Bug 2089175 - SELinux is preventing 10-sendmail from 'execute' accesses on the file /usr/bin/systemctl.
Summary: SELinux is preventing 10-sendmail from 'execute' accesses on the file /usr/bi...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 36
Hardware: x86_64
OS: Unspecified
medium
medium
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:324a88b75f03074e637f64309b7...
: 2089176 2089177 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-05-23 07:29 UTC by Kamil Páral
Modified: 2022-06-03 03:06 UTC (History)
9 users (show)

Fixed In Version: selinux-policy-36.10-1.fc36
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2022-06-03 03:06:52 UTC
Type: ---


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github fedora-selinux selinux-policy pull 1205 0 None open Add support for nm-dispatcher sendmail scripts 2022-05-24 19:39:43 UTC
Red Hat Bugzilla 2089170 1 medium CLOSED SELinux is preventing systemctl from 'map' accesses on the file /usr/bin/systemctl. 2022-08-03 15:33:24 UTC
Red Hat Bugzilla 2089171 1 medium CLOSED SELinux is preventing systemctl from 'search' accesses on the directory 1. 2022-08-03 15:36:39 UTC

Description Kamil Páral 2022-05-23 07:29:38 UTC
Description of problem:
I upgraded my F36 Workstation and rebooted. This is the first time I see this error, so it must be related to the recent update.
SELinux is preventing 10-sendmail from 'execute' accesses on the file /usr/bin/systemctl.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that 10-sendmail should be allowed execute access on the systemctl file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c '10-sendmail' --raw | audit2allow -M my-10sendmail
# semodule -X 300 -i my-10sendmail.pp

Additional Information:
Source Context                system_u:system_r:NetworkManager_dispatcher_custom
                              _t:s0
Target Context                system_u:object_r:systemd_systemctl_exec_t:s0
Target Objects                /usr/bin/systemctl [ file ]
Source                        10-sendmail
Source Path                   10-sendmail
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           systemd-250.3-8.fc36.x86_64
SELinux Policy RPM            selinux-policy-targeted-36.9-1.fc36.noarch
Local Policy RPM              selinux-policy-targeted-36.9-1.fc36.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 5.17.9-300.fc36.x86_64 #1 SMP
                              PREEMPT Wed May 18 15:08:23 UTC 2022 x86_64 x86_64
Alert Count                   1
First Seen                    2022-05-23 09:25:13 CEST
Last Seen                     2022-05-23 09:25:13 CEST
Local ID                      ff05b81a-2cf8-48ad-8690-b178d90492e2

Raw Audit Messages
type=AVC msg=audit(1653290713.727:245): avc:  denied  { execute } for  pid=1396 comm="10-sendmail" name="systemctl" dev="dm-0" ino=1836519 scontext=system_u:system_r:NetworkManager_dispatcher_custom_t:s0 tcontext=system_u:object_r:systemd_systemctl_exec_t:s0 tclass=file permissive=1


Hash: 10-sendmail,NetworkManager_dispatcher_custom_t,systemd_systemctl_exec_t,file,execute

Version-Release number of selected component:
selinux-policy-targeted-36.9-1.fc36.noarch

Additional info:
component:      selinux-policy
reporter:       libreport-2.17.1
hashmarkername: setroubleshoot
kernel:         5.17.9-300.fc36.x86_64
type:           libreport

Comment 1 Zdenek Pytela 2022-05-23 09:15:48 UTC
*** Bug 2089176 has been marked as a duplicate of this bug. ***

Comment 2 Zdenek Pytela 2022-05-23 09:15:57 UTC
*** Bug 2089177 has been marked as a duplicate of this bug. ***

Comment 3 Davide Repetto 2022-05-29 18:05:55 UTC
Similar problem has been detected:

This happens at boot, even after "fixfiles onboot", together with another 10 AVCs.


hashmarkername: setroubleshoot
kernel:         5.17.11-300.fc36.x86_64
package:        selinux-policy-targeted-36.9-1.fc36.noarch
reason:         SELinux is preventing 10-sendmail from 'execute' accesses on the file /usr/bin/systemctl.
type:           libreport

Comment 4 Davide Repetto 2022-05-29 18:06:15 UTC
Similar problem has been detected:

This happens at boot, even after "fixfiles onboot", together with another 10 AVCs.


hashmarkername: setroubleshoot
kernel:         5.17.11-300.fc36.x86_64
package:        selinux-policy-targeted-36.9-1.fc36.noarch
reason:         SELinux is preventing 10-sendmail from read, open access on the file /usr/bin/systemctl.
type:           libreport

Comment 5 Davide Repetto 2022-05-29 18:06:40 UTC
Similar problem has been detected:

This happens at boot, even after "fixfiles onboot", together with another 10 AVCs.


hashmarkername: setroubleshoot
kernel:         5.17.11-300.fc36.x86_64
package:        selinux-policy-targeted-36.9-1.fc36.noarch
reason:         SELinux is preventing 10-sendmail from 'execute_no_trans' accesses on the file /usr/bin/systemctl.
type:           libreport

Comment 6 Fedora Update System 2022-05-30 12:48:15 UTC
FEDORA-2022-a8b9033ed5 has been submitted as an update to Fedora 36. https://bodhi.fedoraproject.org/updates/FEDORA-2022-a8b9033ed5

Comment 7 Fedora Update System 2022-06-01 02:28:38 UTC
FEDORA-2022-a8b9033ed5 has been pushed to the Fedora 36 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2022-a8b9033ed5`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2022-a8b9033ed5

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 8 Fedora Update System 2022-06-03 03:06:52 UTC
FEDORA-2022-a8b9033ed5 has been pushed to the Fedora 36 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.