Created attachment 519674 [details] dmesg When booting live image with selinux-policy-targeted-3.10.0-18.fc16.noarch dracut-013-4.fc16.noarch systemd-33-2.fc16.x86_64 udev-173-1.fc16.x86_64 I get: [ 16.592255] type=1400 audit(1314206451.269:4): avc: denied { relabelto } for pid=538 comm="udevd" name="rtc" dev=devtmpfs ino=1326 scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=lnk_file [ 16.592355] type=1400 audit(1314206451.270:5): avc: denied { associate } for pid=538 comm="udevd" name="rtc" dev=devtmpfs ino=1326 scontext=system_u:object_r:default_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=filesystem [ 17.380126] type=1400 audit(1314206452.058:6): avc: denied { associate } for pid=463 comm="udevd" name="live" dev=devtmpfs ino=6778 scontext=system_u:object_r:default_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=filesystem [ 17.382508] udevd[463]: setfilecon /dev/live failed: Permission denied [ 18.537611] systemd-tmpfiles[748]: Successfully loaded SELinux database in 16ms 966us, size on heap is 464K. [ 18.590550] systemd-tmpfiles[748]: Failed to set security context system_u:object_r:var_t:s0 for /var: Permission denied [ 18.602486] systemd-tmpfiles[748]: Failed to set security context system_u:object_r:var_t:s0 for /var: Permission denied [ 18.603547] systemd-tmpfiles[748]: Failed to set security context system_u:object_r:var_t:s0 for /var: Permission denied [ 18.610616] systemd-tmpfiles[748]: Failed to set security context system_u:object_r:var_run_t:s0 for /run: Permission denied [ 18.613431] systemd-tmpfiles[748]: Failed to set security context system_u:object_r:var_run_t:s0 for /run: Permission denied [ 18.615268] systemd-tmpfiles[748]: Failed to set security context system_u:object_r:var_run_t:s0 for /run: Permission denied [ 18.616286] systemd-tmpfiles[748]: Failed to set security context system_u:object_r:var_t:s0 for /var: Permission denied [ 18.617392] systemd-tmpfiles[748]: Failed to set security context system_u:object_r:var_t:s0 for /var: Permission denied [ 18.618274] systemd-tmpfiles[748]: Failed to set security context system_u:object_r:var_t:s0 for /var: Permission denied [ 18.619099] systemd-tmpfiles[748]: Failed to set security context system_u:object_r:var_t:s0 for /var: Permission denied [ 18.619919] systemd-tmpfiles[748]: Failed to set security context system_u:object_r:var_t:s0 for /var: Permission denied [ 18.620572] systemd-tmpfiles[748]: Failed to set security context system_u:object_r:var_t:s0 for /var: Permission denied [ 18.621293] systemd-tmpfiles[748]: Failed to set security context system_u:object_r:var_t:s0 for /var: Permission denied [ 18.622276] systemd-tmpfiles[748]: Failed to set security context system_u:object_r:var_t:s0 for /var: Permission denied [ 18.623425] systemd-tmpfiles[748]: Failed to set security context system_u:object_r:var_run_t:s0 for /run: Permission denied [ 18.631411] systemd-tmpfiles[748]: Failed to set security context system_u:object_r:var_t:s0 for /var: Permission denied [ 18.632045] systemd-tmpfiles[748]: Failed to set security context system_u:object_r:var_t:s0 for /var: Permission denied [ 18.632578] type=1400 audit(1314206453.311:7): avc: denied { write } for pid=748 comm="systemd-tmpfile" name="cache" dev=dm-0 ino=13 scontext=system_u:system_r:systemd_tmpfiles_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=dir [ 18.632696] systemd-tmpfiles[748]: Failed to create directory /var/cache/man: Permission denied [ 18.633078] systemd-tmpfiles[748]: Failed to set security context system_u:object_r:var_run_t:s0 for /run: Permission denied [ 18.634558] systemd-tmpfiles[748]: Failed to set security context system_u:object_r:var_run_t:s0 for /run: Permission denied [ 18.635318] systemd-tmpfiles[748]: Failed to set security context system_u:object_r:var_run_t:s0 for /run: Permission denied [ 18.636119] systemd-tmpfiles[748]: Failed to set security context system_u:object_r:var_run_t:s0 for /run: Permission denied [ 18.636634] systemd-tmpfiles[748]: Failed to set security context system_u:object_r:tmp_t:s0 for /tmp: Permission denied [ 18.642937] systemd-tmpfiles[748]: Failed to set security context system_u:object_r:tmp_t:s0 for /tmp: Permission denied [ 18.645264] systemd-tmpfiles[748]: Failed to set security context system_u:object_r:tmp_t:s0 for /tmp: Permission denied [ 18.647172] systemd-tmpfiles[748]: Failed to set security context system_u:object_r:tmp_t:s0 for /tmp: Permission denied [ 18.649596] systemd-tmpfiles[748]: Failed to set security context system_u:object_r:tmp_t:s0 for /tmp: Permission denied I don't know if they are related ... or if the latter should be reported to systemd?
