Bug 1971621 - SElinux + Asterisk + Timezone
Summary: SElinux + Asterisk + Timezone
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 34
Hardware: aarch64
OS: Unspecified
medium
medium
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-06-14 13:07 UTC by camelot
Modified: 2021-07-01 11:15 UTC (History)
7 users (show)

Fixed In Version: selinux-policy-34.12-1.fc34
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-06-30 03:16:02 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description camelot 2021-06-14 13:07:23 UTC
I installed Asterisk on Fedora 34 and set the timezone to Germany in /etc/asterisk/voicemail.conf:

[zonemessages]
germany=Europe/Berlin|'vm-received' a d b Y 'digits/at' HM

This causes these selinus messages:

type=AVC msg=audit(1623660479.330:18563): avc:  denied  { watch } for  pid=177853 comm="asterisk" path="/usr/share/zoneinfo/UTC" dev="dm-0" ino=5767559 scontext=system_u:system_r:asterisk_t:s0 tcontext=system_u:object_r:locale_t:s0 tclass=file permissive=0
type=AVC msg=audit(1623660479.330:18564): avc:  denied  { watch } for  pid=177853 comm="asterisk" path="/usr/share/zoneinfo/UTC" dev="dm-0" ino=5767559 scontext=system_u:system_r:asterisk_t:s0 tcontext=system_u:object_r:locale_t:s0 tclass=file permissive=0
type=AVC msg=audit(1623661687.051:18569): avc:  denied  { watch } for  pid=179089 comm="asterisk" path="/usr/share/zoneinfo/UTC" dev="dm-0" ino=5767559 scontext=system_u:system_r:asterisk_t:s0 tcontext=system_u:object_r:locale_t:s0 tclass=file permissive=0
type=AVC msg=audit(1623661687.051:18570): avc:  denied  { watch } for  pid=179089 comm="asterisk" path="/usr/share/zoneinfo/UTC" dev="dm-0" ino=5767559 scontext=system_u:system_r:asterisk_t:s0 tcontext=system_u:object_r:locale_t:s0 tclass=file permissive=0
type=AVC msg=audit(1623669047.613:18731): avc:  denied  { watch } for  pid=183821 comm="asterisk" path="/usr/share/zoneinfo/UTC" dev="dm-0" ino=5767559 scontext=system_u:system_r:asterisk_t:s0 tcontext=system_u:object_r:locale_t:s0 tclass=file permissive=0
type=AVC msg=audit(1623669047.613:18732): avc:  denied  { watch } for  pid=183821 comm="asterisk" path="/usr/share/zoneinfo/UTC" dev="dm-0" ino=5767559 scontext=system_u:system_r:asterisk_t:s0 tcontext=system_u:object_r:locale_t:s0 tclass=file permissive=0
type=AVC msg=audit(1623669058.393:18733): avc:  denied  { watch } for  pid=183821 comm="asterisk" path="/usr/share/zoneinfo/Europe/Berlin" dev="dm-0" ino=5505633 scontext=system_u:system_r:asterisk_t:s0 tcontext=system_u:object_r:locale_t:s0 tclass=file permissive=0
type=AVC msg=audit(1623670594.331:18752): avc:  denied  { watch } for  pid=184836 comm="asterisk" path="/usr/share/zoneinfo/UTC" dev="dm-0" ino=5767559 scontext=system_u:system_r:asterisk_t:s0 tcontext=system_u:object_r:locale_t:s0 tclass=file permissive=0
type=AVC msg=audit(1623670594.331:18753): avc:  denied  { watch } for  pid=184836 comm="asterisk" path="/usr/share/zoneinfo/UTC" dev="dm-0" ino=5767559 scontext=system_u:system_r:asterisk_t:s0 tcontext=system_u:object_r:locale_t:s0 tclass=file permissive=0
type=AVC msg=audit(1623670612.271:18754): avc:  denied  { watch } for  pid=184836 comm="asterisk" path="/usr/share/zoneinfo/Europe/Berlin" dev="dm-0" ino=5505633 scontext=system_u:system_r:asterisk_t:s0 tcontext=system_u:object_r:locale_t:s0 tclass=file permissive=0
type=AVC msg=audit(1623671190.607:18770): avc:  denied  { watch } for  pid=185230 comm="asterisk" path="/usr/share/zoneinfo/UTC" dev="dm-0" ino=5767559 scontext=system_u:system_r:asterisk_t:s0 tcontext=system_u:object_r:locale_t:s0 tclass=file permissive=0
type=AVC msg=audit(1623671190.607:18771): avc:  denied  { watch } for  pid=185230 comm="asterisk" path="/usr/share/zoneinfo/UTC" dev="dm-0" ino=5767559 scontext=system_u:system_r:asterisk_t:s0 tcontext=system_u:object_r:locale_t:s0 tclass=file permissive=0
type=AVC msg=audit(1623671194.487:18772): avc:  denied  { watch } for  pid=185230 comm="asterisk" path="/usr/share/zoneinfo/Europe/Berlin" dev="dm-0" ino=5505633 scontext=system_u:system_r:asterisk_t:s0 tcontext=system_u:object_r:locale_t:s0 tclass=file permissive=0
