Bug 2322867 - selinux policy violations when asterisk tries to read /proc/sys/net
Summary: selinux policy violations when asterisk tries to read /proc/sys/net
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 41
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Jared Smith
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-10-31 00:06 UTC by Dave Koberstein
Modified: 2025-05-14 01:19 UTC (History)
10 users (show)

Fixed In Version: selinux-policy-41.39-1.fc41
Clone Of:
Environment:
Last Closed: 2025-05-14 01:19:31 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github fedora-selinux selinux-policy pull 2657 0 None open Allow asterisk read network sysctls 2025-04-25 11:46:07 UTC

Description Dave Koberstein 2024-10-31 00:06:51 UTC
This seems to have been around for a while. It was reported in Redhat here: 1810727, which was closed for being reported too late in a release cycle.

pjsip wants to read /proc/sys/net to figure out some networking information to configure itself. This seems to be triggering selinux policy violations. As covered in the bug above this local policy will resolve it:

module my-asterisk 1.0;

require {
        type asterisk_t;
        type sysctl_net_t;
        class dir search;
        class file { getattr open read };
}

#============= asterisk_t ==============
allow asterisk_t sysctl_net_t:dir search;
allow asterisk_t sysctl_net_t:file { getattr open read };

Reproducible: Always

Steps to Reproduce:
1. configure asterisk to use pjsip with a "type = transport" section
2. start asterisk
3. check for selinux policy violations for reading from /proc/sys/net/ipv6 and ipv4
Actual Results:  
I think asterisk is actually running ok. I found these issues by reviewing my journalctl setroubleshoot output.

Expected Results:  
No selinux policy voilations

Comment 1 Dave Koberstein 2025-04-18 16:23:29 UTC
Seems to still be in f42. 

Should this bug be applied to selinux-policy-targeted? I think that's the rpm where it needs to be resolved. I added selinux to the keywords field.

Comment 2 Dave Koberstein 2025-04-24 16:18:47 UTC
I corresponded with Jared and he thought this made more sense assigned to selinux-policy (targeted in my case). So moving the component.

Comment 3 Fedora Update System 2025-05-02 08:11:24 UTC
FEDORA-2025-a84432e770 (selinux-policy-41.39-1.fc41) has been submitted as an update to Fedora 41.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-a84432e770

Comment 4 Fedora Update System 2025-05-03 03:03:27 UTC
FEDORA-2025-a84432e770 has been pushed to the Fedora 41 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-a84432e770`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-a84432e770

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 5 Fedora Update System 2025-05-14 01:19:31 UTC
FEDORA-2025-a84432e770 (selinux-policy-41.39-1.fc41) has been pushed to the Fedora 41 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.