Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Description of problem:
It appears when installation progress reaches 100%
SELinux is preventing systemd-localed from 'rename' accesses on the file .#vconsole.confpgMBe1.
***** Plugin catchall_labels (83.8 confidence) suggests *******************
If you want to allow systemd-localed to have rename access on the .#vconsole.confpgMBe1 file
Then you need to change the label on .#vconsole.confpgMBe1
Do
# semanage fcontext -a -t FILE_TYPE '.#vconsole.confpgMBe1'
where FILE_TYPE is one of the following: locale_t, xserver_etc_t.
Then execute:
restorecon -v '.#vconsole.confpgMBe1'
***** Plugin catchall (17.1 confidence) suggests **************************
If you believe that systemd-localed should be allowed rename access on the .#vconsole.confpgMBe1 file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'systemd-localed' --raw | audit2allow -M my-systemdlocaled
# semodule -X 300 -i my-systemdlocaled.pp
Additional Information:
Source Context system_u:system_r:systemd_localed_t:s0
Target Context system_u:object_r:etc_t:s0
Target Objects .#vconsole.confpgMBe1 [ file ]
Source systemd-localed
Source Path systemd-localed
Port <Unknown>
Host (removed)
Source RPM Packages
Target RPM Packages
Policy RPM selinux-policy-3.13.1-249.fc26.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Permissive
Host Name (removed)
Platform Linux (removed) 4.11.0-0.rc6.git0.1.fc26.x86_64 #1
SMP Mon Apr 10 19:45:50 UTC 2017 x86_64 x86_64
Alert Count 1
First Seen 2017-04-17 00:49:25 EDT
Last Seen 2017-04-17 00:49:25 EDT
Local ID b18d5643-ea4a-4c6a-a0a4-c067426274b4
Raw Audit Messages
type=AVC msg=audit(1492404565.521:261): avc: denied { rename } for pid=16946 comm="systemd-localed" name=".#vconsole.confpgMBe1" dev="dm-0" ino=294625 scontext=system_u:system_r:systemd_localed_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=1
Hash: systemd-localed,systemd_localed_t,etc_t,file,rename
Version-Release number of selected component:
selinux-policy-3.13.1-249.fc26.noarch
Additional info:
component: selinux-policy
reporter: libreport-2.9.1
hashmarkername: setroubleshoot
kernel: 4.11.0-0.rc6.git0.1.fc26.x86_64
type: libreport
Potential duplicate: bug 917367
Comment 1Giulio 'juliuxpigface'
2017-04-27 17:50:10 UTC
Proposing as a blocker for Fedora 26 Final.
The notification of SEAlert popped up (together with other 2/3 AVCs) after reaching the 100% of the installation of Fedora 26 Workstation.
This seems a violation of the "2.5.4 SELinux and crash notifications" criterion
"There must be no SELinux denial notifications or crash notifications on boot of or during installation from a release-blocking live image, or at first login after a default install of a release-blocking desktop."
https://fedoraproject.org/wiki/Fedora_26_Final_Release_Criteria#SELinux_and_crash_notifications
Discussed during the 2017-05-01 blocker review meeting: [1]
The decision to classify this bug as an AcceptedBlocker was made as it violates the following blocker criteria:
"There must be no SELinux denial notifications or crash notifications on boot of or during installation from a release-blocking live image, or at first login after a default install of a release-blocking desktop."
[1] https://meetbot.fedoraproject.org/fedora-blocker-review/2017-05-01/f26-blocker-review.2017-05-01-16.02.txt
Description of problem: It appears when installation progress reaches 100% SELinux is preventing systemd-localed from 'rename' accesses on the file .#vconsole.confpgMBe1. ***** Plugin catchall_labels (83.8 confidence) suggests ******************* If you want to allow systemd-localed to have rename access on the .#vconsole.confpgMBe1 file Then you need to change the label on .#vconsole.confpgMBe1 Do # semanage fcontext -a -t FILE_TYPE '.#vconsole.confpgMBe1' where FILE_TYPE is one of the following: locale_t, xserver_etc_t. Then execute: restorecon -v '.#vconsole.confpgMBe1' ***** Plugin catchall (17.1 confidence) suggests ************************** If you believe that systemd-localed should be allowed rename access on the .#vconsole.confpgMBe1 file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'systemd-localed' --raw | audit2allow -M my-systemdlocaled # semodule -X 300 -i my-systemdlocaled.pp Additional Information: Source Context system_u:system_r:systemd_localed_t:s0 Target Context system_u:object_r:etc_t:s0 Target Objects .#vconsole.confpgMBe1 [ file ] Source systemd-localed Source Path systemd-localed Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-249.fc26.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 4.11.0-0.rc6.git0.1.fc26.x86_64 #1 SMP Mon Apr 10 19:45:50 UTC 2017 x86_64 x86_64 Alert Count 1 First Seen 2017-04-17 00:49:25 EDT Last Seen 2017-04-17 00:49:25 EDT Local ID b18d5643-ea4a-4c6a-a0a4-c067426274b4 Raw Audit Messages type=AVC msg=audit(1492404565.521:261): avc: denied { rename } for pid=16946 comm="systemd-localed" name=".#vconsole.confpgMBe1" dev="dm-0" ino=294625 scontext=system_u:system_r:systemd_localed_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=1 Hash: systemd-localed,systemd_localed_t,etc_t,file,rename Version-Release number of selected component: selinux-policy-3.13.1-249.fc26.noarch Additional info: component: selinux-policy reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.0-0.rc6.git0.1.fc26.x86_64 type: libreport Potential duplicate: bug 917367