Bug 2387061 - selinux policy doesn't allow chronyc to change UID/GID
Summary: selinux policy doesn't allow chronyc to change UID/GID
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 42
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-08-07 13:04 UTC by Miroslav Lichvar
Modified: 2025-09-08 09:16 UTC (History)
7 users (show)

Fixed In Version: selinux-policy-42.8-1.fc42
Clone Of:
Environment:
Last Closed: 2025-09-07 00:52:15 UTC
Type: ---
Embargoed:
zpytela: mirror+


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github fedora-selinux selinux-policy pull 2856 0 None open Allow chronyc the setgid and setuid capabilities 2025-09-01 14:45:47 UTC
Red Hat Issue Tracker FC-1919 0 None None None 2025-08-07 13:17:15 UTC

Description Miroslav Lichvar 2025-08-07 13:04:53 UTC
The latest development code of chrony has support for dropping root privileges in the chronyc command-line utility to minimize the impact of potential bugs.

The setgroups()/setgid() and setuid() calls are blocked by the current selinux policy. This is what I see in the permissive mode:

type=AVC msg=audit(1754571339.039:1605): avc:  denied  { setgid } for  pid=647878 comm="chronyc" capability=6  scontext=unconfined_u:unconfined_r:chronyc_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chronyc_t:s0-s0:c0.c1023 tclass=capability permissive=1
type=AVC msg=audit(1754571339.039:1606): avc:  denied  { setuid } for  pid=647878 comm="chronyc" capability=7  scontext=unconfined_u:unconfined_r:chronyc_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chronyc_t:s0-s0:c0.c1023 tclass=capability permissive=1


Reproducible: Always

Steps to Reproduce:
1. install chrony from https://copr.fedorainfracloud.org/coprs/mlichvar/chrony/build/9386351/
2. systemctl start chronyd
3. (as root) chronyc -u chrony ntpdata

Actual Results:
setgroups() failed : Operation not permitted

Expected Results:
No errors reported by chronyc and the audit log.

Additional Information:
selinux-policy-42.4-1.fc42.noarch

Comment 1 Fedora Update System 2025-09-04 18:43:33 UTC
FEDORA-2025-3ed36829c6 (selinux-policy-42.8-1.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-3ed36829c6

Comment 2 Fedora Update System 2025-09-05 02:01:38 UTC
FEDORA-2025-3ed36829c6 has been pushed to the Fedora 42 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-3ed36829c6`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-3ed36829c6

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 3 Fedora Update System 2025-09-07 00:52:15 UTC
FEDORA-2025-3ed36829c6 (selinux-policy-42.8-1.fc42) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 4 Miroslav Lichvar 2025-09-08 09:16:46 UTC
It works, thanks!


Note You need to log in before you can comment on or make changes to this bug.