Bug 2277355 - Spammed by abrtdumpjourn write errors
Summary: Spammed by abrtdumpjourn write errors
Keywords:
Status: CLOSED DUPLICATE of bug 2265927
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: rawhide
Hardware: Unspecified
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-04-26 13:12 UTC by Cristian Le
Modified: 2024-04-26 15:16 UTC (History)
8 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2024-04-26 15:16:46 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Cristian Le 2024-04-26 13:12:05 UTC
SETroubleshoot details:
```
SELinux is preventing abrt-dump-journ from write access on the sock_file io.systemd.Machine.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that abrt-dump-journ should be allowed write access on the io.systemd.Machine sock_file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'abrt-dump-journ' --raw | audit2allow -M my-abrtdumpjourn
# semodule -X 300 -i my-abrtdumpjourn.pp

Additional Information:
Source Context                system_u:system_r:abrt_dump_oops_t:s0
Target Context                system_u:object_r:systemd_userdbd_runtime_t:s0
Target Objects                io.systemd.Machine [ sock_file ]
Source                        abrt-dump-journ
Source Path                   abrt-dump-journ
Port                          <Unknown>
Host                          cfelm-pcx33660
Source RPM Packages           
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-40.16-1.fc40.noarch
Local Policy RPM              selinux-policy-targeted-40.16-1.fc40.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     cfelm-pcx33660
Platform                      Linux cfelm-pcx33660 6.8.7-300.fc40.x86_64 #1 SMP
                              PREEMPT_DYNAMIC Wed Apr 17 19:21:08 UTC 2024
                              x86_64
Alert Count                   1020
First Seen                    2024-03-26 20:12:48 CET
Last Seen                     2024-04-26 14:34:06 CEST
Local ID                      998e790d-7550-4662-ad99-12be70db7276

Raw Audit Messages
type=AVC msg=audit(1714134846.390:401): avc:  denied  { write } for  pid=1300 comm="abrt-dump-journ" name="io.systemd.Machine" dev="tmpfs" ino=2445 scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=0


Hash: abrt-dump-journ,abrt_dump_oops_t,systemd_userdbd_runtime_t,sock_file,write
```

One curious thing reported on the Fedora Devel matrix room:
"Not sure why a journal dumper is talking to that rather than journald though"

Reproducible: Sometimes

Steps to Reproduce:
Probably not very reproducible, but here is how I've encountered it

1. Open Dataspell (jupyter notebook IDE by Jetbrains)
2. Start the Jupyter server and run the first cell. No errors or SELinux so far
3. Run the whole notebook, still not able to reproduce
4. Restart everything and try to run it all very fast to get memory issues and stuff
5. Get flooded by SELinux reports like those above

Comment 1 Zdenek Pytela 2024-04-26 15:16:46 UTC

*** This bug has been marked as a duplicate of bug 2265927 ***


Note You need to log in before you can comment on or make changes to this bug.