Did you build own live image?
Yes I did. I don't think there has been made official images from -testing with dracut-013-4 yet - but I'm not up-to-date on that. I'm using livecd-tools-16.3-1.fc16.x86_64 . AFAIK the conclusion on bug 728576 was that it should be OK as long as there is no /selinux on the build host. I would however expect the version with dwalsh's fixes to get in now after the alpha has been released. I can try with the rawhide livecd-tools - if you think that makes any difference?
Created attachment 519832 [details] dmesg I get the same (and other) avcs on a real installed non-live system: [ 16.402026] type=1400 audit(1314274910.239:3): avc: denied { relabelto } for pid=569 comm="udevd" name="rtc" dev=devtmpfs ino=1294 scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=lnk_file [ 16.406903] type=1400 audit(1314274910.244:4): avc: denied { associate } for pid=569 comm="udevd" name="rtc" dev=devtmpfs ino=1294 scontext=system_u:object_r:default_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=filesystem [ 16.419579] type=1400 audit(1314274910.257:5): avc: denied { write } for pid=569 comm="udevd" name="rtc" dev=devtmpfs ino=1294 scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=lnk_file [ 20.478361] type=1400 audit(1314274914.325:6): avc: denied { relabelto } for pid=579 comm="udevd" name="scd0" dev=devtmpfs ino=7326 scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=lnk_file [ 20.482800] type=1400 audit(1314274914.329:7): avc: denied { write } for pid=579 comm="udevd" name="scd0" dev=devtmpfs ino=7326 scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=lnk_file [ 20.489577] type=1400 audit(1314274914.336:8): avc: denied { create } for pid=579 comm="udevd" name="cdrom" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=lnk_file [ 22.518889] type=1400 audit(1314274916.370:9): avc: denied { read } for pid=918 comm="udisks-lvm-pv-e" name="scd0" dev=devtmpfs ino=7326 scontext=system_u:system_r:lvm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=lnk_file [ 22.522458] type=1400 audit(1314274916.374:10): avc: denied { getattr } for pid=918 comm="udisks-lvm-pv-e" path="/dev/scd0" dev=devtmpfs ino=7326 scontext=system_u:system_r:lvm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=lnk_file [ 22.596964] type=1400 audit(1314274916.448:11): avc: denied { read } for pid=919 comm="lvm" name="scd0" dev=devtmpfs ino=7326 scontext=system_u:system_r:lvm_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=lnk_file [ 22.599293] type=1400 audit(1314274916.451:12): avc: denied { getattr } for pid=919 comm="lvm" path="/dev/scd0" dev=devtmpfs ino=7326 scontext=system_u:system_r:lvm_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=lnk_file [ 22.671811] type=1400 audit(1314274916.523:13): avc: denied { associate } for pid=638 comm="udevd" name="root" dev=devtmpfs ino=10462 scontext=system_u:object_r:default_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=filesystem [ 24.914650] multipathd[988]: /etc/multipath.conf does not exist, blacklisting all devices. [ 24.917362] type=1400 audit(1314274918.771:14): avc: denied { getattr } for pid=996 comm="modprobe" path="socket:[14635]" dev=sockfs ino=14635 scontext=system_u:system_r:insmod_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket [ 24.917624] multipathd[988]: A sample multipath.conf file is located at I guess the new dracut requires new policies ... or is buggy ... selinux-policy-targeted-3.10.0-18.fc16.noarch dracut-013-4.fc16.noarch systemd-33-2.fc16.x86_64
What does # matchpathcon /dev/rtc on your F16 real installed non-live system?
