Fedora Account System
Red Hat Associate
Red Hat Customer
We came across this Avc denial error in the Continuous Integration test of our PR - https://github.com/coreos/fedora-coreos-config/pull/3010 With selinux-policy-41.2-1.fc41 pkg on the latest rawhide build , it is hitting an avc denial in our test as follows: CI Test - https://jenkins-coreos-ci.apps.ocp.fedoraproject.org/blue/organizations/jenkins/fedora-coreos-config/detail/PR-3010/3/pipeline/ Welcome to ^[[0;38;2;60;110;180mFedora CoreOS 41.20240614.dev.1^[[0m!^M [ 7.356120] systemd[1]: Initializing machine ID from VM UUID.^M [ 7.509477] systemd[1]: bpf-restrict-fs: LSM BPF program attached^M [ 7.518340] audit: type=1400 audit(1718407618.972:4): avc: denied { map } for pid=1234 comm="coreos-boot-mou" path="/usr/bin/bash" dev="vda4" ino=7191409 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file permissive=1^M [ 7.523419] audit: type=1400 audit(1718407618.976:5): avc: denied { execute } for pid=1234 comm="coreos-boot-mou" path="/usr/bin/bash" dev="vda4" ino=7191409 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file permissive=1^M [ 7.541032] audit: type=1400 audit(1718407618.995:6): avc: denied { read } for pid=1236 comm="coreos-liveiso-" name="passwd" dev="vda4" ino=2784580 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file permissive=1^M [ 7.546177] audit: type=1400 audit(1718407618.998:7): avc: denied { open } for pid=1236 comm="coreos-liveiso-" path="/etc/passwd" dev="vda4" ino=2784580 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file permissive=1^M[ 7.548641] audit: type=1400 audit(1718407618.998:8): avc: denied { getattr } for pid=1236 comm="coreos-liveiso-" path="/etc/passwd" dev="vda4" ino=2784580 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file permissive=1^M [ 7.556476] audit: type=1400 audit(1718407619.011:9): avc: denied { execute } for pid=1234 comm="coreos-boot-mou" name="findmnt" dev="vda4" ino=7350721 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=1^M [ 7.561431] audit: type=1400 audit(1718407619.016:10): avc: denied { execute_no_trans } for pid=1245 comm="coreos-boot-mou" path="/usr/bin/findmnt" dev="vda4" ino=7350721 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=1^M [ 7.566215] audit: type=1400 audit(1718407619.020:11): avc: denied { map } for pid=1245 comm="findmnt" path="/usr/bin/findmnt" dev="vda4" ino=7350721 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=1^M [ 7.676457] zram_generator::config[1272]: No configuration found.^M Reproducible: Always Actual Results: coreos-boot-mount-generator is unable to read /etc/passwd due to SELinux violations. Expected Results: No such avc denials expected
Here's the full set of denials we're seeing (with `enforcing=0`): ``` Jun 18 19:26:29 localhost kernel: audit: type=1400 audit(1718738789.435:3): avc: denied { map } for pid=1527 comm="coreos-boot-mou" path="/usr/bin/bash" dev="vda4" ino=401790 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file permissive=1 Jun 18 19:26:29 localhost kernel: audit: type=1400 audit(1718738789.435:4): avc: denied { execute } for pid=1527 comm="coreos-boot-mou" path="/usr/bin/bash" dev="vda4" ino=401790 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file permissive=1 Jun 18 19:26:29 localhost kernel: audit: type=1400 audit(1718738789.443:5): avc: denied { read } for pid=1527 comm="coreos-boot-mou" name="passwd" dev="vda4" ino=393019 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file permissive=1 Jun 18 19:26:29 localhost kernel: audit: type=1400 audit(1718738789.443:6): avc: denied { open } for pid=1527 comm="coreos-boot-mou" path="/etc/passwd" dev="vda4" ino=393019 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file permissive=1 Jun 18 19:26:29 localhost kernel: audit: type=1400 audit(1718738789.443:7): avc: denied { getattr } for