Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: This io.systemd.Machine related selinux alert on coredump still occurs after I applied https://bodhi.fedoraproject.org/updates/FEDORA-2024-57cdb8429c and rebooted. SELinux is preventing abrt-dump-journ from 'connectto' accesses on the unix_stream_socket /run/systemd/userdb/io.systemd.Machine. ***** Plugin catchall (100. confidence) suggests ************************** abrt-dump-journ に、 io.systemd.Machine unix_stream_socket の connectto アクセスがデフォルトで許可されるべきと考える場合。 Then バグとして報告してください。 ローカルのポリシーモジュールを生成すると、 このアクセスを許可することができます。 Do 以下を実行して、このアクセスを許可します: # ausearch -c 'abrt-dump-journ' --raw | audit2allow -M my-abrtdumpjourn # semodule -X 300 -i my-abrtdumpjourn.pp Additional Information: Source Context system_u:system_r:abrt_dump_oops_t:s0 Target Context system_u:system_r:systemd_machined_t:s0 Target Objects /run/systemd/userdb/io.systemd.Machine [ unix_stream_socket ] Source abrt-dump-journ Source Path abrt-dump-journ Port <不明> Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-40.17-1.fc40.noarch Local Policy RPM selinux-policy-targeted-40.17-1.fc40.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 6.8.7-300.fc40.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Apr 17 19:21:08 UTC 2024 x86_64 Alert Count 2 First Seen 2024-04-29 09:53:36 JST Last Seen 2024-04-29 09:53:36 JST Local ID 7402e203-919c-4524-8c3c-d815fa6c0090 Raw Audit Messages type=AVC msg=audit(1714352016.324:249): avc: denied { connectto } for pid=2471 comm="abrt-dump-journ" path="/run/systemd/userdb/io.systemd.Machine" scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:system_r:systemd_machined_t:s0 tclass=unix_stream_socket permissive=0 Hash: abrt-dump-journ,abrt_dump_oops_t,systemd_machined_t,unix_stream_socket,connectto Version-Release number of selected component: selinux-policy-targeted-40.17-1.fc40.noarch Additional info: reporter: libreport-2.17.15 reason: SELinux is preventing abrt-dump-journ from 'connectto' accesses on the unix_stream_socket /run/systemd/userdb/io.systemd.Machine. package: selinux-policy-targeted-40.17-1.fc40.noarch component: selinux-policy hashmarkername: setroubleshoot type: libreport kernel: 6.8.7-300.fc40.x86_64 comment: This io.systemd.Machine related selinux alert on coredump still occurs after I applied https://bodhi.fedoraproject.org/updates/FEDORA-2024-57cdb8429c and rebooted. component: selinux-policy
Created attachment 2029876 [details] File: description
Created attachment 2029877 [details] File: os_info
*** Bug 2279045 has been marked as a duplicate of this bug. ***
*** Bug 2279104 has been marked as a duplicate of this bug. ***
*** Bug 2279236 has been marked as a duplicate of this bug. ***
FEDORA-2024-759c80369d (selinux-policy-40.18-2.fc40) has been submitted as an update to Fedora 40. https://bodhi.fedoraproject.org/updates/FEDORA-2024-759c80369d
While reproducing this bug, I found that it occurs with Workstation, but not with Xfce. With Workstation: $ rpm -qa selinux\* selinux-policy-40.17-1.fc40.noarch selinux-policy-targeted-40.17-1.fc40.noarch Test command: $ date ; { sleep 60 & } ; sleep 3 ; kill -ABRT %1 ; date Tue May 7 09:43:21 PM UTC 2024 [1] 4308 Tue May 7 09:43:24 PM UTC 2024 $ [1]+ Aborted (core dumped) sleep 60 $ sudo ausearch -ts 21:43 -m avc ---- time->Tue May 7 21:43:25 2024 type=AVC msg=audit(1715118205.191:390): avc: denied { connectto } for pid=875 comm="abrt-dump-journ" path="/run/systemd/userdb/io.systemd.Machine" scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:system_r:systemd_machined_t:s0 tclass=unix_stream_socket permissive=0 ---- time->Tue May 7 21:43:25 2024 type=AVC msg=audit(1715118205.192:391): avc: denied { connectto } for pid=875 comm="abrt-dump-journ" path="/run/systemd/userdb/io.systemd.Home" scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket permissive=0 ---- time->Tue May 7 21:43:25 2024 type=AVC msg=audit(1715118205.194:392): avc: denied { connectto } for pid=875 comm="abrt-dump-journ" path="/run/systemd/userdb/io.systemd.Machine" scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:system_r:systemd_machined_t:s0 tclass=unix_stream_socket permissive=0 ---- time->Tue May 7 21:43:25 2024 type=AVC msg=audit(1715118205.194:393): avc: denied { connectto } for pid=875 comm="abrt-dump-journ" path="/run/systemd/userdb/io.systemd.Home" scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket permissive=0
On Workstation: $ ll /run/systemd/userdb/ total 0 lrwxrwxrwx. 1 root root 42 May 7 21:25 io.systemd.DropIn -> /run/systemd/userdb/io.systemd.Multiplexer srw-rw-rw-. 1 root root 0 May 7 21:25 io.systemd.DynamicUser srw-rw-rw-. 1 root root 0 May 7 21:25 io.systemd.Home srw-rw-rw-. 1 root root 0 May 7 21:25 io.systemd.Machine srw-rw-rw-. 1 root root 0 May 7 21:25 io.systemd.Multiplexer lrwxrwxrwx. 1 root root 42 May 7 21:25 io.systemd.NameServiceSwitch -> /run/systemd/userdb/io.systemd.Multiplexer $ sudo lsof +c 0 |& fgrep Machine systemd-machine 842 root 9u unix 0x000000008f1ef52e 0t0 9924 /run/systemd/userdb/io.systemd.Machine type=STREAM (LISTEN) On Xfce, there is no io.systemd.Machine: $ ll /run/systemd/userdb/ total 0 lrwxrwxrwx. 1 root root 42 May 7 14:54 io.systemd.DropIn -> /run/systemd/userdb/io.systemd.Multiplexer srw-rw-rw-. 1 root root 0 May 7 14:54 io.systemd.DynamicUser srw-rw-rw-. 1 root root 0 May 7 14:54 io.systemd.Home srw-rw-rw-. 1 root root 0 May 7 14:54 io.systemd.Multiplexer lrwxrwxrwx. 1 root root 42 May 7 14:54 io.systemd.NameServiceSwitch -> /run/systemd/userdb/io.systemd.Multiplexer
The difference appears to be in whether systemd-container is installed or not. On Workstation: $ systemctl list-unit-files -a \*systemd-machine\* UNIT FILE STATE PRESET systemd-machine-id-commit.service static - systemd-machined.service static - $ locate systemd-machined.service /usr/lib/systemd/system/systemd-machined.service /usr/share/man/man8/systemd-machined.service.8.gz $ rpm -qf /usr/lib/systemd/system/systemd-machined.service systemd-container-255.4-1.fc40.x86_64 On Xfce: $ rpm -q systemd-container package systemd-container is not installed
FEDORA-2024-759c80369d has been pushed to the Fedora 40 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-759c80369d` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-759c80369d See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2024-759c80369d (selinux-policy-40.18-2.fc40) has been pushed to the Fedora 40 stable repository. If problem still persists, please make note of it in this bug report.