[root@imac ~]# matchpathcon /dev/rtc /dev/rtc system_u:object_r:default_t:s0 [root@imac ~]# restorecon /dev/rtc [root@imac ~]# matchpathcon /dev/rtc /dev/rtc system_u:object_r:default_t:s0 [root@imac ~]# rpm -q selinux-policy-targeted selinux-policy-targeted-3.10.0-18.fc16.noarch [root@imac ~]#
I guess it doesn't make sense to repeat matchpathcon without -V, but both before and after and everywhere and with selinux-policy-targeted-3.10.0-21.fc16 it is: lrwxrwxrwx. root root system_u:object_r:default_t:s0 /dev/rtc -> rtc0 crw-------. root root system_u:object_r:clock_device_t:s0 /dev/rtc0
So this is fixed with -21 correct?
No, it is not my experience that -21 fixes it, but I also didn't look for that. Should -21 fix it? Then I will try again and focus on that. One piece of the puzzle I might be missing: Is the policy more or less included in the dracut initrd so that I have to rebuild it after updating the policy? Or do the dracut scripts run without SE constraints until the policy is loaded from /etc ?
After installation of -21 and relabel and dracut -f I still get: [ 15.842516] type=1400 audit(1314384836.679:3): avc: denied { relabelto } for pid=500 comm="udevd" name="rtc" dev=devtmpfs ino=10268 scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=lnk_file [ 15.847266] type=1400 audit(1314384836.684:4): avc: denied { associate } for pid=500 comm="udevd" name="rtc" dev=devtmpfs ino=10268 scontext=system_u:object_r:default_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=filesystem [ 15.849860] type=1400 audit(1314384836.687:5): avc: denied { write } for pid=500 comm="udevd" name="rtc" dev=devtmpfs ino=10268 scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=lnk_file [ 16.752414] type=1400 audit(1314384837.591:6): avc: denied { relabelto } for pid=603 comm="udevd" name="scd0" dev=devtmpfs ino=10309 scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=lnk_file [ 16.757783] type=1400 audit(1314384837.597:7): avc: denied { associate } for pid=603 comm="udevd" name="scd0" dev=devtmpfs ino=10309 scontext=system_u:object_r:default_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=filesystem [ 16.760762] type=1400 audit(1314384837.600:8): avc: denied { write } for pid=603 comm="udevd" name="scd0" dev=devtmpfs ino=10309 scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=lnk_file [ 16.768291] type=1400 audit(1314384837.607:9): avc: denied { create } for pid=603 comm="udevd" name="cdrom" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=lnk_file [ 23.345013] type=1400 audit(1314384844.199:10): avc: denied { read } for pid=825 comm="udisks-lvm-pv-e" name="scd0" dev=devtmpfs ino=10309 scontext=system_u:system_r:lvm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=lnk_file [ 23.350214] type=1400 audit(1314384844.204:11): avc: denied { getattr } for pid=825 comm="udisks-lvm-pv-e" path="/dev/scd0" dev=devtmpfs ino=10309 scontext=system_u:system_r:lvm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=lnk_file [ 24.441708] type=1400 audit(1314384845.298:12): avc: denied { read } for pid=885 comm="lvm" name="scd0" dev=devtmpfs ino=10309 scontext=system_u:system_r:lvm_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=lnk_file [ 24.443988] type=1400 audit(1314384845.301:13): avc: denied { getattr } for pid=885 comm="lvm" path="/dev/scd0" dev=devtmpfs ino=10309 scontext=system_u:system_r:lvm_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=lnk_file [ 27.258082] dbus[998]: avc: netlink poll: error 4 and I get [root@imac ~]# restorecon -R -v /dev restorecon reset /dev/dvdrw context system_u:object_r:default_t:s0->system_u:object_r:device_t:s0 restorecon reset /dev/dvd context system_u:object_r:default_t:s0->system_u:object_r:device_t:s0 restorecon reset /dev/cdrw context system_u:object_r:default_t:s0->system_u:object_r:device_t:s0 restorecon reset /dev/cdrom context system_u:object_r:default_t:s0->system_u:object_r:device_t:s0 restorecon reset /dev/root context system_u:object_r:default_t:s0->system_u:object_r:device_t:s0 restorecon reset /dev/scd0 context system_u:object_r:default_t:s0->system_u:object_r:device_t:s0 restorecon reset /dev/rtc context system_u:object_r:default_t:s0->system_u:object_r:device_t:s0 restorecon reset /dev/pts/ptmx context system_u:object_r:devpts_t:s0->system_u:object_r:ptmx_t:s0 selinux-policy-targeted-3.10.0-21.fc16.noarch dracut-013-4.fc16.noarch
Is this a livecd still?
