Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: Run icecast.service 24x7. Eventually logs rotate and hit this selinux alert. This has been happening since at least fedora 20. The suggested way to solve/workaround: $ ausearch -c 'icecast' --raw | audit2allow -M my-icecast $ semodule -X 300 -i my-icecast.pp has never helped. [root@wan2 ~]# ls -alZ /var/log/icecast/ total 26636 drwxr-xr-x. 2 icecast icecast system_u:object_r:icecast_log_t:s0 4096 Dec 27 00:00 . drwxr-xr-x. 31 root root system_u:object_r:var_log_t:s0 8192 Dec 28 00:00 .. -rw-r--r--. 1 icecast icecast unconfined_u:object_r:icecast_log_t:s0 194 Dec 28 09:41 access.log -rw-r--r--. 1 icecast icecast unconfined_u:object_r:icecast_log_t:s0 8743492 Jul 29 2021 access.log-20210801 -rw-r--r--. 1 icecast icecast unconfined_u:object_r:icecast_log_t:s0 96 Sep 26 2021 access.log-20210927 -rw-r--r--. 1 icecast icecast unconfined_u:object_r:icecast_log_t:s0 928 Feb 27 2022 access.log-20211106 -rw-r--r--. 1 icecast icecast unconfined_u:object_r:icecast_log_t:s0 6596388 Dec 28 08:18 access.log-20221227 -rw-r--r--. 1 icecast icecast system_u:object_r:icecast_log_t:s0 11865729 Dec 28 10:02 error.log -rw-r--r--. 1 icecast icecast system_u:object_r:icecast_log_t:s0 927 Aug 8 06:48 error.log-20220808 -rw-r--r--. 1 icecast icecast system_u:object_r:icecast_log_t:s0 927 Oct 13 20:19 error.log-20220814 -rw-r--r--. 1 icecast icecast system_u:object_r:icecast_log_t:s0 927 Dec 25 12:19 error.log-20221014 -rw-r--r--. 1 icecast icecast system_u:object_r:icecast_log_t:s0 927 Dec 26 08:18 error.log-20221226 -rw-r--r--. 1 root root unconfined_u:object_r:icecast_log_t:s0 949 Jun 12 2020 my-icecast.pp -rw-r--r--. 1 root root unconfined_u:object_r:icecast_log_t:s0 187 Jun 12 2020 my-icecast.te [root@wan2 ~]# SELinux is preventing icecast from 'rename' accesses on the file /var/log/icecast/error.log. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that icecast should be allowed rename access on the error.log file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'icecast' --raw | audit2allow -M my-icecast # semodule -X 300 -i my-icecast.pp Additional Information: Source Context system_u:system_r:icecast_t:s0 Target Context system_u:object_r:icecast_log_t:s0 Target Objects /var/log/icecast/error.log [ file ] Source icecast Source Path icecast Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-36.17-1.fc36.noarch Local Policy RPM selinux-policy-targeted-36.17-1.fc36.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 6.0.15-200.fc36.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Dec 21 18:46:09 UTC 2022 x86_64 x86_64 Alert Count 8 First Seen 2022-12-28 10:02:22 EST Last Seen 2022-12-28 10:02:24 EST Local ID 517c0ab3-dcee-4b8e-868b-169705a199ed Raw Audit Messages type=AVC msg=audit(1672239744.55:89311): avc: denied { rename } for pid=386178 comm="icecast" name="error.log" dev="dm-0" ino=9692022 scontext=system_u:system_r:icecast_t:s0 tcontext=system_u:object_r:icecast_log_t:s0 tclass=file permissive=0 Hash: icecast,icecast_t,icecast_log_t,file,rename Version-Release number of selected component: selinux-policy-targeted-36.17-1.fc36.noarch Additional info: component: selinux-policy reporter: libreport-2.17.4 hashmarkername: setroubleshoot kernel: 6.0.15-200.fc36.x86_64 type: libreport
Michael, Could you gather all denials with full auditing enabled? 0) Set SELinux to permissive: # setenforce 0 1) Open the /etc/audit/rules.d/audit.rules file in an editor. 2) Remove the following line if it exists: -a task,never 3) Add the following line to the end of the file: -w /etc/shadow -p w 4) Restart the audit daemon: # service auditd restart 5) Re-run your scenario. 6) Collect AVC denials: # ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts today 0) Set SELinux to enforcing: # setenforce 1 Rotating logs using logrotate is not sufficient?
