On Fri, 31 Jul 2020 05:51:21 +0800
Ed Greshko <ed.greshko(a)greshko.com> wrote:
Well, it seems similar issues have come up in the past.
https://bugzilla.redhat.com/show_bug.cgi?id=1309108
and
https://bugzilla.redhat.com/show_bug.cgi?id=1298192
You may want to try the work around in comment 19 of that one.
I think it is already in place as the command
sesearch -A -s unconfined_t -t user_cron_spool_t -c file
found
allow application_domain_type user_cron_spool_t:file { append getattr ioctl lock read
write };
allow crontab_domain user_cron_spool_t:file { append create getattr ioctl link lock open
read rename setattr unlink write };
allow domain file_type:file map; [ domain_can_mmap_files ]:True
allow files_unconfined_type file_type:file execmod; [ selinuxuser_execmod ]:True
allow files_unconfined_type file_type:file { append audit_access create execute
execute_no_trans getattr ioctl link lock map mounton open quotaon read relabelfrom
relabelto rename setattr swapon unlink write };
allow unconfined_t user_cron_spool_t:file entrypoint; [ cron_userdomain_transition ]:True
allow unconfined_t user_cron_spool_t:file { getattr ioctl read write };
and the second from the bottom is that workaround.
I think you should then wait on your BZ as well as you may want to
join/ask on the selinux mailing list.
I agree, I'll wait a while to see if anything develops, and then ask
there. Hey, it is F31, so going end of life in a few months,
seems to work fine except for this corner case, so probably not a
priority.