Bug 912034 - SELinux is preventing /usr/lib/systemd/systemd-hostnamed from 'create' accesses on the unix_dgram_socket .
Summary: SELinux is preventing /usr/lib/systemd/systemd-hostnamed from 'create' access...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 18
Hardware: i686
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:666f8e1b57dd1055f11d1ba7b53...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-02-17 10:59 UTC by Mikhail
Modified: 2013-02-22 18:03 UTC (History)
30 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2013-02-20 04:00:59 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Mikhail 2013-02-17 10:59:07 UTC
Description of problem:
SELinux is preventing /usr/lib/systemd/systemd-hostnamed from 'create' accesses on the unix_dgram_socket .

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that systemd-hostnamed should be allowed create access on the  unix_dgram_socket by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep systemd-hostnam /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:systemd_hostnamed_t:s0
Target Context                system_u:system_r:systemd_hostnamed_t:s0
Target Objects                 [ unix_dgram_socket ]
Source                        systemd-hostnam
Source Path                   /usr/lib/systemd/systemd-hostnamed
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           systemd-197-1.fc18.2.i686
Target RPM Packages           
Policy RPM                    selinux-policy-3.11.1-78.fc18.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.7.8-202.fc18.i686.PAE #1 SMP Fri
                              Feb 15 17:47:05 UTC 2013 i686 i686
Alert Count                   1
First Seen                    2013-02-17 16:58:24 YEKT
Last Seen                     2013-02-17 16:58:24 YEKT
Local ID                      604ec49b-fac6-4120-91a9-da21ed334059

Raw Audit Messages
type=AVC msg=audit(1361098704.506:339): avc:  denied  { create } for  pid=10179 comm="systemd-hostnam" scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:system_r:systemd_hostnamed_t:s0 tclass=unix_dgram_socket


type=SYSCALL msg=audit(1361098704.506:339): arch=i386 syscall=socketcall success=no exit=EACCES a0=1 a1=bfecdfd0 a2=b7749dd8 a3=6 items=0 ppid=1 pid=10179 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm=systemd-hostnam exe=/usr/lib/systemd/systemd-hostnamed subj=system_u:system_r:systemd_hostnamed_t:s0 key=(null)

Hash: systemd-hostnam,systemd_hostnamed_t,systemd_hostnamed_t,unix_dgram_socket,create

audit2allow

#============= systemd_hostnamed_t ==============
allow systemd_hostnamed_t self:unix_dgram_socket create;

audit2allow -R

#============= systemd_hostnamed_t ==============
allow systemd_hostnamed_t self:unix_dgram_socket create;


Additional info:
hashmarkername: setroubleshoot
kernel:         3.7.8-202.fc18.i686.PAE
type:           libreport

Comment 1 Davi 2013-02-18 01:17:20 UTC
Just booted and got the warning. Occurs on every boot.

Package: (null)
Architecture: x86_64
OS Release: Fedora release 18 (Spherical Cow)

Comment 2 Miroslav Grepl 2013-02-18 10:41:57 UTC
commit 33a62dfff572a0954b36313132a99c8b4da2f02e
Author: Miroslav Grepl <mgrepl>
Date:   Mon Feb 18 11:40:44 2013 +0100

    Backport fixes for systemd-hostname policy to F18

Comment 3 Borut Semenic 2013-02-18 16:20:38 UTC
Every time I open Files (nautilus ) I get 3 selinux preventing ...


Source RPM Packages           systemd-197-1.fc18.2.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.11.1-78.fc18.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux 3.7.8-202.fc18.x86_64

SELinux is preventing /usr/lib/systemd/systemd-hostnamed from create access on the unix_dgram_socket .

