc:  denied  { remove_name } for  pid=580 comm=systemd-hostnam name=default-hostname dev="tmpfs" ino=12 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=dir permissive=1 
type=AVC msg=audit(06/02/2021 02:41:36.291:130) : avc:  denied  { write } for  pid=580 comm=systemd-hostnam name=systemd dev="tmpfs" ino=2 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=dir permissive=1 
----
Comment 17 Martin Pitt 2021-08-07 05:32:14 UTC 
*** Bug 1978507 has been marked as a duplicate of this bug. ***
Note You need to log in before you can comment on or make changes to this bug.