Bug 2062911
| Summary: | SELinux is preventing /usr/libexec/fprintd from write access on the file persist. | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Adam Miller <admiller> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | CentOS Stream | CC: | bstinson, cmattern, dwojewod, jwboyer, lukas, lvrabec, mmalik, nknazeko, ssekidde |
| Target Milestone: | rc | Keywords: | AutoVerified, Triaged |
| Target Release: | 9.1 | Flags: | pm-rhel:
mirror+
|
| Hardware: | Unspecified | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-34.1.30-2.el9 | Doc Type: | No Doc Update |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-11-15 11:13:17 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
To fix this issue properly, we need to see SELinux denials generated in the permissive mode as well. Please run the following commands: 1. # semanage permissive -a fprintd_t 2. re-run your scenario 3. # ausearch -m avc -m user_avc -m selinux_err -i -ts today 4. # semanage permissive -d fprintd_t Please attach the ausearch output to this BZ. Thank you. $ ausearch -m avc -m user_avc -m selinux_err -i -ts today
----
type=PROCTITLE msg=audit(03/12/2022 10:32:03.052:263) : proctitle=/usr/libexec/fprintd
type=SYSCALL msg=audit(03/12/2022 10:32:03.052:263) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=AT_FDCWD a1=0x5632e7193dd0 a2=O_WRONLY a3=0x0 items=0 ppid=1 pid=6590 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=fprintd exe=/usr/libexec/fprintd subj=system_u:system_r:fprintd_t:s0 key=(null)
type=AVC msg=audit(03/12/2022 10:32:03.052:263) : avc: denied { write } for pid=6590 comm=fprintd name=wakeup dev="sysfs" ino=47262 scontext=system_u:system_r:fprintd_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file permissive=0
----
type=PROCTITLE msg=audit(03/12/2022 10:32:03.052:264) : proctitle=/usr/libexec/fprintd
type=SYSCALL msg=audit(03/12/2022 10:32:03.052:264) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=AT_FDCWD a1=0x5632e718a4d0 a2=O_WRONLY a3=0x0 items=0 ppid=1 pid=6590 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=fprintd exe=/usr/libexec/fprintd subj=system_u:system_r:fprintd_t:s0 key=(null)
type=AVC msg=audit(03/12/2022 10:32:03.052:264) : avc: denied { write } for pid=6590 comm=fprintd name=persist dev="sysfs" ino=29343 scontext=system_u:system_r:fprintd_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file permissive=0
----
type=PROCTITLE msg=audit(03/12/2022 10:32:03.294:265) : proctitle=/usr/libexec/fprintd
type=SYSCALL msg=audit(03/12/2022 10:32:03.294:265) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=AT_FDCWD a1=0x5632e71536f0 a2=O_WRONLY a3=0x0 items=0 ppid=1 pid=6590 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=fprintd exe=/usr/libexec/fprintd subj=system_u:system_r:fprintd_t:s0 key=(null)
type=AVC msg=audit(03/12/2022 10:32:03.294:265) : avc: denied { write } for pid=6590 comm=fprintd name=wakeup dev="sysfs" ino=49136 scontext=system_u:system_r:fprintd_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file permissive=0
----
type=PROCTITLE msg=audit(03/12/2022 10:32:03.294:266) : proctitle=/usr/libexec/fprintd
type=SYSCALL msg=audit(03/12/2022 10:32:03.294:266) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=AT_FDCWD a1=0x5632e71963a0 a2=O_WRONLY a3=0x0 items=0 ppid=1 pid=6590 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=fprintd exe=/usr/libexec/fprintd subj=system_u:system_r:fprintd_t:s0 key=(null)
type=AVC msg=audit(03/12/2022 10:32:03.294:266) : avc: denied { write } for pid=6590 comm=fprintd name=persist dev="sysfs" ino=29343 scontext=system_u:system_r:fprintd_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file permissive=0
----
type=PROCTITLE msg=audit(03/12/2022 10:32:55.575:282) : proctitle=/usr/libexec/fprintd
type=SYSCALL msg=audit(03/12/2022 10:32:55.575:282) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=AT_FDCWD a1=0x56479bf92570 a2=O_WRONLY a3=0x0 items=0 ppid=1 pid=6828 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=fprintd exe=/usr/libexec/fprintd subj=system_u:system_r:fprintd_t:s0 key=(null)
