On 8/31/19 7:49 PM, arnaud gaboury wrote:
On Sat, Aug 31, 2019 at 7:37 PM arnaud gaboury <arnaud.gaboury(a)gmail.com
<mailto:arnaud.gaboury@gmail.com>> wrote:
I am running Fedora atomic server 29 and start to see weird
behaviors due to SELinux since a few days. I did everything I could
to fix issues with audit2allow, sealert and audit2why (logs are
empty of alerts). Some issues are still here. One example below:
-----------------------------
% rpm-ostree status
error: An SELinux policy prevents this sender from sending this
message to this recipient, 0 matched rules; type="method_call",
sender=":1.90" (uid=0 pid=1731 comm="/usr/bin/rpm-ostree status
"
label="sysadm_u:sysadm_r:sysadm_t:s0-s0:c0.c1023")
interface="org.projectatomic.rpmostree1.Sysroot"
member="RegisterClient" error name="(unset)"
requested_reply="0"
destination="org.projectatomic.rpmostree1" (uid=0 pid=1734
comm="/usr/bin/rpm-ostree start-daemon "
label="system_u:system_r:install_t:s0")
---------------------------------------------------------------
NOTE: I ssh the machine.
A few settings if it can help:
----------------------
gab@poppy➤➤ ~ % id -Z
sysadm_u:sysadm_r:sysadm_t:s0-s0:c0.c1023
gab@poppy➤➤ ~ % semanage login -l
ValueError: SELinux policy is not managed or store cannot be accessed.
root@poppy➤➤ ~ # semanage login -l
Login Name SELinux User MLS/MCS Range Service
__default__ unconfined_u s0-s0:c0.c1023 *
gab sysadm_u s0-s0:c0.c1023 *
root system_u s0-s0:c0.c1023 *
gab@poppy➤➤ ~ % sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: targeted
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 31
gab@poppy➤➤ ~ # cat /etc/sudoers.d/gab
gab ALL=(ALL) TYPE=sysadm_t ROLE=sysadm_r ALL
gab@poppy➤➤ ~ # ls -alZ /etc/sudoers.d/
total 24
drwxr-x---. 2 root root system_u:object_r:etc_t:s0 42 Aug 31
15:05 .
drwxr-xr-x. 90 root root system_u:object_r:etc_t:s0 8192 Aug 31
17:09 ..
-rw-r--r--. 1 root root unconfined_u:object_r:etc_t:s0 71 Aug 31
14:42 gab
-rw-r--r--. 1 root root unconfined_u:object_r:etc_t:s0 72 Aug 31
15:04 gabx
-rw-r--r--. 1 root root unconfined_u:object_r:etc_t:s0 120 Aug 12
11:53 louis
No more alerts:
gab@poppy➤➤ ~ % sealert -b
/usr/bin/sealert:32: DeprecationWarning: Importing dbus.glib to use
the GLib main loop with dbus-python is deprecated.
Instead, use this sequence:
from dbus.mainloop.glib import DBusGMainLoop
DBusGMainLoop(set_as_default=True)
import dbus.glib
gab@poppy➤➤ ~ %
-----------------------------------------------
What can I do to fix the ostree status and more globally fix any
SELinux remaing issues. The server has yet to be set up and I don't
want to go ahead with lying around issues.
EDIT:
I deleted the mapping of user gab:
------------
# semanage login -d gab
gab@poppy➤➤ ~ % id -Z
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
Now:
gab@poppy➤➤ ~ % rpm-ostree status
State: idle
AutomaticUpdates: disabled
Deployments:
......
---------------------
Everything is OK. What did I wrong with my mapping? How can I change
user gab from unconfined_u to sysadm_u? Or maybe best is to keep gab as
unconfined?
Hi,
Could you please put SELinux to permissive mode for testin purposes:
# setenforce 0
Add maaping for user gab (sysadm_u) as you did and logout/login try to
reproduce the issue and attach output from:
# ausearch -m AVC,USER_AVC -ts boot
Thanks,
Lukas.
Thank you for help.
_______________________________________________
selinux mailing list -- selinux(a)lists.fedoraproject.org
To unsubscribe send an email to selinux-leave(a)lists.fedoraproject.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/selinux@lists.fedoraproject...
--
Lukas Vrabec
Senior Software Engineer, Security Technologies
Red Hat, Inc.