Fedora Account System
Red Hat Associate
Red Hat Customer
Description: In Fedora CoreOS CI we noticed that our kdump.service seem to fail in the `ext.config.kdump.crash` test that is defined here: https://github.com/coreos/fedora-coreos-config/tree/testing-devel/tests/kola/kdump/crash This issue is tracked in the Fedora CoreOS issue tracker at https://github.com/coreos/fedora-coreos-tracker/issues/1560 From the journal log, we can see that the kdump.service fails because of an avc denial: ``` Aug 31 12:56:34.925329 kernel: audit: type=1400 audit(1693486594.923:5): avc: denied { write } for pid=5538 comm="kexec" path=2F6D656D66643A6B65726E656C202864656C6574656429 dev="tmpfs" ino=8 scontext=system_u:system_r:kdump_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file permissive=0 Aug 31 12:56:34.928341 kdump.service[1360]: kdump: kexec: failed to load kdump kernel Aug 31 12:56:34.928341 kdump.service[1360]: kdump: Starting kdump: [FAILED] Aug 31 12:56:34.930701 init.scope[1]: kdump.service: Main process exited, code=exited, status=1/FAILURE Aug 31 12:56:34.931202 init.scope[1]: kdump.service: Failed with result 'exit-code'. Aug 31 12:56:34.934342 init.scope[1]: Failed to start kdump.service - Crash recovery kernel arming. Aug 31 12:56:34.938215 init.scope[1]: Startup finished in 1.124s (kernel) + 4.497s (initrd) + 28.538s (userspace) = 34.160s. Aug 31 12:56:34.938342 init.scope[1]: kdump.service: Consumed 19.389s CPU time. Aug 31 12:56:35.462584 kola-runext.service[4943]: + for _x in {0..60} ``` If we set selinux to permissive mode with `enforcing=0` then we see two denials: ``` Sep 1 15:54:32.042762 kdump.service[1719]: *** Squashing the files inside the initramfs done *** Sep 1 15:54:32.047391 kdump.service[1719]: *** Creating image file '/var/lib/kdump/initramfs-6.6.0-0.rc0.20230830git6c1b980a7e79.1.fc40.x86_64kdump.img' *** Sep 1 15:54:32.350746 kdump.service[1719]: *** Creating initramfs image file '/var/lib/kdump/initramfs-6.6.0-0.rc0.20230830git6c1b980a7e79.1.fc40.x86_64kdump.img' done *** Sep 1 15:54:32.474674 kernel: kexec[5348]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set Sep 1 15:54:32.474876 kernel: audit: type=1400 audit(1693583672.473:4): avc: denied { write } for pid=5348 comm="kexec" path=2F6D656D66643A6B65726E656C202864656C6574656429 dev="tmpfs" ino=8 scontext=system_u:system_r:kdump_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file permissive=1 Sep 1 15:54:32.480666 kernel: audit: type=1400 audit(1693583672.479:5): avc: denied { read } for pid=5348 comm="kexec" path=2F6D656D66643A6B65726E656C202864656C6574656429 dev="tmpfs" ino=8 scontext=system_u:system_r:kdump_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file permissive=1 Sep 1 15:54:32.484689 kernel: PKCS7: Message signed outside of X.509 validity window Sep 1 15:54:32.508762 init.scope[1]: systemd-hostnamed.service: Deactivated successfully. Sep 1 15:54:32.546676 kdump.service[1353]: kdump: kexec: loaded kdump kernel Sep 1 15:54:32.547187 kdump.service[1353]: kdump: Starting kdump: [OK] ``` I have attached the full journal logs from a run on a system with `enforcing=0` set to illustrate all denials. Reproducible: Always Steps to Reproduce: 1. On Fedora rawhide machine with latest package set. 2. Set crashkernel=512M kernel argument and reboot 3. Enable kdump.service 4. Observe failure and SELinux denial. Actual Results: kdump.service doesn’t start Expected Results: kdump.service starts Additional info: rpm -q kernel kexec-tools selinux-policy-targeted kernel-6.6.0-0.rc0.20230830git6c1b980a7e79.1.fc40.x86_64 kexec-tools-2.0.27-1.fc40.x86_64 selinux-policy-targeted-38.26-1.fc40.noarch
We already have a PR resolving the issue
Before the fix was applied, the following SELinux denial appeared in enforcing mode: ---- type=PROCTITLE msg=audit(09/13/2023 07:02:41.422:200) : proctitle=/sbin/kexec -s -d -p --command-line=BOOT_IMAGE=(hd0,gpt2)/boot/vmlinuz-6.6.0-0.rc1.13.fc40.x86_64 ro net.ifnames=0 rhgb irqpoll type=SYSCALL msg=audit(09/13/2023 07:02:41.422:200) : arch=x86_64 syscall=write success=no exit=EACCES(Permission denied) a0=0x3 a1=0x7f9b3a60e010 a2=0xdf1b08 a3=0x22 items=0 ppid=4670 pid=5034 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=kexec exe=/usr/sbin/kexec subj=system_u:system_r:kdump_t:s0 key=(null) type=AVC msg=audit(09/13/2023 07:02:41.422:200) : avc: denied { write } for pid=5034 comm=kexec path=/memfd:kernel (deleted) dev="tmpfs" ino=12 scontext=system_u:system_r:kdump_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file permissive=0 ---- Before the fix was applied, the following SELinux denials appeared in permissive mode: ---- type=PROCTITLE msg=audit(09/13/2023 07:04:23.219:204) : proctitle=/sbin/kexec -s -d -p --command-line=BOOT_IMAGE=(hd0,gpt2)/boot/vmlinuz-6.6.0-0.rc1.13.fc40.x86_64 ro net.ifnames=0 rhgb irqpoll type=SYSCALL msg=audit(09/13/2023 07:04:23.219:204) : arch=x86_64 syscall=write success=yes exit=14621448 a0=0x3 a1=0x7f412be0e010 a2=0xdf1b08 a3=0x22 items=0 ppid=5049 pid=5413 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=kexec exe=/usr/sbin/kexec subj=system_u:system_r:kdump_t:s0 key=(null) type=AVC msg=audit(09/13/2023 07:04:23.219:204) : avc: denied { write } for pid=5413 comm=kexec path=/memfd:kernel (deleted) dev="tmpfs" ino=13 scontext=system_u:system_r:kdump_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file permissive=1 ---- type=PROCTITLE msg=audit(09/13/2023 07:04:23.224:205) : proctitle=/sbin/kexec -s -d -p --command-line=BOOT_IMAGE=(hd0,gpt2)/boot/vmlinuz-6.6.0-0.rc1.13.fc40.x86_64 ro net.ifnames=0 rhgb irqpoll type=SYSCALL msg=audit(09/13/2023 07:04:23.224:205) : arch=x86_64 syscall=kexec_file_load success=yes exit=0 a0=0x3 a1=0x4 a2=0x12f a3=0x556d3db9f9d0 items=0 ppid=5049 pid=5413 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=kexec exe=/usr/sbin/kexec subj=system_u:system_r:kdump_t:s0 key=(null) type=AVC msg=audit(09/13/2023 07:04:23.224:205) : avc: denied { read } for pid=5413 comm=kexec path=/memfd:kernel (deleted) dev="tmpfs" ino=13 scontext=system_u:system_r:kdump_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file permissive=1 ---- # rpm -qa selinux\* kexec\* | sort kexec-tools-2.0.27-1.fc40.x86_64 selinux-policy-38.27-1.fc40.noarch selinux-policy-targeted-38.27-1.fc40.noarch #