type=AVC msg=audit(03/12/2022 10:32:55.575:282) : avc: denied { write } for pid=6828 comm=fprintd name=wakeup dev="sysfs" ino=49147 scontext=system_u:system_r:fprintd_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file permissive=0
----
type=PROCTITLE msg=audit(03/12/2022 10:32:55.575:283) : proctitle=/usr/libexec/fprintd
type=SYSCALL msg=audit(03/12/2022 10:32:55.575:283) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=AT_FDCWD a1=0x56479bf8b7c0 a2=O_WRONLY a3=0x0 items=0 ppid=1 pid=6828 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=fprintd exe=/usr/libexec/fprintd subj=system_u:system_r:fprintd_t:s0 key=(null)
type=AVC msg=audit(03/12/2022 10:32:55.575:283) : avc: denied { write } for pid=6828 comm=fprintd name=persist dev="sysfs" ino=29343 scontext=system_u:system_r:fprintd_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file permissive=0
----
type=PROCTITLE msg=audit(03/12/2022 10:32:56.051:284) : proctitle=/usr/libexec/fprintd
type=SYSCALL msg=audit(03/12/2022 10:32:56.051:284) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=AT_FDCWD a1=0x56479bf917d0 a2=O_WRONLY a3=0x0 items=0 ppid=1 pid=6828 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=fprintd exe=/usr/libexec/fprintd subj=system_u:system_r:fprintd_t:s0 key=(null)
type=AVC msg=audit(03/12/2022 10:32:56.051:284) : avc: denied { write } for pid=6828 comm=fprintd name=wakeup dev="sysfs" ino=49290 scontext=system_u:system_r:fprintd_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file permissive=0
----
type=PROCTITLE msg=audit(03/12/2022 10:32:56.052:285) : proctitle=/usr/libexec/fprintd
type=SYSCALL msg=audit(03/12/2022 10:32:56.052:285) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=AT_FDCWD a1=0x56479bf90870 a2=O_WRONLY a3=0x0 items=0 ppid=1 pid=6828 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=fprintd exe=/usr/libexec/fprintd subj=system_u:system_r:fprintd_t:s0 key=(null)
type=AVC msg=audit(03/12/2022 10:32:56.052:285) : avc: denied { write } for pid=6828 comm=fprintd name=persist dev="sysfs" ino=29343 scontext=system_u:system_r:fprintd_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file permissive=0
To backport:
commit afae18572849c2bc42148eda944776a1d626d29f (HEAD -> rawhide, upstream/rawhide)
Author: Zdenek Pytela <zpytela>
Date: Wed Mar 30 13:43:49 2022 +0200
Allow fprintd read and write hardware state information
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:8283 |
Description of problem: SELinux is preventing /usr/libexec/fprintd from write access on the file persist. Additional Information: Source Context system_u:system_r:fprintd_t:s0 Target Context system_u:object_r:sysfs_t:s0 Target Objects persist [ file ] Source fprintd Source Path /usr/libexec/fprintd Port <Unknown> Host framework Source RPM Packages fprintd-1.94.0-3.el9.x86_64 Target RPM Packages SELinux Policy RPM selinux-policy-targeted-34.1.27-1.el9.noarch Local Policy RPM selinux-policy-targeted-34.1.27-1.el9.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name framework Platform Linux framework 5.14.0-70.el9.x86_64 #1 SMP PREEMPT Thu Feb 24 23:01:31 UTC 2022 x86_64 x86_64 Alert Count 16 First Seen 2022-03-10 15:07:07 CST Last Seen 2022-03-10 15:39:14 CST Local ID c2a47469-7e5f-46d7-9060-fb8d5231876f Raw Audit Messages type=AVC msg=audit(1646948354.315:173): avc: denied { write } for pid=3433 comm="fprintd" name="persist" dev="sysfs" ino=29343 scontext=system_u:system_r:fprintd_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file permissive=0 type=SYSCALL msg=audit(1646948354.315:173): arch=x86_64 syscall=openat success=no exit=EACCES a0=ffffff9c a1=55ab1a396060 a2=1 a3=0 items=0 ppid=1 pid=3433 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=fprintd exe=/usr/libexec/fprintd subj=system_u:system_r:fprintd_t:s0 key=(null) Hash: fprintd,fprintd_t,sysfs_t,file,write Version-Release number of selected component (if applicable): selinux-policy-34.1.27-1.el9.noarch How reproducible: Always, anytime I try to login or run sudo. Steps to Reproduce: 1. Use a laptop with a fingerprint reader 2. Login or run sudo 3.