Bug 2183190 - New selinux denials with geoclue2-2.7.0-1.fc38
Summary: New selinux denials with geoclue2-2.7.0-1.fc38
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 38
Hardware: Unspecified
OS: Linux
medium
unspecified
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
: 2183028 2183208 2183296 2183298 2183310 2183315 2183551 2183553 2183709 2184515 2184528 2184532 2184732 2186963 2186964 2186966 2187432 2187657 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-03-30 14:26 UTC by Kalev Lember
Modified: 2023-04-18 11:38 UTC (History)
18 users (show)

Fixed In Version: selinux-policy-38.10-1.fc38
Clone Of:
Environment:
Last Closed: 2023-04-15 02:06:51 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github fedora-selinux selinux-policy pull 1632 0 None open New geoclue 2023-03-30 17:19:28 UTC

Description Kalev Lember 2023-03-30 14:26:18 UTC
Looks like selinux-policy needs updating for geoclue2-2.7.0-1.fc38:

SELinux is preventing geoclue from watch access on the directory /etc.
SELinux is preventing pool-geoclue from search access on the directory net.

(These are from https://bodhi.fedoraproject.org/updates/FEDORA-2023-8fdae6bd57)

Watch access on /etc is probably due to a newly added glib file monitor on /etc/geolocation, https://gitlab.freedesktop.org/geoclue/geoclue/-/commit/cb66669cff959046c8ef02abe13fc4f1a68660c5

Comment 1 Christian Labisch 2023-03-30 14:35:23 UTC
SELinux is preventing geoclue from watch access on the directory /etc.

*****  Plugin catchall_labels (83.8 confidence) suggests   *******************

If you want to allow geoclue to have watch access on the etc directory
Then you need to change the label on /etc
Do
# semanage fcontext -a -t FILE_TYPE '/etc'
where FILE_TYPE is one of the following: geoclue_tmp_t, geoclue_var_lib_t.
Then execute:
restorecon -v '/etc'


*****  Plugin catchall (17.1 confidence) suggests   **************************

If you believe that geoclue should be allowed watch access on the etc directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'geoclue' --raw | audit2allow -M my-geoclue
# semodule -X 300 -i my-geoclue.pp

Additional Information:
Source Context                system_u:system_r:geoclue_t:s0
Target Context                system_u:object_r:etc_t:s0
Target Objects                /etc [ dir ]
Source                        geoclue
Source Path                   geoclue
Port                          <Unknown>
Host                          xxxxxxxx
Source RPM Packages           
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-38.9-1.fc38.noarch
Local Policy RPM              selinux-policy-targeted-38.9-1.fc38.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     xxxxxxxx
Platform                      Linux xxxxxxxx 6.2.8-300.fc38.x86_64 #1 SMP
                              PREEMPT_DYNAMIC Wed Mar 22 19:29:30 UTC 2023
                              x86_64
Alert Count                   15
First Seen                    2023-03-30 13:35:25 CEST
Last Seen                     2023-03-30 13:36:21 CEST
Local ID                      c6a3fdfe-eeb0-4862-be36-9d0335bf115c

Raw Audit Messages
type=AVC msg=audit(1680176181.677:232): avc:  denied  { watch } for  pid=1532 comm="gmain" path="/etc" dev="dm-0" ino=134295681 scontext=system_u:system_r:geoclue_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=0

Hash: geoclue,geoclue_t,etc_t,dir,watch


SELinux is preventing pool-geoclue from search access on the directory net.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that pool-geoclue should be allowed search access on the net directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'pool-geoclue' --raw | audit2allow -M my-poolgeoclue
# semodule -X 300 -i my-poolgeoclue.pp

Additional Information:
Source Context                system_u:system_r:geoclue_t:s0
Target Context                system_u:object_r:sysctl_net_t:s0
Target Objects                net [ dir ]
Source                        pool-geoclue
Source Path                   pool-geoclue
Port                          <Unknown>
Host                          xxxxxxxx
Source RPM Packages           
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-38.9-1.fc38.noarch
Local Policy RPM              selinux-policy-targeted-38.9-1.fc38.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     xxxxxxxx
Platform                      Linux xxxxxxxx 6.2.8-300.fc38.x86_64 #1 SMP
                              PREEMPT_DYNAMIC Wed Mar 22 19:29:30 UTC 2023
                              x86_64
Alert Count                   28
First Seen                    2023-03-30 13:35:27 CEST
Last Seen                     2023-03-30 13:35:42 CEST
Local ID                      d604119d-8266-4b9f-8894-347c25cdaaa8

