Bug 952204 - [selinux] localectl denial
Summary: [selinux] localectl denial
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: oVirt
Classification: Retired
Component: ovirt-node
Version: 3.2
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
: ---
Assignee: Fabian Deutsch
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: ovirt-node-3.0
TreeView+ depends on / blocked
 
Reported: 2013-04-15 11:26 UTC by Fabian Deutsch
Modified: 2016-04-26 22:24 UTC (History)
6 users (show)

Fixed In Version: ovrt-node-3.0.0
Clone Of:
Environment:
Last Closed: 2013-08-26 09:48:32 UTC
oVirt Team: ---
Embargoed:


Attachments (Terms of Use)
Error shown on the screen (18.64 KB, image/png)
2013-04-15 11:26 UTC, Fabian Deutsch
no flags Details
complete audit.log (136.50 KB, text/x-log)
2013-04-15 11:29 UTC, Fabian Deutsch
no flags Details

Description Fabian Deutsch 2013-04-15 11:26:40 UTC
Created attachment 735868 [details]
Error shown on the screen

Description of problem:
Fedora migrated to localectl, so do we (bug #882206) this introduces an selinux denial which ultimately stops the installer from succeeding.

Version-Release number of selected component (if applicable):
Recent F18 build

How reproducible:
always

Steps to Reproduce:
1. Launch test build
2. Select keyboard layout
3.
  
Actual results:
error on installer screen and denial in audit.log

Expected results:
installer completes / next page can be selected

Additional info:
setenforce 0 is a workaround

type=SERVICE_START msg=audit(1366024948.199:342): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="systemd-localed" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=AVC msg=audit(1366024948.200:343): avc:  denied  { create } for  pid=4807 comm="systemd-localed" name=".vconsole.confVStRrV" scontext=system_u:system_r:systemd_localed_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file
type=AVC msg=audit(1366024948.200:343): avc:  denied  { write } for  pid=4807 comm="systemd-localed" path="/etc/.vconsole.confVStRrV" dev="tmpfs" ino=31394 scontext=system_u:system_r:systemd_localed_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file
type=SYSCALL msg=audit(1366024948.200:343): arch=c000003e syscall=2 success=yes exit=5 a0=7f5b25cc8f60 a1=800c2 a2=180 a3=1a7e2f2fa items=3 ppid=1 pid=4807 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="systemd-localed" exe="/usr/lib/systemd/systemd-localed" subj=system_u:system_r:systemd_localed_t:s0 key=(null)
type=CWD msg=audit(1366024948.200:343):  cwd="/"
type=PATH msg=audit(1366024948.200:343): item=0 name="/etc/.vconsole.confVStRrV" inode=14543 dev=00:21 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0
type=PATH msg=audit(1366024948.200:343): item=1 name=(null) inode=14543 dev=00:21 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0
type=PATH msg=audit(1366024948.200:343): item=2 name=(null) inode=31394 dev=00:21 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0
type=AVC msg=audit(1366024948.200:344): avc:  denied  { setattr } for  pid=4807 comm="systemd-localed" name=".vconsole.confVStRrV" dev="tmpfs" ino=31394 scontext=system_u:system_r:systemd_localed_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file
type=SYSCALL msg=audit(1366024948.200:344): arch=c000003e syscall=91 success=yes exit=0 a0=5 a1=1a4 a2=fbad2484 a3=22 items=1 ppid=1 pid=4807 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="systemd-localed" exe="/usr/lib/systemd/systemd-localed" subj=system_u:system_r:systemd_localed_t:s0 key=(null)
type=PATH msg=audit(1366024948.200:344): item=0 name=(null) inode=31394 dev=00:21 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0
type=AVC msg=audit(1366024948.200:345): avc:  denied  { rename } for  pid=4807 comm="systemd-localed" name=".vconsole.confVStRrV" dev="tmpfs" ino=31394 scontext=system_u:system_r:systemd_localed_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file
type=SYSCALL msg=audit(1366024948.200:345): arch=c000003e syscall=82 success=yes exit=0 a0=7f5b25cc8f60 a1=7f5b251acf3f a2=7f5b25ccc3a0 a3=22 items=4 ppid=1 pid=4807 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="systemd-localed" exe="/usr/lib/systemd/systemd-localed" subj=system_u:system_r:systemd_localed_t:s0 key=(null)
type=CWD msg=audit(1366024948.200:345):  cwd="/"

Comment 1 Fabian Deutsch 2013-04-15 11:29:58 UTC
Created attachment 735869 [details]
complete audit.log

Comment 2 Fabian Deutsch 2013-04-15 11:42:10 UTC
http://gerrit.ovirt.org/#/c/13922/

Comment 3 Fabian Deutsch 2013-08-26 09:45:48 UTC
The fix for this patch has been merged and is present in the released ovirt-node-3.0.0.


Note You need to log in before you can comment on or make changes to this bug.