Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 984981 - SELinux is preventing systemd-tmpfile from using the 'sys_admin' capabilities.
Summary: SELinux is preventing systemd-tmpfile from using the 'sys_admin' capabilities.
Keywords:
Status: CLOSED INSUFFICIENT_DATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 19
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:dabdb3d7f945694ae5513e7b4e1...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-07-16 14:01 UTC by plioski
Modified: 2020-04-28 07:02 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-08-22 12:15:29 UTC
Type: ---
Embargoed:

Attachments (Terms of Use)
Comment (81.54 KB, text/plain)
2013-07-18 06:48 UTC, plioski 		no flags Details
View All

Description plioski 2013-07-16 14:01:44 UTC 
Description of problem:
SELinux is preventing systemd-tmpfile from using the 'sys_admin' capabilities.

*****  Plugin catchall (100. confidence) suggests  ***************************

If si pensa che systemd-tmpfile dovrebbe avere funzionalità sys_admin in modo predefinito.
Then si dovrebbe riportare il problema come bug.
E' possibile generare un modulo di politica locale per consentire questo accesso.
Do
consentire questo accesso per il momento eseguendo:
# grep systemd-tmpfile /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:systemd_tmpfiles_t:s0
Target Context                system_u:system_r:systemd_tmpfiles_t:s0
Target Objects                 [ capability ]
Source                        systemd-tmpfile
Source Path                   systemd-tmpfile
Port                          <Sconosciuto>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.12.1-63.fc19.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.9.8-300.fc19.x86_64 #1 SMP Thu
                              Jun 27 19:24:23 UTC 2013 x86_64 x86_64
Alert Count                   3
First Seen                    2013-07-16 15:55:31 CEST
Last Seen                     2013-07-16 15:55:31 CEST
Local ID                      17504358-0b2d-46b3-9cd6-c32583eb03e0

Raw Audit Messages
type=AVC msg=audit(1373982931.280:260): avc:  denied  { sys_admin } for  pid=353 comm="systemd-tmpfile" capability=21  scontext=system_u:system_r:systemd_tmpfiles_t:s0 tcontext=system_u:system_r:systemd_tmpfiles_t:s0 tclass=capability


Hash: systemd-tmpfile,systemd_tmpfiles_t,systemd_tmpfiles_t,capability,sys_admin

Additional info:
reporter:       libreport-2.1.5
hashmarkername: setroubleshoot
kernel:         3.9.8-300.fc19.x86_64
type:           libreport
Comment 1 Daniel Walsh 2013-07-16 17:24:01 UTC 
Would be nice if we new what syscall it was attempting.
Comment 2 Eric Paris 2013-07-16 20:28:10 UTC 
Did you stop collecting the SYSCALL record Dan?  There should always be a SYSCALL record in the audit log, even if no rules are loaded.  Loading rules only gives you PATHNAME records...

This is the second bug without an associated SYSCALL record...
Comment 3 Daniel Walsh 2013-07-17 17:25:35 UTC 
No code changes to this code in years.

 plioski

Can you attach the output of 

ausearch -m avc -i
Comment 4 plioski 2013-07-18 06:48:48 UTC 
Created attachment 915737 [details]
Comment

(This comment was longer than 65,535 characters and has been moved to an attachment by Red Hat Bugzilla).
Comment 5 Daniel Walsh 2013-07-24 22:13:59 UTC 
Why is systemd-tmpfiles going into /sys/kernel/debug/vgaswitcheroo/switch?
Comment 6 Mark Harig 2013-08-11 07:39:44 UTC 
Description of problem:
The SELinux alert simply appeared, likely due to the systemd-tmpfile service carrying out its tasks to remove old temporary files.

Additional info:
reporter:       libreport-2.1.6
hashmarkername: setroubleshoot
kernel:         3.10.5-201.fc19.x86_64
type:           libreport
Comment 7 Daniel Walsh 2013-08-12 14:03:31 UTC 
I am suprised to see it in those directories.

/sys/kernel/debug/vgaswitcheroo/switch
Comment 8 Lennart Poettering 2013-10-13 19:39:00 UTC 
Hmm, is there some tmpfiles snippet listing things in /sys/kernel/ on your machine?

I.e. do you see anything in /etc/sysctl.d or /usr/lib/sysctl.d/ referencing those dirs? If so, which package is that file from?
Note You need to log in before you can comment on or make changes to this bug.