pid=1527 comm="coreos-boot-mou" path="/etc/passwd" dev="vda4" ino=393019 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file permissive=1 Jun 18 19:26:29 localhost kernel: audit: type=1400 audit(1718738789.443:8): avc: denied { write } for pid=1527 comm="coreos-boot-mou" name="kmsg" dev="devtmpfs" ino=10 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:kmsg_device_t:s0 tclass=chr_file permissive=1 Jun 18 19:26:29 localhost kernel: audit: type=1400 audit(1718738789.443:9): avc: denied { open } for pid=1527 comm="coreos-boot-mou" path="/dev/kmsg" dev="devtmpfs" ino=10 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:kmsg_device_t:s0 tclass=chr_file permissive=1 Jun 18 19:26:29 localhost kernel: audit: type=1400 audit(1718738789.443:10): avc: denied { execute } for pid=1527 comm="coreos-boot-mou" name="findmnt" dev="vda4" ino=3957450 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=1 Jun 18 19:26:29 localhost kernel: audit: type=1400 audit(1718738789.444:11): avc: denied { execute_no_trans } for pid=1556 comm="coreos-boot-mou" path="/usr/bin/findmnt" dev="vda4" ino=3957450 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=1 Jun 18 19:26:29 localhost audit[1627]: AVC avc: denied { write } for pid=1627 comm="systemd-nsresou" name="memory.pressure" dev="cgroup2" ino=4107 scontext=system_u:system_r:systemd_nsresourced_t:s0 tcontext=system_u:object_r:cgroup_t:s0 tclass=file permissive=1 Jun 18 19:26:30 localhost audit[1763]: AVC avc: denied { connectto } for pid=1763 comm="(resolved)" path="/run/systemd/io.systemd.NamespaceResource" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:systemd_nsresourced_t:s0 tclass=unix_stream_socket permissive=1 Jun 18 19:26:31 localhost audit[1907]: AVC avc: denied { connectto } for pid=1907 comm="(m-ostree)" path="/run/systemd/io.systemd.NamespaceResource" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:systemd_nsresourced_t:s0 tclass=unix_stream_socket permissive=1 Jun 18 19:26:31 cosa-devsh audit[2029]: AVC avc: denied { connectto } for pid=2029 comm="(zincati)" path="/run/systemd/io.systemd.NamespaceResource" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:systemd_nsresourced_t:s0 tclass=unix_stream_socket permissive=1 Jun 18 19:26:31 cosa-devsh audit[2022]: AVC avc: denied { write } for pid=2022 comm="agetty" name="io.systemd.NamespaceResource" dev="tmpfs" ino=1270 scontext=system_u:system_r:getty_t:s0-s0:c0.c1023 tcontext=system_u:object_r:init_var_run_t:s0 tclass=sock_file permissive=1 Jun 18 19:26:31 cosa-devsh audit[2022]: AVC avc: denied { connectto } for pid=2022 comm="agetty" path="/run/systemd/io.systemd.NamespaceResource" scontext=system_u:system_r:getty_t:s0-s0:c0.c1023 tcontext=system_u:system_r:systemd_nsresourced_t:s0 tclass=unix_stream_socket permissive=1 Jun 18 19:26:31 cosa-devsh audit[2022]: AVC avc: denied { connectto } for pid=2022 comm="login" path="/run/systemd/io.systemd.NamespaceResource" scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:system_r:systemd_nsresourced_t:s0 tclass=unix_stream_socket permissive=1 Jun 18 19:26:31 cosa-devsh audit[2097]: AVC avc: denied { connectto } for pid=2097 comm="(systemd)" path="/run/systemd/io.systemd.NamespaceResource" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:systemd_nsresourced_t:s0 tclass=unix_stream_socket permissive=1 ``` The agetty and login related ones I think are the most important; they prevent any login into the system. This is with systemd-256-1.fc41.x86_64. The `coreos-boot-mount-generator` is owned by the CoreOS team: https://github.com/coreos/fedora-coreos-config/blob/testing-devel/overlay.d/05core/usr/lib/systemd/system-generators/coreos-boot-mount-generator. I'm not sure where the /etc/passwd access requests are coming from. I don't think they're from that script directly, but may be from bash itself?