Raw Audit Messages
type=AVC msg=audit(1680176142.674:209): avc:  denied  { search } for  pid=1532 comm="pool-geoclue" name="net" dev="proc" ino=25312 scontext=system_u:system_r:geoclue_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=dir permissive=0

Hash: pool-geoclue,geoclue_t,sysctl_net_t,dir,search

Comment 2 Zdenek Pytela 2023-03-30 15:10:51 UTC
*** Bug 2183028 has been marked as a duplicate of this bug. ***

Comment 3 Ben Cotton 2023-03-30 15:17:08 UTC
*** Bug 2183208 has been marked as a duplicate of this bug. ***

Comment 4 Zdenek Pytela 2023-03-30 17:19:29 UTC
Please try the PR's scratchbuild if you can:

https://github.com/fedora-selinux/selinux-policy/pull/1632
Checks -> Artifacts -> rpms.zip

Comment 5 Ben Cotton 2023-03-30 18:26:58 UTC
Upstream PR 1632 fixes this behavior on my system.

Comment 6 Milos Malik 2023-03-30 18:30:42 UTC
Caught in enforcing mode:
----
type=PROCTITLE msg=audit(03/30/2023 14:28:23.473:571) : proctitle=/usr/libexec/geoclue 
type=PATH msg=audit(03/30/2023 14:28:23.473:571) : item=0 name=/etc inode=131078 dev=fc:02 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(03/30/2023 14:28:23.473:571) : cwd=/ 
type=SYSCALL msg=audit(03/30/2023 14:28:23.473:571) : arch=x86_64 syscall=inotify_add_watch success=no exit=EACCES(Permission denied) a0=0x9 a1=0x562ed261dfa0 a2=0x1002fce a3=0x4 items=1 ppid=1 pid=1876 auid=unset uid=geoclue gid=geoclue euid=geoclue suid=geoclue fsuid=geoclue egid=geoclue sgid=geoclue fsgid=geoclue tty=(none) ses=unset comm=geoclue exe=/usr/libexec/geoclue subj=system_u:system_r:geoclue_t:s0 key=(null) 
type=AVC msg=audit(03/30/2023 14:28:23.473:571) : avc:  denied  { watch } for  pid=1876 comm=geoclue path=/etc dev="vda2" ino=131078 scontext=system_u:system_r:geoclue_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=0 
----
type=PROCTITLE msg=audit(03/30/2023 14:28:23.478:573) : proctitle=/usr/libexec/geoclue 
type=PATH msg=audit(03/30/2023 14:28:23.478:573) : item=0 name=/proc/sys/net/ipv6/conf/all/disable_ipv6 nametype=UNKNOWN cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(03/30/2023 14:28:23.478:573) : cwd=/ 
type=SYSCALL msg=audit(03/30/2023 14:28:23.478:573) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=AT_FDCWD a1=0x7fd5913fbfb0 a2=O_RDONLY|O_NOCTTY|O_CLOEXEC a3=0x0 items=1 ppid=1 pid=1876 auid=unset uid=geoclue gid=geoclue euid=geoclue suid=geoclue fsuid=geoclue egid=geoclue sgid=geoclue fsgid=geoclue tty=(none) ses=unset comm=pool-geoclue exe=/usr/libexec/geoclue subj=system_u:system_r:geoclue_t:s0 key=(null) 
type=AVC msg=audit(03/30/2023 14:28:23.478:573) : avc:  denied  { search } for  pid=1876 comm=pool-geoclue name=net dev="proc" ino=25184 scontext=system_u:system_r:geoclue_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=dir permissive=0 
----

# rpm -qa selinux\* geoclue\* | sort
geoclue2-2.7.0-1.fc39.x86_64
selinux-policy-38.9-1.fc39.noarch
selinux-policy-targeted-38.9-1.fc39.noarch
#

