Hide Forgot
Description of problem: When called from a cron job, package-cleanup fails to remove kernels packages with the following error: Error in PREUN scriptlet in rpm package kernel kernel-2.6.32-220.4.2.el6.x86_64 was supposed to be removed but is not! I believe this bug is the same as 750892 which was filed against Fedora 16? Changing the selinux context of /usr/bin/package-cleanup to system_u:object_r:rpm_exec_t:s0 seems to fix this issue. Would it be possible to include this policy update in a next update of the selinux-policy package? Version-Release number of selected component (if applicable): How reproducible: always Steps to Reproduce: 1. create a cron job that calls package-cleanup --oldkernels --count=1 -y 2. wait for the job to run 3. Actual results: package-cleanup fails to remove older kernels with the preun scriptlet error mentioned above. Expected results: Older kernels removed without errors. Additional info: When the package-cleanup command is called from a shell (unconfined), there is not error message and the packages are removed as expected. Regards, Rik
Following your instructions I believe I reproduced the problem: ---- time->Mon Apr 16 23:18:17 2012 type=SYSCALL msg=audit(1334611097.009:40968): arch=40000003 syscall=11 success=no exit=-13 a0=d489360 a1=d430180 a2=bfd06ccc a3=0 items=0 ppid=13147 pid=13150 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=13 comm="package-cleanup" exe="/usr/bin/python" subj=system_u:system_r:system_cronjob_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1334611097.009:40968): avc: denied { transition } for pid=13150 comm="package-cleanup" path="/bin/bash" dev=sda3 ino=219786 scontext=system_u:system_r:system_cronjob_t:s0-s0:c0.c1023 tcontext=system_u:system_r:rpm_script_t:s0-s0:c0.c1023 tclass=process ---- # ls -Z /etc/cron.d/package-cleanup -rw-r--r--. root root system_u:object_r:system_cron_spool_t:s0 /etc/cron.d/package-cleanup # cat /etc/cron.d/package-cleanup SHELL=/bin/bash PATH=/sbin:/bin:/usr/sbin:/usr/bin MAILTO=root HOME=/ 18 * * * * root package-cleanup --oldkernels --count=1 -y #
And if you label /usr/bin/package-cleanup as rpm_exec_t, does it work?
Hi Daniel, Yes, changing the label makes it work. Regards, Rik
If /usr/bin/package-cleanup is labelled rpm_exec_t then the scenario works without AVCs.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2012-0780.html