Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1301007 - Cron cannot load user crontab due to SELinux denial
Summary: Cron cannot load user crontab due to SELinux denial
Keywords:
Status: CLOSED DUPLICATE of bug 1298192
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 23
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-01-22 10:14 UTC by Martin Kosek
Modified: 2016-01-22 10:41 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-01-22 10:41:06 UTC
Type: Bug
Embargoed:

Attachments (Terms of Use)

Description Martin Kosek 2016-01-22 10:14:59 UTC 
Description of problem:
After I rebooted my laptop on Jan 19, 2016, cron stopped executing my crontab as it failed to load the user crontab:

$ systemctl status crond.service -l
● crond.service - Command Scheduler
   Loaded: loaded (/usr/lib/systemd/system/crond.service; enabled; vendor preset: enabled)
   Active: active (running) since Fri 2016-01-22 11:04:49 CET; 1min 44s ago
 Main PID: 31151 (crond)
   CGroup: /system.slice/crond.service
           └─31151 /usr/sbin/crond -n

Jan 22 11:04:49 xxxxx.redhat.com systemd[1]: Started Command Scheduler.
Jan 22 11:04:49 xxxxx.redhat.com systemd[1]: Starting Command Scheduler...
Jan 22 11:04:49 xxxxx.redhat.com crond[31151]: (CRON) INFO (RANDOM_DELAY will be scaled with factor 81% if used.)
Jan 22 11:04:49 xxxxx.redhat.com crond[31151]: (mkosek) Unauthorized SELinux context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 file_context=unconfined_u:object_r:user_cron_spool_t:s0 (/var/spool/cron/mkosek)
Jan 22 11:04:49 xxxxx.redhat.com crond[31151]: (mkosek) FAILED (loading cron table)
Jan 22 11:04:49 xxxxx.redhat.com crond[31151]: (CRON) INFO (running with inotify support)
Jan 22 11:04:49 xxxxx.redhat.com crond[31151]: (CRON) INFO (@reboot jobs will be run at computer's startup.)


$ getsebool cron_userdomain_transition
cron_userdomain_transition --> on

$ sudo ls -laZ /var/spool/cron/
total 12
drwx------.  2 root   root   system_u:object_r:user_cron_spool_t:s0     4096 Jul 13  2015 .
drwxr-xr-x. 13 root   root   system_u:object_r:var_spool_t:s0           4096 Sep 10 10:23 ..
-rw-------.  1 mkosek mkosek unconfined_u:object_r:user_cron_spool_t:s0  634 Feb  4  2015 mkosek

$ sudo ausearch -m AVC -ts today
<no matches>


Version-Release number of selected component (if applicable):
selinux-policy-3.13.1-158.fc23.noarch
cronie-1.5.0-3.fc23.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Restart crond
2.
3.

Actual results:
Fails to load user crontab

Expected results:
Loads user crontab

Additional info:
I saw Bug 1052401 and Bug 1063503, but I did not see any useful information helping me continue run in the enforcing mode.
Comment 1 Petr Lautrbach 2016-01-22 10:22:11 UTC 
It seems to be duplicate of https://bugzilla.redhat.com/show_bug.cgi?id=1298192 . The kernel-4.3.3-303.fc23 https://bodhi.fedoraproject.org/updates/FEDORA-2016-b59fd603be should fix your problem
Comment 2 Petr Lautrbach 2016-01-22 10:41:06 UTC 
It the kernel doesn't fix your problem feel free to reopen this bug.

*** This bug has been marked as a duplicate of bug 1298192 ***
Note You need to log in before you can comment on or make changes to this bug.