Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1359446 - SELinux is preventing (coredump) from mounton access on the directory /etc
Summary: SELinux is preventing (coredump) from mounton access on the directory /etc
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 24
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Lukas Vrabec
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-07-24 00:44 UTC by Chris Murphy
Modified: 2016-08-12 22:24 UTC (History)
7 users (show)

Fixed In Version: selinux-policy-3.13.1-191.9.fc24 selinux-policy-3.13.1-191.10.fc24
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-08-12 19:29:24 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
sealert output (3.10 KB, text/plain)
2016-07-24 00:44 UTC, Chris Murphy
no flags Details

Description Chris Murphy 2016-07-24 00:44:11 UTC
Description of problem:


I see this message in the journal, and once today I saw a notification for it in GNOME which lastest only very briefly even though I didn't dismiss the message.

Version-Release number of selected component (if applicable):
selinux-policy-3.13.1-191.5.fc24.noarch

How reproducible:
Frequently, I have several of these from the past couple days, but I'm not exactly sure what's triggering it.

Steps to Reproduce:
1. Unknown


Actual results:

type=AVC msg=audit(1469306689.434:87): avc:  denied  { mounton } for  pid=785 comm="(uetoothd)" path="/etc" dev="sda5" ino=267 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=0


Expected results:

Either no denial, or 


Additional info:


Could be related to bug 1341753. comm=uetoothd in the AVC but sealert as well as the journal information on this event says the source is coredump.

Comment 1 Chris Murphy 2016-07-24 00:44:45 UTC
Created attachment 1183239 [details]
sealert output

Comment 2 Chris Murphy 2016-07-24 00:54:03 UTC
OK so it looks like there's a bluetooth issue:

Jul 23 14:44:49 f24m bluetoothd[785]: Failed to obtain handles for "Service Changed" characteristic

And abrt wants to capture some info about it, and wants to create some directory, which then results in the AVC.

Jul 23 14:44:52 f24m abrt-dump-journal-oops[882]: abrt-dump-journal-oops: Found oopses: 1
Jul 23 14:44:52 f24m abrt-dump-journal-oops[882]: abrt-dump-journal-oops: Creating problem directories
Jul 23 14:44:52 f24m setroubleshoot[908]: SELinux is preventing (coredump) from mounton access on the directory /etc. For complete SELinux messages. run sealert -l 3fe792d7-2dc0-4379-9386-00ff207e4291

Comment 3 notadrop 2016-07-24 06:55:15 UTC
Ever since I installed the package "powetop" I have begun to see this notification from the SELinux Troubleshooter on every boot. Perhaps this is related?

See below:

SELinux is preventing (uetoothd) from mounton access on the directory /etc.

*****  Plugin catchall_labels (83.8 confidence) suggests   *******************

If you want to allow (uetoothd) to have mounton access on the etc directory
Then you need to change the label on /etc
Do
# semanage fcontext -a -t FILE_TYPE '/etc'
where FILE_TYPE is one of the following: admin_home_t, anon_inodefs_t, audit_spool_t, auditd_log_t, autofs_t, automount_tmp_t, bacula_store_t, binfmt_misc_fs_t, boot_t, capifs_t, cephfs_t, cgroup_t, cifs_t, container_image_t, debugfs_t, default_t, device_t, devpts_t, dnssec_t, dosfs_t, ecryptfs_t, efivarfs_t, fusefs_t, home_root_t, hugetlbfs_t, ifconfig_var_run_t, init_var_run_t, initrc_tmp_t, iso9660_t, kdbusfs_t, mail_spool_t, mnt_t, mqueue_spool_t, named_conf_t, news_spool_t, nfs_t, nfsd_fs_t, onload_fs_t, openshift_tmp_t, openshift_var_lib_t, oracleasmfs_t, proc_t, proc_xen_t, pstore_t, public_content_rw_t, public_content_t, ramfs_t, random_seed_t, removable_t, root_t, rpc_pipefs_t, security_t, spufs_t, src_t, svirt_sandbox_file_t, sysctl_fs_t, sysctl_t, sysfs_t, sysv_t, tmp_t, tmpfs_t, usbfs_t, user_home_dir_t, user_home_t, user_tmp_t, usr_t, var_lib_nfs_t, var_lib_t, var_lock_t, var_log_t, var_run_t, var_t, virt_image_t, virt_var_lib_t, vmblock_t, vxfs_t, xend_var_lib_t, xend_var_run_t, xenfs_t, xenstored_var_lib_t.
Then execute:
restorecon -v '/etc'


*****  Plugin catchall (17.1 confidence) suggests   **************************

If you believe that (uetoothd) should be allowed mounton access on the etc directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c '(uetoothd)' --raw | audit2allow -M my-uetoothd
# semodule -X 300 -i my-uetoothd.pp

Additional Information:
Source Context                system_u:system_r:init_t:s0
Target Context                system_u:object_r:etc_t:s0
Target Objects                /etc [ dir ]
Source                        (uetoothd)
Source Path                   (uetoothd)
Port                          <Unknown>
Host                          vishnu
Source RPM Packages           
Target RPM Packages           filesystem-3.2-37.fc24.x86_64
Policy RPM                    selinux-policy-3.13.1-191.5.fc24.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     vishnu
Platform                      Linux vishnu 4.6.4-301.fc24.x86_64 #1 SMP Tue Jul
                              12 11:50:00 UTC 2016 x86_64 x86_64
Alert Count                   15
First Seen                    2016-07-20 00:19:27 MDT
Last Seen                     2016-07-24 00:47:44 MDT
Local ID                      b8381d75-0b93-4365-a11f-912f364c00cd

Raw Audit Messages
type=AVC msg=audit(1469342864.699:208): avc:  denied  { mounton } for  pid=1604 comm="(uetoothd)" path="/etc" dev="dm-0" ino=1703937 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=0


Hash: (uetoothd),init_t,etc_t,dir,mounton

Comment 4 notadrop 2016-07-24 06:56:00 UTC
Apologies for the typo. The above comment should specify a package named "powertop"

Comment 5 schlaffi 2016-08-09 20:12:34 UTC
I see this too. Since I am (an unskilled) developer, this pops up everytime I manage to coredump. This is although I have set Storage=none in /etc/systemd/coredump.conf . (Btw, the idea that in the default configuration all my precious passwords are floating around in /var/*/coredump gives me nightmares...)

Comment 6 Fedora Update System 2016-08-10 12:24:43 UTC
selinux-policy-3.13.1-191.10.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-2c8a3e08c6

Comment 7 Fedora Update System 2016-08-12 19:28:35 UTC
selinux-policy-3.13.1-191.10.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.

Comment 8 notadrop 2016-08-12 22:24:13 UTC
I have updated my system and also installed the testing update of the "selinux-policy.noarch" package. The problem appears to be solved. I will, of course, report back if anything changes in that regard.


Note You need to log in before you can comment on or make changes to this bug.