type=AVC msg=audit(1623671467.954:18781): avc:  denied  { watch } for  pid=185543 comm="asterisk" path="/usr/share/zoneinfo/Europe/Berlin" dev="dm-0" ino=5505633 scontext=system_u:system_r:asterisk_t:s0 tcontext=system_u:object_r:locale_t:s0 tclass=file permissive=0
type=AVC msg=audit(1623671467.954:18782): avc:  denied  { watch } for  pid=185543 comm="asterisk" path="/usr/share/zoneinfo/Europe/Berlin" dev="dm-0" ino=5505633 scontext=system_u:system_r:asterisk_t:s0 tcontext=system_u:object_r:locale_t:s0 tclass=file permissive=0
type=AVC msg=audit(1623671525.724:18783): avc:  denied  { watch } for  pid=185543 comm="asterisk" path="/usr/share/zoneinfo/UTC" dev="dm-0" ino=5767559 scontext=system_u:system_r:asterisk_t:s0 tcontext=system_u:object_r:locale_t:s0 tclass=file permissive=0
type=AVC msg=audit(1623671943.841:18792): avc:  denied  { watch } for  pid=185801 comm="asterisk" path="/usr/share/zoneinfo/UTC" dev="dm-0" ino=5767559 scontext=system_u:system_r:asterisk_t:s0 tcontext=system_u:object_r:locale_t:s0 tclass=file permissive=0
type=AVC msg=audit(1623671943.841:18793): avc:  denied  { watch } for  pid=185801 comm="asterisk" path="/usr/share/zoneinfo/UTC" dev="dm-0" ino=5767559 scontext=system_u:system_r:asterisk_t:s0 tcontext=system_u:object_r:locale_t:s0 tclass=file permissive=0
type=AVC msg=audit(1623671946.591:18794): avc:  denied  { watch } for  pid=185801 comm="asterisk" path="/usr/share/zoneinfo/Europe/Berlin" dev="dm-0" ino=5505633 scontext=system_u:system_r:asterisk_t:s0 tcontext=system_u:object_r:locale_t:s0 tclass=file permissive=0
type=AVC msg=audit(1623672368.337:18803): avc:  denied  { watch } for  pid=186645 comm="asterisk" path="/usr/share/zoneinfo/UTC" dev="dm-0" ino=5767559 scontext=system_u:system_r:asterisk_t:s0 tcontext=system_u:object_r:locale_t:s0 tclass=file permissive=0
type=AVC msg=audit(1623672368.337:18804): avc:  denied  { watch } for  pid=186645 comm="asterisk" path="/usr/share/zoneinfo/UTC" dev="dm-0" ino=5767559 scontext=system_u:system_r:asterisk_t:s0 tcontext=system_u:object_r:locale_t:s0 tclass=file permissive=0
type=AVC msg=audit(1623672370.987:18805): avc:  denied  { watch } for  pid=186645 comm="asterisk" path="/usr/share/zoneinfo/Europe/Berlin" dev="dm-0" ino=5505633 scontext=system_u:system_r:asterisk_t:s0 tcontext=system_u:object_r:locale_t:s0 tclass=file permissive=0
type=AVC msg=audit(1623674046.744:18830): avc:  denied  { watch } for  pid=187601 comm="asterisk" path="/usr/share/zoneinfo/UTC" dev="dm-0" ino=5767559 scontext=system_u:system_r:asterisk_t:s0 tcontext=system_u:object_r:locale_t:s0 tclass=file permissive=0
type=AVC msg=audit(1623674046.744:18831): avc:  denied  { watch } for  pid=187601 comm="asterisk" path="/usr/share/zoneinfo/UTC" dev="dm-0" ino=5767559 scontext=system_u:system_r:asterisk_t:s0 tcontext=system_u:object_r:locale_t:s0 tclass=file permissive=0
type=AVC msg=audit(1623674049.324:18832): avc:  denied  { watch } for  pid=187601 comm="asterisk" path="/usr/share/zoneinfo/Europe/Berlin" dev="dm-0" ino=5505633 scontext=system_u:system_r:asterisk_t:s0 tcontext=system_u:object_r:locale_t:s0 tclass=file permissive=0

It seems UTC is also not readable

Comment 1 Zdenek Pytela 2021-06-15 09:37:24 UTC
I've submitted a Fedora PR to address the issue:
https://github.com/fedora-selinux/selinux-policy/pull/779

Comment 2 Fedora Update System 2021-06-24 15:28:38 UTC
FEDORA-2021-3df7370a94 has been submitted as an update to Fedora 34. https://bodhi.fedoraproject.org/updates/FEDORA-2021-3df7370a94

Comment 3 Fedora Update System 2021-06-24 16:56:01 UTC
FEDORA-2021-3df7370a94 has been pushed to the Fedora 34 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2021-3df7370a94`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2021-3df7370a94

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 4 Fedora Update System 2021-06-30 03:16:02 UTC
FEDORA-2021-3df7370a94 has been pushed to the Fedora 34 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 5 camelot 2021-07-01 11:15:02 UTC
Thx for the quick fix!


Note You need to log in before you can comment on or make changes to this bug.