Comment 7 Milos Malik 2023-03-30 18:31:56 UTC
Caught in permissive mode:
----
type=PROCTITLE msg=audit(03/30/2023 14:30:55.141:593) : proctitle=/usr/libexec/geoclue 
type=PATH msg=audit(03/30/2023 14:30:55.141:593) : item=0 name=/etc inode=131078 dev=fc:02 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(03/30/2023 14:30:55.141:593) : cwd=/ 
type=SYSCALL msg=audit(03/30/2023 14:30:55.141:593) : arch=x86_64 syscall=inotify_add_watch success=yes exit=1 a0=0x9 a1=0x5585a6485380 a2=0x1002fce a3=0x4 items=1 ppid=1 pid=1903 auid=unset uid=geoclue gid=geoclue euid=geoclue suid=geoclue fsuid=geoclue egid=geoclue sgid=geoclue fsgid=geoclue tty=(none) ses=unset comm=geoclue exe=/usr/libexec/geoclue subj=system_u:system_r:geoclue_t:s0 key=(null) 
type=AVC msg=audit(03/30/2023 14:30:55.141:593) : avc:  denied  { watch } for  pid=1903 comm=geoclue path=/etc dev="vda2" ino=131078 scontext=system_u:system_r:geoclue_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=1 
----
type=PROCTITLE msg=audit(03/30/2023 14:30:55.145:595) : proctitle=/usr/libexec/geoclue 
type=PATH msg=audit(03/30/2023 14:30:55.145:595) : item=0 name=/proc/sys/net/ipv6/conf/all/disable_ipv6 inode=25298 dev=00:32 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:sysctl_net_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(03/30/2023 14:30:55.145:595) : cwd=/ 
type=SYSCALL msg=audit(03/30/2023 14:30:55.145:595) : arch=x86_64 syscall=openat success=yes exit=10 a0=AT_FDCWD a1=0x7fcc41ffbfb0 a2=O_RDONLY|O_NOCTTY|O_CLOEXEC a3=0x0 items=1 ppid=1 pid=1903 auid=unset uid=geoclue gid=geoclue euid=geoclue suid=geoclue fsuid=geoclue egid=geoclue sgid=geoclue fsgid=geoclue tty=(none) ses=unset comm=pool-geoclue exe=/usr/libexec/geoclue subj=system_u:system_r:geoclue_t:s0 key=(null) 
type=AVC msg=audit(03/30/2023 14:30:55.145:595) : avc:  denied  { open } for  pid=1903 comm=pool-geoclue path=/proc/sys/net/ipv6/conf/all/disable_ipv6 dev="proc" ino=25298 scontext=system_u:system_r:geoclue_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file permissive=1 
type=AVC msg=audit(03/30/2023 14:30:55.145:595) : avc:  denied  { read } for  pid=1903 comm=pool-geoclue name=disable_ipv6 dev="proc" ino=25298 scontext=system_u:system_r:geoclue_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file permissive=1 
type=AVC msg=audit(03/30/2023 14:30:55.145:595) : avc:  denied  { search } for  pid=1903 comm=pool-geoclue name=net dev="proc" ino=25294 scontext=system_u:system_r:geoclue_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=dir permissive=1 
----
type=PROCTITLE msg=audit(03/30/2023 14:30:55.145:596) : proctitle=/usr/libexec/geoclue 
type=PATH msg=audit(03/30/2023 14:30:55.145:596) : item=0 name= inode=25298 dev=00:32 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:sysctl_net_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(03/30/2023 14:30:55.145:596) : cwd=/ 
type=SYSCALL msg=audit(03/30/2023 14:30:55.145:596) : arch=x86_64 syscall=newfstatat success=yes exit=0 a0=0xa a1=0x7fcc4435cb8e a2=0x7fcc41ffc010 a3=0x1000 items=1 ppid=1 pid=1903 auid=unset uid=geoclue gid=geoclue euid=geoclue suid=geoclue fsuid=geoclue egid=geoclue sgid=geoclue fsgid=geoclue tty=(none) ses=unset comm=pool-geoclue exe=/usr/libexec/geoclue subj=system_u:system_r:geoclue_t:s0 key=(null) 
type=AVC msg=audit(03/30/2023 14:30:55.145:596) : avc:  denied  { getattr } for  pid=1903 comm=pool-geoclue path=/proc/sys/net/ipv6/conf/all/disable_ipv6 dev="proc" ino=25298 scontext=system_u:system_r:geoclue_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file permissive=1 
----

