Bug 2134272 - SELinux is preventing to write on devtmpfs
Summary: SELinux is preventing to write on devtmpfs
Keywords:
Status: CLOSED DUPLICATE of bug 2134121
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: rawhide
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-10-13 03:16 UTC by Huanian Li
Modified: 2022-10-13 06:45 UTC (History)
8 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2022-10-13 06:45:20 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Huanian Li 2022-10-13 03:16:26 UTC
Description of problem:

avc: denied { write } for pid=173647 comm="systemd-gpt-aut" name="vda" dev="devtmpfs" ino=321 scontext=system_u:system_r:systemd_gpt_generator_t:s0 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1. clone https://s3.amazonaws.com/arr-cki-prod-trusted-artifacts/trusted-artifacts/661793015/setup%20x86_64/3145814585/artifacts/beaker.xml
2. submit it to beaker
3. check avc.log

Actual results:

# https://s3.us-east-1.amazonaws.com/arr-cki-prod-datawarehouse-public/datawarehouse-public/2022/10/08/redhat:661793015/build_x86_64_redhat:661793015_x86_64/tests/3/results_0001/job.01/recipes/12730349/tasks/8/results/1665253769/logs/avc.log
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   permissive
Mode from config file:          permissive
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      33
selinux-policy-37.13-1.fc38.noarch
----
time->Sat Oct  8 14:53:49 2022
type=AVC msg=audit(1665255229.515:549): avc:  denied  { write } for  pid=173647 comm="systemd-gpt-aut" name="vda" dev="devtmpfs" ino=321 scontext=system_u:system_r:systemd_gpt_generator_t:s0 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file permissive=1
----
time->Sat Oct  8 14:53:52 2022
type=AVC msg=audit(1665255232.008:591): avc:  denied  { write } for  pid=173720 comm="systemd-gpt-aut" name="vda" dev="devtmpfs" ino=321 scontext=system_u:system_r:systemd_gpt_generator_t:s0 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file permissive=1


Expected results:

Should not deny {write} for comm="systemd-gpt-aut" name="\S+" dev="devtmpfs"

Additional info:

https://gitlab.com/redhat/centos-stream/tests/kernel/kernel-tests/-/issues/1424

Comment 1 Zdenek Pytela 2022-10-13 06:45:20 UTC

*** This bug has been marked as a duplicate of bug 2134121 ***


Note You need to log in before you can comment on or make changes to this bug.