Bug 505183 - Crond keeps tripping SELinux
Crond keeps tripping SELinux
Status: CLOSED NOTABUG
Product: Fedora
Classification: Fedora
Component: cronie (Show other bugs)
11
All Linux
low Severity medium
: ---
: ---
Assigned To: Marcela Mašláňová
Fedora Extras Quality Assurance
: SELinux
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2009-06-10 18:08 EDT by pagina_secunda
Modified: 2009-06-12 07:45 EDT (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-06-12 07:45:46 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Comment 1 pagina_secunda 2009-06-10 18:10:31 EDT
Oops... I didn't mean to include the host name.  Is there any way that the names can be removed from the report?  Sorry about that...
Comment 2 pagina_secunda 2009-06-10 18:17:26 EDT
Also, in case it's important, I'm using cronie-1.2-7.fc11.i586.  Thanks...
Comment 3 Marcela Mašláňová 2009-06-11 03:49:57 EDT
This could be duplicate of #504954. Could you try install this update of selinux-policy? https://admin.fedoraproject.org/updates/F11/FEDORA-2009-5888
Comment 4 pagina_secunda 2009-06-11 10:51:44 EDT
Well, now that's interesting...  The updates didn't seem to help, but I just found a correlation with it throwing the exception and me running yum.  Also, I keep trying to set the enforce level to enforcing, but it throws an exception and everytime I restart it seems to be changed back to permissive.  Is that the same bug, or should I file another bug report?  Thanks.
Comment 5 Marcela Mašláňová 2009-06-11 10:58:43 EDT
Sounds like new bug to me. Dan?
Comment 6 Daniel Walsh 2009-06-11 11:35:53 EDT
I made the bug report private so only you and I can see it.

pagina_secunda@yahoo.com can you try to run 

restorecon -R -v /etc/selinux

And see if this reports any changes.  If this does it might indicate you have a mislabeled system.

To relabel the entire system you can execute fixfiles restore, or 
touch /.autorelabel; reboot

Did you upgrade from a previous version of Fedora?
Comment 7 pagina_secunda 2009-06-11 13:39:30 EDT
Yes, I upgraded from F10.  

Here's the results of my attempt to restore the file.  Hopefully this works...  I'll relabel the whole system then reboot to see if there are any changes.  Thanks.

restorecon -R -v /etc/selinux
restorecon reset /etc/selinux/seedit/modules/tmp context system_u:object_r:unlabeled_t:s0->system_u:object_r:etc_selinux_t:s0
restorecon reset /etc/selinux/seedit/modules/tmp/modules context system_u:object_r:unlabeled_t:s0->system_u:object_r:etc_selinux_t:s0
restorecon reset /etc/selinux/semanage.conf context system_u:object_r:selinux_config_t:s0->system_u:object_r:etc_selinux_t:s0
restorecon reset /etc/selinux/targeted/policy/policy.24 context system_u:object_r:semanage_store_t:s0->system_u:object_r:etc_selinux_t:s0
restorecon reset /etc/selinux/targeted/modules/active/seusers.final context system_u:object_r:semanage_store_t:s0->system_u:object_r:etc_selinux_t:s0
restorecon reset /etc/selinux/targeted/modules/active/netfilter_contexts context system_u:object_r:semanage_store_t:s0->system_u:object_r:etc_selinux_t:s0
restorecon reset /etc/selinux/targeted/modules/active/file_contexts.template context system_u:object_r:semanage_store_t:s0->system_u:object_r:etc_selinux_t:s0
restorecon reset /etc/selinux/targeted/modules/active/modules context system_u:object_r:semanage_store_t:s0->system_u:object_r:etc_selinux_t:s0
restorecon reset /etc/selinux/targeted/modules/active/users_extra context system_u:object_r:semanage_store_t:s0->system_u:object_r:etc_selinux_t:s0
restorecon reset /etc/selinux/targeted/contexts/netfilter_contexts context system_u:object_r:default_context_t:s0->system_u:object_r:etc_selinux_t:s0
restorecon reset /etc/selinux/targeted/contexts/files/file_contexts.homedirs context system_u:object_r:file_context_t:s0->system_u:object_r:etc_selinux_t:s0
restorecon reset /etc/selinux/targeted/contexts/files/file_contexts.local context system_u:object_r:file_context_t:s0->system_u:object_r:etc_selinux_t:s0
restorecon reset /etc/selinux/targeted/contexts/files/file_contexts context system_u:object_r:file_context_t:s0->system_u:object_r:etc_selinux_t:s0
restorecon reset /etc/selinux/targeted/seusers context system_u:object_r:selinux_config_t:s0->system_u:object_r:etc_selinux_t:s0
restorecon reset /etc/selinux/restorecond.conf.rpmnew context system_u:object_r:selinux_config_t:s0->system_u:object_r:etc_selinux_t:s0
Comment 8 pagina_secunda 2009-06-11 14:11:52 EDT
Okay, relabeling the system really messed things up.  It kept giving me a bunch of errors on load about how it can't map things (previously there were only two), and now I can't open my email.  I'm not too concerned, because I have all of my data, but is there a good way to fix this?  Thanks.
Comment 9 pagina_secunda 2009-06-11 14:13:23 EDT
I tried running the /.autorelabel; reboot, and I don't know what it did, but it gave me about two messages in the terminal and rebooted straight off.  So then I tried to run the second one, and it gave me this, even though I was running it as a superuser:

fixfiles restore
filespec_add:  conflicting specifications for /var/spool/plymouth/boot.log and /var/log/boot.log, using system_u:object_r:var_log_t:s0.
*****/sbin/setfiles:  unable to stat file /home/Falconus/.gvfs: Permission denied
/sbin/setfiles:  error while labeling /:  Permission denied
/sbin/setfiles:  error while labeling /boot:  Permission denied
Comment 10 Daniel Walsh 2009-06-11 17:42:54 EDT
Did you install seedit?


These are not standard labels.

Please uninstall seedit and use selinux-policy-targeted.
Comment 11 pagina_secunda 2009-06-11 18:03:24 EDT
Ah, okay.  I will try that; thanks.
Comment 12 pagina_secunda 2009-06-11 18:57:58 EDT
Okay, I tried that. Running yum no longer throws an exception, but now I have about 18 different things throwing exceptions everytime I start the computer up.
Comment 13 Daniel Walsh 2009-06-12 07:45:46 EDT
You need to relabel your system

touch /.autorelabel; reboot

Note You need to log in before you can comment on or make changes to this bug.