Comment 8 Zdenek Pytela 2023-03-30 19:37:52 UTC
*** Bug 2183296 has been marked as a duplicate of this bug. ***

Comment 9 Zdenek Pytela 2023-03-30 19:38:02 UTC
*** Bug 2183298 has been marked as a duplicate of this bug. ***

Comment 10 Kalev Lember 2023-03-31 10:48:43 UTC
Thanks for the quick fix, Zdenek!

Comment 11 Zdenek Pytela 2023-03-31 10:55:31 UTC
I am glad we can proactively address a bz reported like this. Policy will probably be updated after GA.

Comment 12 Zdenek Pytela 2023-03-31 10:55:48 UTC
*** Bug 2183315 has been marked as a duplicate of this bug. ***

Comment 13 Kalev Lember 2023-03-31 10:59:49 UTC
(In reply to Zdenek Pytela from comment #11)
> I am glad we can proactively address a bz reported like this. Policy will
> probably be updated after GA.

Works for me. I'll submit the geoclue2 update again once we have the updated policy in the repos.

Comment 14 Christian Labisch 2023-03-31 11:45:34 UTC
Thank you very much @Kalev and @Zdenek for having addressed the issue so quick - that's collaboration at its best ... awesome !

Comment 15 Zdenek Pytela 2023-03-31 13:31:12 UTC
*** Bug 2183310 has been marked as a duplicate of this bug. ***

Comment 16 Zdenek Pytela 2023-04-03 10:10:20 UTC
*** Bug 2183551 has been marked as a duplicate of this bug. ***

Comment 17 Zdenek Pytela 2023-04-03 10:10:32 UTC
*** Bug 2183553 has been marked as a duplicate of this bug. ***

Comment 18 Zdenek Pytela 2023-04-03 15:04:13 UTC
*** Bug 2183709 has been marked as a duplicate of this bug. ***

Comment 19 Zdenek Pytela 2023-04-05 06:30:22 UTC
*** Bug 2184515 has been marked as a duplicate of this bug. ***

Comment 20 Zdenek Pytela 2023-04-05 06:30:39 UTC
*** Bug 2184532 has been marked as a duplicate of this bug. ***

Comment 21 Zdenek Pytela 2023-04-05 06:30:53 UTC
*** Bug 2184528 has been marked as a duplicate of this bug. ***

Comment 22 Fedora Update System 2023-04-05 08:39:09 UTC
FEDORA-2023-9e48ecef73 has been submitted as an update to Fedora 38. https://bodhi.fedoraproject.org/updates/FEDORA-2023-9e48ecef73

Comment 23 Fedora Update System 2023-04-06 01:48:03 UTC
FEDORA-2023-9e48ecef73 has been pushed to the Fedora 38 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-9e48ecef73

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 24 Zdenek Pytela 2023-04-12 12:33:37 UTC
*** Bug 2184732 has been marked as a duplicate of this bug. ***

Comment 25 Fedora Update System 2023-04-15 02:06:51 UTC
FEDORA-2023-9e48ecef73 has been pushed to the Fedora 38 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 26 Zdenek Pytela 2023-04-17 16:02:33 UTC
*** Bug 2186963 has been marked as a duplicate of this bug. ***

Comment 27 Zdenek Pytela 2023-04-17 16:02:54 UTC
*** Bug 2186964 has been marked as a duplicate of this bug. ***

Comment 28 Zdenek Pytela 2023-04-17 16:03:08 UTC
*** Bug 2186966 has been marked as a duplicate of this bug. ***

Comment 29 Zdenek Pytela 2023-04-18 06:47:32 UTC
*** Bug 2187432 has been marked as a duplicate of this bug. ***

Comment 30 Zdenek Pytela 2023-04-18 11:38:52 UTC
*** Bug 2187657 has been marked as a duplicate of this bug. ***


Note You need to log in before you can comment on or make changes to this bug.