Created attachment 2037743 [details] journal.txt
Some overlap I think with https://bugzilla.redhat.com/show_bug.cgi?id=2290482, but some denials are also specific to CoreOS (e.g. the "coreos-boot-mount" ones). Any updates on this? We're currently pinning on systemd-255 in FCOS rawhide.
Can you try coprbuild from the pr draft? https://github.com/fedora-selinux/selinux-policy/pull/2224/checks
@aaradhak will test it.
The avc denial error is found to persist on trying with the selinux-policy-41.7-1.20240709170751833112.pr2224.13.ga60adc5a3.fc41.noarch & selinux-policy-targeted-41.7-1.20240709170751833112.pr2224.13.ga60adc5a3.fc41.noarch pkgs from the copr build. Welcome to ^[[0;38;2;60;110;180mFedora CoreOS 41.20240710.dev.2^[[0m!^M ^M^M [ 5.437279] systemd[1]: Initializing machine ID from VM UUID.^M [ 5.664465] systemd[1]: bpf-restrict-fs: LSM BPF program attached^M [ 5.671179] audit: type=1400 audit(1720583335.409:4): avc: denied { map } for pid=1342 comm="coreos-sulogin-" path="/usr/bin/bash" dev="vda4" ino=3946774 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file permissive=1^M [ 5.672711] audit: type=1400 audit(1720583335.409:5): avc: denied { execute } for pid=1342 comm="coreos-sulogin-" path="/usr/bin/bash" dev="vda4" ino=3946774 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file permissive=1^M [ 5.687195] audit: type=1400 audit(1720583335.426:6): avc: denied { read } for pid=1341 comm="coreos-liveiso-" name="passwd" dev="vda4" ino=773179 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file permissive=1^M [ 5.690790] audit: type=1400 audit(1720583335.428:7): avc: denied { open } for pid=1341 comm="coreos-liveiso-" path="/etc/passwd" dev="vda4" ino=773179 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file permissive=1^M [ 5.692226] audit: type=1400 audit(1720583335.428:8): avc: denied { getattr } for pid=1341 comm="coreos-liveiso-" path="/etc/passwd" dev="vda4" ino=773179 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file permissive=1^M [ 5.693627] audit: type=1400 audit(1720583335.429:9): avc: denied { write } for pid=1342 comm="coreos-sulogin-" name="kmsg" dev="devtmpfs" ino=10 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:kmsg_device_t:s0 tclass=chr_file permissive=1^M [ 5.695025] audit: type=1400 audit(1720583335.429:10): avc: denied { open } for pid=1342 comm="coreos-sulogin-" path="/dev/kmsg" dev="devtmpfs" ino=10 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:kmsg_device_t:s0 tclass=chr_file permissive=1^M [ 5.704106] audit: type=1400 audit(1720583335.443:11): avc: denied { write } for pid=1339 comm="coreos-boot-mou" name="generator" dev="tmpfs" ino=1202 scontext=system_u:system_r:coreos_bootmount_generator_t:s0 tcontext=system_u:object_r:systemd_unit_file_t:s0 tclass=dir permissive=1^M [ 5.746887] zram_generator::config[1371]: No configuration found.^M
Ash, can you show the full list of denials with the `enforcing=0` karg?
There are 2 additional generators in the last comment which were not reported previously. The selinux-policy PR has been updated, it should suffice to dnf clean metadata and update. All generators are temporarily set to permissive mode.
