Bug 505183 - Crond keeps tripping SELinux
Summary: Crond keeps tripping SELinux
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: cronie
Version: 11
Hardware: All
OS: Linux
low
medium
Target Milestone: ---
Assignee: Marcela Mašláňová
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-06-10 22:08 UTC by pagina_secunda
Modified: 2009-06-12 11:45 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2009-06-12 11:45:46 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Comment 1 pagina_secunda 2009-06-10 22:10:31 UTC
Oops... I didn't mean to include the host name.  Is there any way that the names can be removed from the report?  Sorry about that...

Comment 2 pagina_secunda 2009-06-10 22:17:26 UTC
Also, in case it's important, I'm using cronie-1.2-7.fc11.i586.  Thanks...

Comment 3 Marcela Mašláňová 2009-06-11 07:49:57 UTC
This could be duplicate of #504954. Could you try install this update of selinux-policy? https://admin.fedoraproject.org/updates/F11/FEDORA-2009-5888

Comment 4 pagina_secunda 2009-06-11 14:51:44 UTC
Well, now that's interesting...  The updates didn't seem to help, but I just found a correlation with it throwing the exception and me running yum.  Also, I keep trying to set the enforce level to enforcing, but it throws an exception and everytime I restart it seems to be changed back to permissive.  Is that the same bug, or should I file another bug report?  Thanks.

Comment 5 Marcela Mašláňová 2009-06-11 14:58:43 UTC
Sounds like new bug to me. Dan?

Comment 6 Daniel Walsh 2009-06-11 15:35:53 UTC
I made the bug report private so only you and I can see it.

pagina_secunda can you try to run 

restorecon -R -v /etc/selinux

And see if this reports any changes.  If this does it might indicate you have a mislabeled system.

To relabel the entire system you can execute fixfiles restore, or 
touch /.autorelabel; reboot

Did you upgrade from a previous version of Fedora?

Comment 7 pagina_secunda 2009-06-11 17:39:30 UTC
Yes, I upgraded from F10.  

Here's the results of my attempt to restore the file.  Hopefully this works...  I'll relabel the whole system then reboot to see if there are any changes.  Thanks.

restorecon -R -v /etc/selinux
restorecon reset /etc/selinux/seedit/modules/tmp context system_u:object_r:unlabeled_t:s0->system_u:object_r:etc_selinux_t:s0
restorecon reset /etc/selinux/seedit/modules/tmp/modules context system_u:object_r:unlabeled_t:s0->system_u:object_r:etc_selinux_t:s0
restorecon reset /etc/selinux/semanage.conf context system_u:object_r:selinux_config_t:s0->system_u:object_r:etc_selinux_t:s0
restorecon reset /etc/selinux/targeted/policy/policy.24 context system_u:object_r:semanage_store_t:s0->system_u:object_r:etc_selinux_t:s0
restorecon reset /etc/selinux/targeted/modules/active/seusers.final context system_u:object_r:semanage_store_t:s0->system_u:object_r:etc_selinux_t:s0
restorecon reset /etc/selinux/targeted/modules/active/netfilter_contexts context system_u:object_r:semanage_store_t:s0->system_u:object_r:etc_selinux_t:s0
restorecon reset /etc/selinux/targeted/modules/active/file_contexts.template context system_u:object_r:semanage_store_t:s0->system_u:object_r:etc_selinux_t:s0
restorecon reset /etc/selinux/targeted/modules/active/modules context system_u:object_r:semanage_store_t:s0->system_u:object_r:etc_selinux_t:s0
restorecon reset /etc/selinux/targeted/modules/active/users_extra context system_u:object_r:semanage_store_t:s0->system_u:object_r:etc_selinux_t:s0
restorecon reset /etc/selinux/targeted/contexts/netfilter_contexts context system_u:object_r:default_context_t:s0->system_u:object_r:etc_selinux_t:s0
restorecon reset /etc/selinux/targeted/contexts/files/file_contexts.homedirs context system_u:object_r:file_context_t:s0->system_u:object_r:etc_selinux_t:s0
restorecon reset /etc/selinux/targeted/contexts/files/file_contexts.local context system_u:object_r:file_context_t:s0->system_u:object_r:etc_selinux_t:s0
restorecon reset /etc/selinux/targeted/contexts/files/file_contexts context system_u:object_r:file_context_t:s0->system_u:object_r:etc_selinux_t:s0
restorecon reset /etc/selinux/targeted/seusers context system_u:object_r:selinux_config_t:s0->system_u:object_r:etc_selinux_t:s0
restorecon reset /etc/selinux/restorecond.conf.rpmnew context system_u:object_r:selinux_config_t:s0->system_u:object_r:etc_selinux_t:s0

Comment 8 pagina_secunda 2009-06-11 18:11:52 UTC
Okay, relabeling the system really messed things up.  It kept giving me a bunch of errors on load about how it can't map things (previously there were only two), and now I can't open my email.  I'm not too concerned, because I have all of my data, but is there a good way to fix this?  Thanks.

Comment 9 pagina_secunda 2009-06-11 18:13:23 UTC
I tried running the /.autorelabel; reboot, and I don't know what it did, but it gave me about two messages in the terminal and rebooted straight off.  So then I tried to run the second one, and it gave me this, even though I was running it as a superuser:

fixfiles restore
filespec_add:  conflicting specifications for /var/spool/plymouth/boot.log and /var/log/boot.log, using system_u:object_r:var_log_t:s0.
*****/sbin/setfiles:  unable to stat file /home/Falconus/.gvfs: Permission denied
/sbin/setfiles:  error while labeling /:  Permission denied
/sbin/setfiles:  error while labeling /boot:  Permission denied

Comment 10 Daniel Walsh 2009-06-11 21:42:54 UTC
Did you install seedit?


These are not standard labels.

Please uninstall seedit and use selinux-policy-targeted.

Comment 11 pagina_secunda 2009-06-11 22:03:24 UTC
Ah, okay.  I will try that; thanks.

Comment 12 pagina_secunda 2009-06-11 22:57:58 UTC
Okay, I tried that. Running yum no longer throws an exception, but now I have about 18 different things throwing exceptions everytime I start the computer up.

Comment 13 Daniel Walsh 2009-06-12 11:45:46 UTC
You need to relabel your system

touch /.autorelabel; reboot


Note You need to log in before you can comment on or make changes to this bug.