On 06/12/21 09:10 +1100, Nick Urbanik wrote:
On 05/12/21 09:59 -0500, Jonathan Billings wrote:
>> On Dec 5, 2021, at 05:44, Nick Urbanik <nicku(a)nicku.org> wrote:
>> I am regularly having selinux labels changing. This should never
>> happen, but it does quite continuously; many critical executables lose
>> their correct label, preventing me from logging in without a relabel.
>>
>> This is Fedora 35, upgraded over quite a few generations of Fedora.
>> The root file system is ext4 on luks encryption on RAID 1.
>>
>> Any suggestions on how to troubleshoot and determine the cause? I've
>> never had selinux labels decay before.
There is an ongoing problem of decay of selinux labels on this
machine; I would appreciate any suggestions on how to troubleshoot
this I find it alarming.
$ sudo restorecon -rv *
Relabeled /usr/sbin/alsactl from system_u:object_r:bin_t:s0 to
system_u:object_r:alsa_exec_t:s0
Relabeled /usr/sbin/ldconfig from system_u:object_r:bin_t:s0 to
system_u:object_r:ldconfig_exec_t:s0
Relabeled /usr/sbin/pcscd from system_u:object_r:bin_t:s0 to
system_u:object_r:pcscd_exec_t:s0
>I’ve never heard of this happening except in cases where file
systems were mounted in alternate locations and written to. (For example, a chrooted OS
mounted on a livecd)
>
>Maybe it would help if you showed an example of paths and what context you found them
in? Knowing the incorrect context can sometimes help identify what is causing it.
$ sudo restorecon -rv *
Relabeled /etc/cups/client.conf from system_u:object_r:cupsd_etc_t:s0 to
system_u:object_r:etc_t:s0
Relabeled /etc/cups/cupsd.conf.default from system_u:object_r:cupsd_etc_t:s0 to
system_u:object_r:cupsd_rw_etc_t:s0
Relabeled /etc/cups/printers.conf from system_u:object_r:cupsd_etc_t:s0 to
system_u:object_r:cupsd_rw_etc_t:s0
Relabeled /etc/cups/cupsd.conf.rpmnew from system_u:object_r:cupsd_etc_t:s0 to
system_u:object_r:cupsd_rw_etc_t:s0
Relabeled /etc/strongswan/ipsec.secrets from system_u:object_r:ipsec_conf_file_t:s0 to
system_u:object_r:ipsec_key_file_t:s0
Relabeled /etc/sysconfig/snapd from system_u:object_r:etc_t:s0 to
system_u:object_r:snappy_config_t:s0
$ sudo restorecon -rv *
Relabeled /usr/sbin/charon-systemd from system_u:object_r:bin_t:s0 to
system_u:object_r:ipsec_exec_t:s0
Relabeled /usr/sbin/chpasswd from system_u:object_r:bin_t:s0 to
system_u:object_r:passwd_exec_t:s0
Relabeled /usr/sbin/cryptsetup from system_u:object_r:bin_t:s0 to
system_u:object_r:lvm_exec_t:s0
Relabeled /usr/sbin/cupsd from system_u:object_r:bin_t:s0 to
system_u:object_r:cupsd_exec_t:s0
Relabeled /usr/sbin/fsck.btrfs from system_u:object_r:bin_t:s0 to
system_u:object_r:fsadm_exec_t:s0
Relabeled /usr/sbin/fsck.exfat from system_u:object_r:bin_t:s0 to
system_u:object_r:fsadm_exec_t:s0
Relabeled /usr/sbin/groupadd from system_u:object_r:bin_t:s0 to
system_u:object_r:groupadd_exec_t:s0
Relabeled /usr/sbin/groupdel from system_u:object_r:bin_t:s0 to
system_u:object_r:groupadd_exec_t:s0
Relabeled /usr/sbin/groupmod from system_u:object_r:bin_t:s0 to
system_u:object_r:groupadd_exec_t:s0
Relabeled /usr/sbin/grpconv from system_u:object_r:bin_t:s0 to
system_u:object_r:admin_passwd_exec_t:s0
Relabeled /usr/sbin/grpunconv from system_u:object_r:bin_t:s0 to
system_u:object_r:admin_passwd_exec_t:s0
Relabeled /usr/sbin/keepalived from unconfined_u:object_r:bin_t:s0 to
unconfined_u:object_r:keepalived_exec_t:s0
Relabeled /usr/sbin/lpadmin from system_u:object_r:bin_t:s0 to
system_u:object_r:lpr_exec_t:s0
Relabeled /usr/sbin/lpc.cups from system_u:object_r:bin_t:s0 to
system_u:object_r:lpr_exec_t:s0
Relabeled /usr/sbin/lpinfo from system_u:object_r:bin_t:s0 to
system_u:object_r:lpr_exec_t:s0
Relabeled /usr/sbin/lpmove from system_u:object_r:bin_t:s0 to
system_u:object_r:lpr_exec_t:s0
Relabeled /usr/sbin/mkfs.btrfs from system_u:object_r:bin_t:s0 to
system_u:object_r:fsadm_exec_t:s0
Relabeled /usr/sbin/mkfs.exfat from system_u:object_r:bin_t:s0 to
system_u:object_r:fsadm_exec_t:s0
Relabeled /usr/sbin/newusers from system_u:object_r:bin_t:s0 to
system_u:object_r:useradd_exec_t:s0
Relabeled /usr/sbin/nmbd from system_u:object_r:bin_t:s0 to
system_u:object_r:nmbd_exec_t:s0
Relabeled /usr/sbin/php-fpm from system_u:object_r:bin_t:s0 to
system_u:object_r:httpd_exec_t:s0
Relabeled /usr/sbin/pwconv from system_u:object_r:bin_t:s0 to
system_u:object_r:admin_passwd_exec_t:s0
Relabeled /usr/sbin/pwunconv from system_u:object_r:bin_t:s0 to
system_u:object_r:admin_passwd_exec_t:s0
Relabeled /usr/sbin/rngd from system_u:object_r:bin_t:s0 to
system_u:object_r:rngd_exec_t:s0
Relabeled /usr/sbin/smbd from system_u:object_r:bin_t:s0 to
system_u:object_r:smbd_exec_t:s0
Relabeled /usr/sbin/sshd from system_u:object_r:bin_t:s0 to
system_u:object_r:sshd_exec_t:s0
Relabeled /usr/sbin/strongswan from system_u:object_r:bin_t:s0 to
system_u:object_r:ipsec_mgmt_exec_t:s0
Relabeled /usr/sbin/swanctl from system_u:object_r:bin_t:s0 to
system_u:object_r:ipsec_mgmt_exec_t:s0
Relabeled /usr/sbin/useradd from system_u:object_r:bin_t:s0 to
system_u:object_r:useradd_exec_t:s0
Relabeled /usr/sbin/userdel from system_u:object_r:bin_t:s0 to
system_u:object_r:useradd_exec_t:s0
Relabeled /usr/sbin/usermod from system_u:object_r:bin_t:s0 to
system_u:object_r:useradd_exec_t:s0
Relabeled /usr/sbin/vipw from system_u:object_r:bin_t:s0 to
system_u:object_r:admin_passwd_exec_t:s0
Relabeled /usr/sbin/winbindd from system_u:object_r:bin_t:s0 to
system_u:object_r:winbind_exec_t:s0
There are many other examples in /bin, /var/lib, /usr/lib.
--
Nick Urbanik
http://nicku.org nicku(a)nicku.org
GPG: 7FFA CDC7 5A77 0558 DC7A 790A 16DF EC5B BB9D 2C24 ID: BB9D2C24