The build seemed to have failed in the PR draft - https://github.com/fedora-selinux/selinux-policy/pull/2224/checks?check_run_id=27273968182 I tried testing it after a dnf clean metadata & update, the test seem to be failing still with the same avc denial failure Welcome to ^[[0;38;2;60;110;180mFedora CoreOS 41.20240710.dev.3^[[0m!^M ^M^M [ 5.487651] systemd[1]: Initializing machine ID from VM UUID.^M [ 5.728471] systemd[1]: bpf-restrict-fs: LSM BPF program attached^M [ 5.733305] audit: type=1400 audit(1720641679.487:4): avc: denied { map } for pid=1341 comm="coreos-liveiso-" path="/usr/bin/bash" dev="vda4" ino=745234 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file permissive=1^M [ 5.736293] audit: type=1400 audit(1720641679.489:5): avc: denied { execute } for pid=1342 comm="coreos-sulogin-" path="/usr/bin/bash" dev="vda4" ino=745234 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file permissive=1^M [ 5.752966] audit: type=1400 audit(1720641679.507:6): avc: denied { read } for pid=1341 comm="coreos-liveiso-" name="passwd" dev="vda4" ino=977639 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file permissive=1^M [ 5.755833] audit: type=1400 audit(1720641679.509:7): avc: denied { open } for pid=1341 comm="coreos-liveiso-" path="/etc/passwd" dev="vda4" ino=977639 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file permissive=1^M [ 5.757243] audit: type=1400 audit(1720641679.509:8): avc: denied { getattr } for pid=1341 comm="coreos-liveiso-" path="/etc/passwd" dev="vda4" ino=977639 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file permissive=1^M [ 5.758640] audit: type=1400 audit(1720641679.509:9): avc: denied { write } for pid=1342 comm="coreos-sulogin-" name="kmsg" dev="devtmpfs" ino=10 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:kmsg_device_t:s0 tclass=chr_file permissive=1^M [ 5.760016] audit: type=1400 audit(1720641679.509:10): avc: denied { open } for pid=1342 comm="coreos-sulogin-" path="/dev/kmsg" dev="devtmpfs" ino=10 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:kmsg_device_t:s0 tclass=chr_file permissive=1^M [ 5.767482] audit: type=1400 audit(1720641679.521:11): avc: denied { write } for pid=1339 comm="coreos-boot-mou" name="generator" dev="tmpfs" ino=1204 scontext=system_u:system_r:coreos_bootmount_generator_t:s0 tcontext=system_u:object_r:systemd_unit_file_t:s0 tclass=dir permissive=1^M [ 5.811967] zram_generator::config[1369]: No configuration found.^M [ 5.825993] Guest personality initialized and is inactive^M [ 5.827183] VMCI host device registered (name=vmci, major=10, minor=123)^M [ 5.827577] Initialized host personality^M [ 5.834905] NET: Registered PF_VSOCK protocol family^M [ 6.020120] systemd[1]: Populated /etc with preset unit settings.^M [ 6.136148] systemd[1]: run-credentials-systemd\x2djournald.service.mount: Deactivated successfully.^M [ 6.137009] systemd[1]: initrd-switch-root.service: Deactivated successfully.^M [ 6.137562] systemd[1]: Stopped initrd-switch-root.service - Switch Root.^M
Aashish, Your report still refers to the generic label, so it looks like the copr update was not fully applied. I will merge the current draft which makes the domains permissive to gather all denials.
Aashish, Can you try the latest rawhide build? https://bodhi.fedoraproject.org/updates/FEDORA-2024-3510bbb1bb More updates will follow.
Thanks! I opened https://github.com/coreos/fedora-coreos-config/pull/3071. CI will test it. (If you have new Koji builds you'd like to test, feel free to open a similar PR too to have CI run on it.)
