Hide Forgot
Created attachment 564786 [details] Please apply this patch and work with Miroslav Grepl to clean up policy. Description of problem: Version-Release number of selected component (if applicable): How reproducible: Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info:
Created attachment 564788 [details] This is an audit.log from F17 showing the current policy has lots of problems. java_exec_t as a label is disappearing in F17. We might need to better understand what is going on with the transitions.
Pushed to master and dogtag 9
reopening - there are more avc's [root@mpgtest scripts]# audit2allow -R -i /var/log/audit/audit.log require { type unlabeled_t; type lib_t; type consoletype_exec_t; type systemd_tmpfiles_t; type hostname_exec_t; type sysctl_kernel_t; type hugetlbfs_t; type pki_ca_t; class capability { setuid chown setgid fowner audit_write dac_override }; class dir { read search open getattr }; class file { execute read open execute_no_trans }; class netlink_audit_socket { nlmsg_relay create }; } #============= pki_ca_t ============== allow pki_ca_t consoletype_exec_t:file { read execute open execute_no_trans }; allow pki_ca_t hostname_exec_t:file { read execute open execute_no_trans }; allow pki_ca_t hugetlbfs_t:file read; allow pki_ca_t lib_t:file execute_no_trans; allow pki_ca_t self:capability { setuid chown setgid fowner audit_write dac_override }; allow pki_ca_t self:netlink_audit_socket { nlmsg_relay create }; allow pki_ca_t sysctl_kernel_t:dir search; allow pki_ca_t sysctl_kernel_t:file { read open }; #============= systemd_tmpfiles_t ============== allow systemd_tmpfiles_t unlabeled_t:dir { read getattr open search };
unlabeled_t looks like an update issue. Could you attach AVC messages for these rules? I will clean up your policy with this log.
This package has changed ownership in the Fedora Package Database. Reassigning to the new owner of this component.
Created attachment 573371 [details] audit logs for above avc messages Removed the f17 patch and obtained raw audit log messages on f17. Attached.
This message is a reminder that Fedora 17 is nearing its end of life. Approximately 4 (four) weeks from now Fedora will stop maintaining and issuing updates for Fedora 17. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as WONTFIX if it remains open with a Fedora 'version' of '17'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version prior to Fedora 17's end of life. Bug Reporter: Thank you for reporting this issue and we are sorry that we may not be able to fix it before Fedora 17 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior to Fedora 17's end of life. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete.
We have fixes in F18+.