Description of problem: Log in from remote via telent SELinux is preventing in.telnetd from 'search' accesses on the directory net. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that in.telnetd should be allowed search access on the net directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'in.telnetd' --raw | audit2allow -M my-intelnetd # semodule -X 300 -i my-intelnetd.pp Additional Information: Source Context system_u:system_r:telnetd_t:s0 Target Context system_u:object_r:sysctl_net_t:s0 Target Objects net [ dir ] Source in.telnetd Source Path in.telnetd Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-38.11-1.fc38.noarch Local Policy RPM selinux-policy-targeted-38.11-1.fc38.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 6.2.11-300.fc38.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Apr 13 20:27:09 UTC 2023 x86_64 Alert Count 6 First Seen 2022-11-23 18:44:16 CET Last Seen 2023-04-24 13:07:39 CEST Local ID 4982f56b-a9fc-4d70-a500-bfb4cb40c77e Raw Audit Messages type=AVC msg=audit(1682334459.949:7376): avc: denied { search } for pid=29294 comm="in.telnetd" name="net" dev="proc" ino=22653 scontext=system_u:system_r:telnetd_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=dir permissive=0 Hash: in.telnetd,telnetd_t,sysctl_net_t,dir,search Version-Release number of selected component: selinux-policy-targeted-38.11-1.fc38.noarch Additional info: reporter: libreport-2.17.9 reason: SELinux is preventing in.telnetd from 'search' accesses on the directory net. package: selinux-policy-targeted-38.11-1.fc38.noarch component: selinux-policy hashmarkername: setroubleshoot type: libreport kernel: 6.2.11-300.fc38.x86_64 comment: Log in from remote via telent component: selinux-policy
Created attachment 1959511 [details] File: description
Created attachment 1959512 [details] File: os_info
Caught in enforcing mode: ---- type=PROCTITLE msg=audit(04/24/2023 09:28:33.785:919) : proctitle=/usr/sbin/in.telnetd type=PATH msg=audit(04/24/2023 09:28:33.785:919) : item=0 name=/proc/sys/net/ipv6/conf/all/disable_ipv6 nametype=UNKNOWN cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(04/24/2023 09:28:33.785:919) : cwd=/ type=SYSCALL msg=audit(04/24/2023 09:28:33.785:919) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=AT_FDCWD a1=0x7ffc65020440 a2=O_RDONLY|O_NOCTTY|O_CLOEXEC a3=0x0 items=1 ppid=1 pid=7334 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=in.telnetd exe=/usr/sbin/in.telnetd subj=system_u:system_r:telnetd_t:s0 key=(null) type=AVC msg=audit(04/24/2023 09:28:33.785:919) : avc: denied { search } for pid=7334 comm=in.telnetd name=net dev="proc" ino=14581 scontext=system_u:system_r:telnetd_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=dir permissive=0 ---- # rpm -qa selinux\* telnet\* | sort selinux-policy-38.11-1.fc39.noarch selinux-policy-devel-38.11-1.fc39.noarch selinux-policy-targeted-38.11-1.fc39.noarch telnet-0.17-88.fc38.x86_64 telnet-server-0.17-88.fc38.x86_64 #
Caught in permissive mode: ---- type=PROCTITLE msg=audit(04/24/2023 09:32:14.977:1277) : proctitle=/usr/sbin/in.telnetd type=PATH msg=audit(04/24/2023 09:32:14.977:1277) : item=0 name=/proc/sys/net/ipv6/conf/all/disable_ipv6 inode=47317 dev=00:14 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:sysctl_net_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(04/24/2023 09:32:14.977:1277) : cwd=/ type=SYSCALL msg=audit(04/24/2023 09:32:14.977:1277) : arch=x86_64 syscall=openat success=yes exit=5 a0=AT_FDCWD a1=0x7ffe9fac35e0 a2=O_RDONLY|O_NOCTTY|O_CLOEXEC a3=0x0 items=1 ppid=1 pid=12628 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=in.telnetd exe=/usr/sbin/in.telnetd subj=system_u:system_r:telnetd_t:s0 key=(null) type=AVC msg=audit(04/24/2023 09:32:14.977:1277) : avc: denied { open } for pid=12628 comm=in.telnetd path=/proc/sys/net/ipv6/conf/all/disable_ipv6 dev="proc" ino=47317 scontext=system_u:system_r:telnetd_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file permissive=1 type=AVC msg=audit(04/24/2023 09:32:14.977:1277) : avc: denied { read } for pid=12628 comm=in.telnetd name=disable_ipv6 dev="proc" ino=47317 scontext=system_u:system_r:telnetd_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file permissive=1 type=AVC msg=audit(04/24/2023 09:32:14.977:1277) : avc: denied { search } for pid=12628 comm=in.telnetd name=net dev="proc" ino=14581 scontext=system_u:system_r:telnetd_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=dir permissive=1 ---- type=PROCTITLE msg=audit(04/24/2023 09:32:14.977:1278) : proctitle=/usr/sbin/in.telnetd type=PATH msg=audit(04/24/2023 09:32:14.977:1278) : item=0 name= inode=47317 dev=00:14 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:sysctl_net_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(04/24/2023 09:32:14.977:1278) : cwd=/ type=SYSCALL msg=audit(04/24/2023 09:32:14.977:1278) : arch=x86_64 syscall=newfstatat success=yes exit=0 a0=0x5 a1=0x7f726139eb8e a2=0x7ffe9fac3640 a3=0x1000 items=1 ppid=1 pid=12628 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=in.telnetd exe=/usr/sbin/in.telnetd subj=system_u:system_r:telnetd_t:s0 key=(null) type=AVC msg=audit(04/24/2023 09:32:14.977:1278) : avc: denied { getattr } for pid=12628 comm=in.telnetd path=/proc/sys/net/ipv6/conf/all/disable_ipv6 dev="proc" ino=47317 scontext=system_u:system_r:telnetd_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file permissive=1 ---- Tested on 1MT-Fedora-Rawhide.
FEDORA-2023-21649bd3fe has been submitted as an update to Fedora 38. https://bodhi.fedoraproject.org/updates/FEDORA-2023-21649bd3fe
FEDORA-2023-21649bd3fe has been pushed to the Fedora 38 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2023-21649bd3fe` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-21649bd3fe See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2023-21649bd3fe has been pushed to the Fedora 38 stable repository. If problem still persists, please make note of it in this bug report.