Bug 2236394 - avc: denied { create } for pid=993 comm="systemd-network" name=".#networkd734718013635965" scontext=system_u:system_r:systemd_network_generator_t:s0
Summary: avc: denied { create } for pid=993 comm="systemd-network" name=".#networkd...
Keywords:
Status: CLOSED DUPLICATE of bug 2230226
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 39
Hardware: Unspecified
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL: https://cockpit-logs.us-east-1.linode...
Whiteboard: CockpitTest
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-08-31 06:56 UTC by Martin Pitt
Modified: 2023-09-08 22:19 UTC (History)
8 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2023-09-08 22:19:25 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Martin Pitt 2023-08-31 06:56:53 UTC
This is a variant of bug 2223571. This time it's about "create", instead of "sendto" or "write":

audit: type=1400 audit(1693394653.739:4): avc:  denied  { create } for  pid=993 comm="systemd-network" name=".#networkd734718013635965" scontext=system_u:system_r:systemd_network_generator_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=file permissive=0



Reproducible: Sometimes

Steps to Reproduce:
We only saw this once, in a test case that's completely unrelated to network configuration. I. e. this is "magic background activity". But as it's very similar to #2223571, it's hopefully simple to adjust the policy?

Comment 1 Zdenek Pytela 2023-08-31 07:22:26 UTC
This rather seems to be a follow-up to bz#2230226, but I believe it was resolved. What was your selinux-policy version?

Comment 2 Martin Pitt 2023-08-31 07:41:50 UTC
Our image has selinux-policy-38.25-1.fc39.noarch . That's the latest available one from https://bodhi.fedoraproject.org/updates/?packages=selinux-policy. If the bz#2230226 fix didn't land in F39 yet, of course feel free to make this a duplicate. Thanks!

Comment 3 Zdenek Pytela 2023-09-08 22:19:25 UTC
The fix was in selinux-policy-38.25-1.fc39.noarch, but not complex enough. Closing anyway as a dup now that the root cause is (hopefully) disclosed.

*** This bug has been marked as a duplicate of bug 2230226 ***


Note You need to log in before you can comment on or make changes to this bug.