Comment 9 is on a real /dev/sda f16 + updates-testing system (I obviously don't get the "live" errors here, but most of avc's are the same.)
This looks like a bogus labelling and is either caused by dracut or systemd.
In F16 dracut does not do any selinux anymore. Systemd took full control over it.
*** Bug 733512 has been marked as a duplicate of this bug. ***
Same issues is seen with: systemd-35-1.fc16.i686 dracut-013-8.fc16.noarch selinux-policy-targeted-3.10.0-25.fc16.noarch kernel-PAE-3.1.0-0.rc4.git0.1.fc16.i686 on a livecd built with livecd-tools-16.5-1.fc16. This one do however also show up on a "real" machine: type=1400 audit(1315568190.150:3): avc: denied { associate } for pid=505 comm="udevd" name="rtc" dev=devtmpfs ino=179 scontext=system_u:object_r:default_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=filesystem
Same for me: [ 56.745901] SELinux: initialized (dev sdh1, type xfs), uses xattr [ 56.851290] systemd-tmpfiles[959]: Successfully loaded SELinux database in 24ms 299us, size on heap is 469K. [ 56.878309] systemd-tmpfiles[959]: Failed to set security context system_u:object_r:var_t:s0 for /var: Permission denied [ 56.910704] systemd-tmpfiles[959]: Failed to set security context system_u:object_r:var_run_t:s0 for /run: Permission denied [ 56.915637] systemd-tmpfiles[959]: Failed to set security context system_u:object_r:var_run_t:s0 for /run: Permission denied [ 56.919232] systemd-tmpfiles[959]: Failed to set security context system_u:object_r:var_run_t:s0 for /run: Permission denied [ 56.922765] systemd-tmpfiles[959]: Failed to set security context system_u:object_r:var_t:s0 for /var: Permission denied [ 56.926310] systemd-tmpfiles[959]: Failed to set security context system_u:object_r:var_t:s0 for /var: Permission denied [ 56.929707] systemd-tmpfiles[959]: Failed to set security context system_u:object_r:var_t:s0 for /var: Permission denied [ 56.933037] systemd-tmpfiles[959]: Failed to set security context system_u:object_r:var_t:s0 for /var: Permission denied [ 56.936311] systemd-tmpfiles[959]: Failed to set security context system_u:object_r:var_t:s0 for /var: Permission denied [ 56.939428] systemd-tmpfiles[959]: Failed to set security context system_u:object_r:var_t:s0 for /var: Permission denied [ 56.942619] systemd-tmpfiles[959]: Failed to set security context system_u:object_r:var_t:s0 for /var: Permission denied [ 56.945781] systemd-tmpfiles[959]: Failed to set security context system_u:object_r:var_run_t:s0 for /run: Permission denied [ 56.961252] systemd-tmpfiles[959]: Failed to set security context system_u:object_r:var_t:s0 for /var: Permission denied [ 56.966561] systemd-tmpfiles[959]: Failed to set security context system_u:object_r:var_run_t:s0 for /run: Permission denied [ 56.969696] systemd-tmpfiles[959]: Failed to set security context system_u:object_r:var_run_t:s0 for /run: Permission denied [ 56.972737] systemd-tmpfiles[959]: Failed to set security context system_u:object_r:var_run_t:s0 for /run: Permission denied [ 56.975672] systemd-tmpfiles[959]: Failed to set security context system_u:object_r:var_run_t:s0 for /run: Permission denied [ 56.978586] systemd-tmpfiles[959]: Failed to set security context system_u:object_r:var_t:s0 for /var: Permission denied [ 56.981489] systemd-tmpfiles[959]: Failed to set security context system_u:object_r:tmp_t:s0 for /tmp: Permission denied [ 56.984506] systemd-tmpfiles[959]: Failed to set security context system_u:object_r:tmp_t:s0 for /tmp: Permission denied [ 56.987397] systemd-tmpfiles[959]: Failed to set security context system_u:object_r:tmp_t:s0 for /tmp: Permission denied [ 56.990160] systemd-tmpfiles[959]: Failed to set security context system_u:object_r:tmp_t:s0 for /tmp: Permission denied [ 56.992969] systemd-tmpfiles[959]: Failed to set security context system_u:object_r:tmp_t:s0 for /tmp: Permission denied
If you run restorecon -R -v -n /run Does it show anything?
