This happened already multiple times for different folders, but always with sendmail. This is an fedora38 system, which I upgraded from 37. SELinux is preventing sendmail from open access on the file /proc/sys/net/ipv6/conf/all/disable_ipv6. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that sendmail should be allowed open access on the disable_ipv6 file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'sendmail' --raw | audit2allow -M my-sendmail # semodule -X 300 -i my-sendmail.pp Additional Information: Source Context system_u:system_r:logwatch_mail_t:s0-s0:c0.c1023 Target Context system_u:object_r:sysctl_net_t:s0 Target Objects /proc/sys/net/ipv6/conf/all/disable_ipv6 [ file ] Source sendmail Source Path sendmail Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-38.9-1.fc38.noarch Local Policy RPM selinux-policy-targeted-38.9-1.fc38.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux newcaprica 6.2.8-300.fc38.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Mar 22 19:29:30 UTC 2023 x86_64 Alert Count 1 First Seen 2023-03-30 18:07:02 CEST Last Seen 2023-03-30 18:07:02 CEST Local ID a524d94d-c508-4a43-81e9-dc9acdf0394a Raw Audit Messages type=AVC msg=audit(1680192422.976:513): avc: denied { open } for pid=9788 comm="sendmail" path="/proc/sys/net/ipv6/conf/all/disable_ipv6" dev="proc" ino=33052 scontext=system_u:system_r:logwatch_mail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file permissive=0 Hash: sendmail,logwatch_mail_t,sysctl_net_t,file,open
Hi, Has it happened for different SELinux domains, i. e. other than logwatch_mail_t in the scontext=system_u:system_r:logwatch_mail_t:... record?
No, I don't think so. Unfortunately, I deleted all the old reports.
Thank you for the quick fix, at least upstream :-)
FEDORA-2023-9e48ecef73 has been submitted as an update to Fedora 38. https://bodhi.fedoraproject.org/updates/FEDORA-2023-9e48ecef73
FEDORA-2023-9e48ecef73 has been pushed to the Fedora 38 testing repository. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-9e48ecef73 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2023-9e48ecef73 has been pushed to the Fedora 38 stable repository. If problem still persists, please make note of it in this bug report.
Test coverage for this bug exists in a form of PR: * https://src.fedoraproject.org/tests/selinux/pull-request/496 The PR waits for a review.