Caught in enforcing mode: ---- type=PROCTITLE msg=audit(01/18/2023 10:46:59.334:633) : proctitle=/usr/bin/icecast -c /etc/icecast.xml type=PATH msg=audit(01/18/2023 10:46:59.334:633) : item=3 name=/var/log/icecast/error.log.20230118_104659 nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(01/18/2023 10:46:59.334:633) : item=2 name=/var/log/icecast/error.log inode=262247 dev=fc:02 mode=file,644 ouid=icecast ogid=icecast rdev=00:00 obj=system_u:object_r:icecast_log_t:s0 nametype=DELETE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(01/18/2023 10:46:59.334:633) : item=1 name=/var/log/icecast/ inode=262246 dev=fc:02 mode=dir,755 ouid=icecast ogid=icecast rdev=00:00 obj=system_u:object_r:icecast_log_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(01/18/2023 10:46:59.334:633) : item=0 name=/var/log/icecast/ inode=262246 dev=fc:02 mode=dir,755 ouid=icecast ogid=icecast rdev=00:00 obj=system_u:object_r:icecast_log_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(01/18/2023 10:46:59.334:633) : cwd=/ type=SYSCALL msg=audit(01/18/2023 10:46:59.334:633) : arch=x86_64 syscall=rename success=no exit=EACCES(Permission denied) a0=0x55ae6d7235b0 a1=0x7f0473fbe5e0 a2=0x55ae6d06501b a3=0x0 items=4 ppid=1 pid=1853 auid=unset uid=icecast gid=icecast euid=icecast suid=icecast fsuid=icecast egid=icecast sgid=icecast fsgid=icecast tty=(none) ses=unset comm=icecast exe=/usr/bin/icecast subj=system_u:system_r:icecast_t:s0 key=(null) type=AVC msg=audit(01/18/2023 10:46:59.334:633) : avc: denied { remove_name } for pid=1853 comm=icecast name=error.log dev="vda2" ino=262247 scontext=system_u:system_r:icecast_t:s0 tcontext=system_u:object_r:icecast_log_t:s0 tclass=dir permissive=0 ---- # rpm -qa selinux\* icecast\* | sort icecast-2.4.4-11.fc36.x86_64 icecast-doc-2.4.4-11.fc36.noarch selinux-policy-36.17-1.fc36.noarch selinux-policy-targeted-36.17-1.fc36.noarch # grep -i logsize /etc/icecast.xml <logsize>10</logsize> <!-- Max size of a logfile --> <!-- If logarchive is enabled (1), then when logsize is reached # grep -i logarchive /etc/icecast.xml <!-- If logarchive is enabled (1), then when logsize is reached <logarchive>1</logarchive> # The SELinux denial appears many times during a restart of the icecast service when the logarchive option is enabled and the logsize option is small enough.