Zdenek, I checked with selinux-policy-41.9-1.fc41 and the issue still persists. Adding the avc denials that is observed in the test. Welcome to ^[[0;38;2;60;110;180mFedora CoreOS 41.20240718.dev.1^[[0m!^M ^M^M [ 12.445618] systemd[1]: Initializing machine ID from VM UUID.^M [ 12.695011] systemd[1]: bpf-restrict-fs: LSM BPF program attached^M [ 12.711656] audit: type=1400 audit(1721338923.118:4): avc: denied { map } for pid=1346 comm="coreos-sulogin-" path="/usr/bin/bash" dev="vda4" ino=5202498 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file permissive=1^M [ 12.715850] audit: type=1400 audit(1721338923.118:5): avc: denied { execute } for pid=1346 comm="coreos-sulogin-" path="/usr/bin/bash" dev="vda4" ino=5202498 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file permissive=1^M [ 12.769853] audit: type=1400 audit(1721338923.176:6): avc: denied { read } for pid=1346 comm="coreos-sulogin-" name="passwd" dev="vda4" ino=415079 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file permissive=1^M [ 12.783139] audit: type=1400 audit(1721338923.184:7): avc: denied { open } for pid=1343 comm="coreos-boot-mou" path="/etc/passwd" dev="vda4" ino=415079 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file permissive=1^M [ 12.787002] audit: type=1400 audit(1721338923.184:8): avc: denied { getattr } for pid=1343 comm="coreos-boot-mou" path="/etc/passwd" dev="vda4" ino=415079 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file permissive=1^M [ 12.798924] audit: type=1400 audit(1721338923.203:9): avc: denied { write } for pid=1345 comm="coreos-liveiso-" name="kmsg" dev="devtmpfs" ino=10 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:kmsg_device_t:s0 tclass=chr_file permissive=1^M [ 12.805966] audit: type=1400 audit(1721338923.203:10): avc: denied { open } for pid=1345 comm="coreos-liveiso-" path="/dev/kmsg" dev="devtmpfs" ino=10 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:kmsg_device_t:s0 tclass=chr_file permissive=1^M [ 12.822011] audit: type=1400 audit(1721338923.228:11): avc: denied { execute } for pid=1343 comm="coreos-boot-mou" name="findmnt" dev="vda4" ino=4813532 scontext=system_u:system_r:systemd_generic_generator_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=1^M [ 12.941444] zram_generator::config[1371]: No configuration found.^M [ 13.001859] Guest personality initialized and is inactive^M [ 13.004242] VMCI host device registered (name=vmci, major=10, minor=123)^M [ 13.005371] Initialized host personality^M
Ashish, For some reason the files were not relabeled. You can try the updated copr build https://github.com/fedora-selinux/selinux-policy/pull/2239/checks and then perhaps restorecon -v /usr/lib/systemd/system-generators/coreos* or wait for a new rawhide build.
(In reply to Jonathan Lebon from comment #13) > I opened https://github.com/coreos/fedora-coreos-config/pull/3071. CI will > test it. (If you have new Koji builds you'd like to test, feel free to open > a similar PR too to have CI run on it.) This seems like a good idea. Any way how to run it on copr builds?
(In reply to Zdenek Pytela from comment #16) > (In reply to Jonathan Lebon from comment #13) > > I opened https://github.com/coreos/fedora-coreos-config/pull/3071. CI will > > test it. (If you have new Koji builds you'd like to test, feel free to open > > a similar PR too to have CI run on it.) > This seems like a good idea. Any way how to run it on copr builds? Sure. E.g. assuming you're testing rawhide, you can clone the repo, checkout rawhide, add the COPR repo file, then add the repo name to this list: https://github.com/coreos/fedora-coreos-config/blob/441ccdd5cc3f2e3ac0cb5e8e0bcf71b301a51c7e/manifest.yaml#L7
The last update is now available at: https://github.com/fedora-selinux/selinux-policy/pull/2255/checks
With the update above, the issue was observed to be failing: https://github.com/coreos/fedora-coreos-config/pull/3072