Bug 984549 - system-config-kdump needs write access to /boot/efi/EFI/fedora/grub.cfg
system-config-kdump needs write access to /boot/efi/EFI/fedora/grub.cfg
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
18
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Miroslav Grepl
Fedora Extras Quality Assurance
:
Depends On:
Blocks: 983017
  Show dependency treegraph
 
Reported: 2013-07-15 09:19 EDT by Martin Milata
Modified: 2013-08-14 22:54 EDT (History)
4 users (show)

See Also:
Fixed In Version: selinux-policy-3.11.1-100.fc18
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-08-14 22:54:31 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
grep system-config-k /var/log/audit/audit.log (11.69 KB, text/plain)
2013-07-15 09:33 EDT, Martin Milata
no flags Details
ausearch -m avc -ts recent (1.60 KB, text/plain)
2013-07-16 08:57 EDT, Martin Milata
no flags Details

  None (edit)
Description Martin Milata 2013-07-15 09:19:49 EDT
As reported in #983017, system-config-kdump is unable to write bootloader configuration on systems that boot using EFI. In addition to fixing s-c-kdump, the SELinux policy needs to be modified to allow s-c-kdump write access to /boot/efi/EFI/fedora/grub.cfg.

It might be relevant that the EFI partition on /boot/efi has FAT32 file system.

Can you also please fix this for F19, or should I open separate bug report?
Comment 1 Martin Milata 2013-07-15 09:33:24 EDT
Created attachment 773757 [details]
grep system-config-k /var/log/audit/audit.log

The output of "grep system-config-k /var/log/audit/audit.log" on Fedora 19. (I don't currently have access to EFI-capable machine with F18, sorry.)
Comment 2 Miroslav Grepl 2013-07-16 08:36:19 EDT
Could you re-test it with

# setenforce 0
# echo "-w /etc/shadow -p w" >> /etc/audit/audit.rules

restart auditd and re-test and run

# ausearch -m avc -ts recent
Comment 3 Martin Milata 2013-07-16 08:57:06 EDT
Created attachment 774225 [details]
ausearch -m avc -ts recent

Attaching requested information.
Comment 4 Daniel Walsh 2013-07-16 13:27:03 EDT
system-config-kdump should be run with 

#! /usr/bin/python -Es

It should not be using /root/.local.

We should allow it to write to dosfs_t if /boot/efi/EFI/fedora/grub.cfg. is a FAT file system?
Comment 5 Martin Milata 2013-07-16 13:36:51 EDT
> We should allow it to write to dosfs_t if /boot/efi/EFI/fedora/grub.cfg. is
> a FAT file system?

I believe that would solve this issue.
Comment 6 Daniel Walsh 2013-07-17 13:08:28 EDT
207c8051a3092e75a1a7c260daf22bfa65806ae2 fixes this in git,  IE Allows system-config-kdump to write to dosfs_t files
Comment 7 Miroslav Grepl 2013-07-22 07:30:55 EDT
Back ported.
Comment 10 Fedora Update System 2013-08-05 01:41:24 EDT
selinux-policy-3.11.1-99.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/selinux-policy-3.11.1-99.fc18
Comment 11 Fedora Update System 2013-08-05 20:14:57 EDT
Package selinux-policy-3.11.1-99.fc18:
* should fix your issue,
* was pushed to the Fedora 18 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.11.1-99.fc18'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-14256/selinux-policy-3.11.1-99.fc18
then log in and leave karma (feedback).
Comment 12 Fedora Update System 2013-08-07 07:13:03 EDT
selinux-policy-3.11.1-100.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/selinux-policy-3.11.1-100.fc18
Comment 13 Fedora Update System 2013-08-14 22:54:31 EDT
selinux-policy-3.11.1-100.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.