Bug 2252796 - SELinux is preventing systemd-sleep from 'add_name/write/read/setattr/create/' accesses on the dir /sys/firmware/efi/efivars.
Summary: SELinux is preventing systemd-sleep from 'add_name/write/read/setattr/create/...
Keywords:
Status: CLOSED DUPLICATE of bug 2249928
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 39
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-12-04 18:07 UTC by rodin-ia
Modified: 2023-12-05 10:19 UTC (History)
8 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2023-12-05 10:19:09 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description rodin-ia 2023-12-04 18:07:14 UTC
An error 'Failed to set EFI variable HibernateLocation: Operation not allowed' occurred when trying to enter hibernate mode.

The error occurred because the process does not have permissions:
audit[3034]: AVC avc: denied { setattr } for pid=3034 comm="systemd-sleep" path="/sys/firmware/efi/efivars/HibernateLocation-8cf2644b-4b0b-428f-9387-6d876050dc>

After granting access, hibernation worked.
Access errors were also recorded when going into hibernation, but they did not cause any problems. 
AVC avc: denied { write } for pid=2594 comm="systemd-sleep" name="/" dev="efivarfs" ino=130 scontext=system_u:system_r:systemd_sleep_t:s0 tcontext>

AVC avc: denied { add_name } for pid=2751 comm="systemd-sleep" name="HibernateLocation-8cf2644b-4b0b-428f-9387-6d87605050dc67" scontext=system_u:sys>

AVC avc: denied { create } for pid=2720 comm="systemd-sleep" name="HibernateLocation-8cf2644b-4b0b-428f-9387-6d87605050dc67" scontext=system_u:syste>

After fixing all the errors, an enabling policy was generated:
ausearch -c 'systemd-sleep' --raw | audit2allow 

require {
	type efivarfs_t;
	type systemd_sleep_t;
	class file { create read setattr };
	class dir { add_name write }
}
#============= systemd_sleep_t ==============
#!!!! This avc is allowed in the current policy
allow systemd_sleep_t efivarfs_t:dir { add_name write };
#!!!! This avc is allowed in the current policy
allow systemd_sleep_t efivarfs_t:file { read setattr };
allow systemd_sleep_t efivarfs_t:file create;

Pay attention to bug 2240320, there was a similar situation there, but in my case those rights were not enough.

Reproducible: Always

Steps to Reproduce:
1.Freshly installed f39
2.Creating a swap partition, and specifying it in fstab.
3.zram disabled
4.set kernel parameter resume=UUUID=XXXXXXXX, where XXXXXX is the UUID of the swap partition;
5.integrated "resume" module in initrd.
6.Mounted partition (user files) on second ssd via dolphin interface

Comment 1 Zdenek Pytela 2023-12-05 10:19:09 UTC

*** This bug has been marked as a duplicate of bug 2249928 ***


Note You need to log in before you can comment on or make changes to this bug.