On a live system: # restorecon -R -v -n /run restorecon reset /run/abrt context system_u:object_r:var_run_t:s0->system_u:object_r:abrt_var_run_t:s0 restorecon reset /run/abrt/saved_core_pattern context system_u:object_r:initrc_var_run_t:s0->system_u:object_r:abrt_var_run_t:s0 restorecon reset /run/user/liveuser/dconf context unconfined_u:object_r:config_home_t:s0->system_u:object_r:user_tmp_t:s0 restorecon reset /run/user/liveuser/dconf/user context unconfined_u:object_r:config_home_t:s0->system_u:object_r:user_tmp_t:s0 # dmesg|grep audit.*rtc [ 12.120169] type=1400 audit(1315852826.192:3): avc: denied { associate } for pid=530 comm="udevd" name="rtc" dev=devtmpfs ino=9487 scontext=system_u:object_r:default_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=filesystem # rpm -q dracut systemd selinux-policy-targeted dracut-013-8.fc16.noarch systemd-35-1.fc16.x86_64 selinux-policy-targeted-3.10.0-25.fc16.noarch FWIW I see many issues that indicates problems with the dracut/systemd interfacing and stuff from before the root pivoting causing strange errors later.
On a installed system with the same package versions and enforcing=0 there is (almost) the same avcs and bad fs labels as mentioned in comment 9, but nothing wrong in /run.
The dconf file labels should be fixed in the next policy update. Where is rtc located?
(In reply to comment #17) > If you run > > restorecon -R -v -n /run > > Does it show anything? [root@nostromo ~]# restorecon -R -v -n /run [root@nostromo ~]# Unfortunately, nothing was changed. I still see all these messages after reboot (they're gone only if I switch to the permissive mode).
(In reply to comment #20) > The dconf file labels should be fixed in the next policy update. Where is rtc > located? I assume it is /dev/rtc - which comment 9 points out has the wrong label.
(In reply to comment #21) > (they're gone only if I switch to the permissive mode). Really? I do see them in permissive mode - I don't think I am able to boot in enforcing mode. Or did you mean selinux=0 / SELINUX=disabled mode?
(In reply to comment #23) > (In reply to comment #21) > > (they're gone only if I switch to the permissive mode). > > Really? I do see them in permissive mode - I don't think I am able to boot in > enforcing mode. Or did you mean selinux=0 / SELINUX=disabled mode? Yes, I was wrong - they still exists in a permissive mode as well. I just updated to the latest selinux-policy-3.10.0-26.fc16.noarch and these issues are still here: [root@nostromo ~]# dmesg | grep avc [ 17.456585] type=1400 audit(1315857818.600:4): avc: denied { associate } for pid=445 comm="udevd" name="root" dev=devtmpfs ino=8261 scontext=system_u:object_r:default_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=filesystem [ 17.520470] type=1400 audit(1315857818.664:5): avc: denied { associate } for pid=447 comm="udevd" name="rtc" dev=devtmpfs ino=8105 scontext=system_u:object_r:default_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=filesystem [ 56.882987] type=1400 audit(1315857858.025:6): avc: denied { associate } for pid=714 comm="udevd" name="root" dev=devtmpfs ino=8261 scontext=system_u:object_r:default_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=filesystem [ 57.121410] type=1400 audit(1315857858.266:7): avc: denied { associate } for pid=714 comm="udevd" name="rtc" dev=devtmpfs ino=8105 scontext=system_u:object_r:default_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=filesystem [root@nostromo ~]#
Fixed in libselinux-2.1.5-4.fc16
libselinux-2.1.5-4.fc16 has been submitted as an update for Fedora 16. https://admin.fedoraproject.org/updates/libselinux-2.1.5-4.fc16
Package libselinux-2.1.5-4.fc16: * should fix your issue, * was pushed to the Fedora 16 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing libselinux-2.1.5-4.fc16' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/libselinux-2.1.5-4.fc16 then log in and leave karma (feedback).
Confirmed. This fixed issues with udevd. Unfortunately the issues with systemd-tmpfiles are still remaining unfixed.
I have filed Bug 737837 - systemd-tmpfiles: Failed to set security context ... for /var: Permission denied
Package libselinux-2.1.5-5.fc16: * should fix your issue, * was pushed to the Fedora 16 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing libselinux-2.1.5-5.fc16' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/libselinux-2.1.5-5.fc16 then log in and leave karma (feedback).
Discussed in the 2011-09-16 blocker review meeting. Accepted as NTH for Fedora 16 beta because it will eventually be a final blocker and a fix is ready.
libselinux-2.1.5-5.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report.