Bug 2093453 - SELinux prevents the fedora-third-party process from reading the /etc/passwd file
Summary: SELinux prevents the fedora-third-party process from reading the /etc/passwd ...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 37
Hardware: x86_64
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-06-03 18:31 UTC by Milos Malik
Modified: 2022-09-23 08:16 UTC (History)
8 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2022-08-18 09:12:26 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github fedora-selinux selinux-policy pull 1307 0 None Merged Allow fedora-third-party read the passwords file 2022-08-09 15:46:40 UTC

Description Milos Malik 2022-06-03 18:31:03 UTC
Description of problem:
 * the service starts successfully and does NOT produce any error messages

Version-Release number of selected component (if applicable):
fedora-third-party-0.10-1.fc37.noarch
selinux-policy-37.3-1.fc37.noarch
selinux-policy-targeted-37.3-1.fc37.noarch

How reproducible:
 * always

Steps to Reproduce:
1. get a Fedora Rawhide machine (targeted policy is active)
2. touch /run/ostree-booted
3. (re)start the fedora-third-party-refresh service
4. search for SELinux denials

Actual results (enforcing mode):
----
type=PROCTITLE msg=audit(06/03/2022 13:53:22.660:605) : proctitle=/usr/bin/python3 /usr/bin/fedora-third-party refresh 
type=PATH msg=audit(06/03/2022 13:53:22.660:605) : item=0 name=/etc/passwd inode=190912 dev=fc:01 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:passwd_file_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(06/03/2022 13:53:22.660:605) : cwd=/ 
type=SYSCALL msg=audit(06/03/2022 13:53:22.660:605) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=AT_FDCWD a1=0x7f90da3bdcc4 a2=O_RDONLY|O_CLOEXEC a3=0x0 items=1 ppid=1 pid=1878 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=fedora-third-pa exe=/usr/bin/python3.10 subj=system_u:system_r:fedoratp_t:s0 key=(null) 
type=AVC msg=audit(06/03/2022 13:53:22.660:605) : avc:  denied  { read } for  pid=1878 comm=fedora-third-pa name=passwd dev="vda1" ino=190912 scontext=system_u:system_r:fedoratp_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file permissive=0 
----

Expected results:
 * no SELinux denials

Comment 1 Milos Malik 2022-06-03 18:33:39 UTC
Actual results (permissive mode):
----
type=PROCTITLE msg=audit(06/03/2022 14:31:15.869:662) : proctitle=/usr/bin/python3 /usr/bin/fedora-third-party refresh 
type=PATH msg=audit(06/03/2022 14:31:15.869:662) : item=0 name=/etc/passwd inode=190912 dev=fc:01 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:passwd_file_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(06/03/2022 14:31:15.869:662) : cwd=/ 
type=SYSCALL msg=audit(06/03/2022 14:31:15.869:662) : arch=x86_64 syscall=openat success=yes exit=3 a0=AT_FDCWD a1=0x7f4b11bbdcc4 a2=O_RDONLY|O_CLOEXEC a3=0x0 items=1 ppid=1 pid=20731 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=fedora-third-pa exe=/usr/bin/python3.10 subj=system_u:system_r:fedoratp_t:s0 key=(null) 
type=AVC msg=audit(06/03/2022 14:31:15.869:662) : avc:  denied  { open } for  pid=20731 comm=fedora-third-pa path=/etc/passwd dev="vda1" ino=190912 scontext=system_u:system_r:fedoratp_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file permissive=1 
type=AVC msg=audit(06/03/2022 14:31:15.869:662) : avc:  denied  { read } for  pid=20731 comm=fedora-third-pa name=passwd dev="vda1" ino=190912 scontext=system_u:system_r:fedoratp_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file permissive=1 
----
type=PROCTITLE msg=audit(06/03/2022 14:31:15.871:663) : proctitle=/usr/bin/python3 /usr/bin/fedora-third-party refresh 
type=PATH msg=audit(06/03/2022 14:31:15.871:663) : item=0 name= inode=190912 dev=fc:01 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:passwd_file_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(06/03/2022 14:31:15.871:663) : cwd=/ 
type=SYSCALL msg=audit(06/03/2022 14:31:15.871:663) : arch=x86_64 syscall=newfstatat success=yes exit=0 a0=0x3 a1=0x7f4b11bb9f2e a2=0x7fff04131840 a3=0x1000 items=1 ppid=1 pid=20731 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=fedora-third-pa exe=/usr/bin/python3.10 subj=system_u:system_r:fedoratp_t:s0 key=(null) 
type=AVC msg=audit(06/03/2022 14:31:15.871:663) : avc:  denied  { getattr } for  pid=20731 comm=fedora-third-pa path=/etc/passwd dev="vda1" ino=190912 scontext=system_u:system_r:fedoratp_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file permissive=1 
----

# semodule -lfull | grep fedora
100 fedoratp          pp          
#

Comment 3 Ben Cotton 2022-08-09 13:41:21 UTC
This bug appears to have been reported against 'rawhide' during the Fedora Linux 37 development cycle.
Changing version to 37.


Note You need to log in before you can comment on or make changes to this bug.