Caught in permissive mode: ---- type=PROCTITLE msg=audit(01/18/2023 10:51:31.550:640) : proctitle=/usr/bin/icecast -c /etc/icecast.xml type=PATH msg=audit(01/18/2023 10:51:31.550:640) : item=3 name=/var/log/icecast/error.log.20230118_105131 inode=262247 dev=fc:02 mode=file,644 ouid=icecast ogid=icecast rdev=00:00 obj=system_u:object_r:icecast_log_t:s0 nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(01/18/2023 10:51:31.550:640) : item=2 name=/var/log/icecast/error.log inode=262247 dev=fc:02 mode=file,644 ouid=icecast ogid=icecast rdev=00:00 obj=system_u:object_r:icecast_log_t:s0 nametype=DELETE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(01/18/2023 10:51:31.550:640) : item=1 name=/var/log/icecast/ inode=262246 dev=fc:02 mode=dir,755 ouid=icecast ogid=icecast rdev=00:00 obj=system_u:object_r:icecast_log_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(01/18/2023 10:51:31.550:640) : item=0 name=/var/log/icecast/ inode=262246 dev=fc:02 mode=dir,755 ouid=icecast ogid=icecast rdev=00:00 obj=system_u:object_r:icecast_log_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(01/18/2023 10:51:31.550:640) : cwd=/ type=SYSCALL msg=audit(01/18/2023 10:51:31.550:640) : arch=x86_64 syscall=rename success=yes exit=0 a0=0x55ae6d7235b0 a1=0x7ffd3d7034b0 a2=0x55ae6d06501b a3=0x0 items=4 ppid=1 pid=1853 auid=unset uid=icecast gid=icecast euid=icecast suid=icecast fsuid=icecast egid=icecast sgid=icecast fsgid=icecast tty=(none) ses=unset comm=icecast exe=/usr/bin/icecast subj=system_u:system_r:icecast_t:s0 key=(null) type=AVC msg=audit(01/18/2023 10:51:31.550:640) : avc: denied { rename } for pid=1853 comm=icecast name=error.log dev="vda2" ino=262247 scontext=system_u:system_r:icecast_t:s0 tcontext=system_u:object_r:icecast_log_t:s0 tclass=file permissive=1 type=AVC msg=audit(01/18/2023 10:51:31.550:640) : avc: denied { remove_name } for pid=1853 comm=icecast name=error.log dev="vda2" ino=262247 scontext=system_u:system_r:icecast_t:s0 tcontext=system_u:object_r:icecast_log_t:s0 tclass=dir permissive=1 ---- # ls -lZ /var/log/icecast/ total 24 -rw-r--r--. 1 icecast icecast system_u:object_r:icecast_log_t:s0 0 Jan 18 10:30 access.log -rw-r--r--. 1 icecast icecast system_u:object_r:icecast_log_t:s0 864 Jan 18 10:51 error.log -rw-r--r--. 1 icecast icecast system_u:object_r:icecast_log_t:s0 19057 Jan 18 10:46 error.log.20230118_105131 #
Test coverage for this BZ exists in a form of PR: * https://src.fedoraproject.org/tests/selinux/pull-request/354 The PR waits for review.
These denials, not related to the reported issue, also appear in rawhide (selinux-policy-38-5.fc38.noarch), but not in F37 (selinux-policy-37.18-1.fc37.noarch): ---- type=PROCTITLE msg=audit(01/27/2023 10:26:12.965:761) : proctitle=/usr/bin/icecast -c /etc/icecast.xml type=PATH msg=audit(01/27/2023 10:26:12.965:761) : item=0 name=/run/systemd/userdb/io.systemd.DynamicUser inode=38 dev=00:18 mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(01/27/2023 10:26:12.965:761) : cwd=/ type=SOCKADDR msg=audit(01/27/2023 10:26:12.965:761) : saddr={ saddr_fam=local path=/run/systemd/userdb/io.systemd.DynamicUser } type=SYSCALL msg=audit(01/27/2023 10:26:12.965:761) : arch=x86_64 syscall=connect success=no exit=EACCES(Permission denied) a0=0x9 a1=0x7ffee89cd7e0 a2=0x2d a3=0x559f38f60bc0 items=1 ppid=1 pid=5336 auid=unset uid=root gid=icecast euid=root suid=root fsuid=root egid=icecast sgid=icecast fsgid=icecast tty=(none) ses=unset comm=icecast exe=/usr/bin/icecast subj=system_u:system_r:icecast_t:s0 key=(null) type=AVC msg=audit(01/27/2023 10:26:12.965:761) : avc: denied { connectto } for pid=5336 comm=icecast path=/run/systemd/userdb/io.systemd.DynamicUser scontext=system_u:system_r:icecast_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=unix_stream_socket permissive=0
FEDORA-2023-9323895447 has been submitted as an update to Fedora 36. https://bodhi.fedoraproject.org/updates/FEDORA-2023-9323895447
FEDORA-2023-9323895447 has been pushed to the Fedora 36 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2023-9323895447` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-9323895447 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2023-9323895447 has been pushed to the Fedora 36 stable repository. If problem still persists, please make note of it in this bug report.