Raw Audit Messages
type=AVC msg=audit(1361203466.493:388): avc:  denied  { create } for  pid=6495 comm="systemd-hostnam" scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:system_r:systemd_hostnamed_t:s0 tclass=unix_dgram_socket


type=SYSCALL msg=audit(1361203466.493:388): arch=x86_64 syscall=socket success=no exit=EACCES a0=1 a1=80802 a2=0 a3=4 items=0 ppid=1 pid=6495 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm=systemd-hostnam exe=/usr/lib/systemd/systemd-hostnamed subj=system_u:system_r:systemd_hostnamed_t:s0 key=(null)

Hash: systemd-hostnam,systemd_hostnamed_t,systemd_hostnamed_t,unix_dgram_socket,create

Source Context                system_u:system_r:systemd_hostnamed_t:s0
Target Context                system_u:system_r:systemd_hostnamed_t:s0
Target Objects                 [ unix_dgram_socket ]
Source                        systemd-hostnam
Source Path                   /usr/lib/systemd/systemd-hostnamed


SELinux is preventing /usr/lib/systemd/systemd-hostnamed from write access on the chr_file kmsg.

Raw Audit Messages
type=AVC msg=audit(1361203466.493:389): avc:  denied  { write } for  pid=6495 comm="systemd-hostnam" name="kmsg" dev="devtmpfs" ino=1037 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:kmsg_device_t:s0 tclass=chr_file


type=SYSCALL msg=audit(1361203466.493:389): arch=x86_64 syscall=open success=no exit=EACCES a0=7f8878aa1f7c a1=80101 a2=0 a3=4 items=0 ppid=1 pid=6495 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm=systemd-hostnam exe=/usr/lib/systemd/systemd-hostnamed subj=system_u:system_r:systemd_hostnamed_t:s0 key=(null)

Hash: systemd-hostnam,systemd_hostnamed_t,kmsg_device_t,chr_file,write

Additional Information:
Source Context                system_u:system_r:systemd_hostnamed_t:s0
Target Context                system_u:object_r:kmsg_device_t:s0
Target Objects                kmsg [ chr_file ]
Source                        systemd-hostnam
Source Path                   /usr/lib/systemd/systemd-hostnamed


SELinux is preventing /usr/lib/systemd/systemd-hostnamed from read access on the file /etc/hostname.

Raw Audit Messages
type=AVC msg=audit(1361203466.493:390): avc:  denied  { read } for  pid=6495 comm="systemd-hostnam" name="hostname" dev="sda5" ino=2237699 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:etc_runtime_t:s0 tclass=file


type=SYSCALL msg=audit(1361203466.493:390): arch=x86_64 syscall=open success=no exit=EACCES a0=7f8878a9fd68 a1=80000 a2=1b6 a3=238 items=0 ppid=1 pid=6495 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm=systemd-hostnam exe=/usr/lib/systemd/systemd-hostnamed subj=system_u:system_r:systemd_hostnamed_t:s0 key=(null)

Hash: systemd-hostnam,systemd_hostnamed_t,etc_runtime_t,file,read

Additional Information:
Source Context                system_u:system_r:systemd_hostnamed_t:s0
Target Context                system_u:object_r:etc_runtime_t:s0
Target Objects                /etc/hostname [ file ]
Source                        systemd-hostnam
Source Path                   /usr/lib/systemd/systemd-hostnamed


Package: (null)
Architecture: x86_64
OS Release: Fedora release 18 (Spherical Cow)

Comment 4 Miroslav Grepl 2013-02-18 16:22:37 UTC
Please execute

# semanage permissive -a systemd_hostnamed_t

to make this working for now. I am going to submit a new update later today.

Comment 5 Guido Kroon 2013-02-18 22:33:23 UTC
Every time I open nautilus.

Package: (null)
Architecture: x86_64
OS Release: Fedora release 18 (Spherical Cow)

Comment 6 Fedora Update System 2013-02-19 09:29:34 UTC
selinux-policy-3.11.1-79.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/selinux-policy-3.11.1-79.fc18

Comment 7 Jeff Buhrt 2013-02-19 14:10:52 UTC
updated system and rebooted

Package: (null)
OS Release: Fedora release 18 (Spherical Cow)

Comment 8 Niki Guldbrand 2013-02-19 23:57:40 UTC
Don't exactly know what happened...

Package: (null)
Architecture: x86_64
OS Release: Fedora release 18 (Spherical Cow)

Comment 9 Scott Plough 2013-02-20 01:27:58 UTC
After rebooting, and then logging in, it happened immately after launching Nautilus.

Package: (null)
Architecture: x86_64
OS Release: Fedora release 18 (Spherical Cow)

Comment 10 Fedora Update System 2013-02-20 04:01:03 UTC
selinux-policy-3.11.1-79.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.