Re: rpm-ostree not showing status because of SELinux

Lukas Vrabec <[email protected]> Tue, 3 Sep 2019 21:24:58 +0200
Newsgroups	gmane.linux.redhat.fedora.selinux
Organization	Red Hat, Inc.
Message-ID	<[email protected]>
On 8/31/19 7:49 PM, arnaud gaboury wrote:
> 
> 
> On Sat, Aug 31, 2019 at 7:37 PM arnaud gaboury <[email protected]
> <mailto:[email protected]>> wrote:
> 
>     I am running Fedora atomic server 29 and start to see weird
>     behaviors due to SELinux since a few days. I did everything I could
>     to fix issues with audit2allow, sealert and audit2why (logs are
>     empty of alerts). Some issues are still here. One example below:
> 
>     -----------------------------
>     % rpm-ostree status
>     error: An SELinux policy prevents this sender from sending this
>     message to this recipient, 0 matched rules; type="method_call",
>     sender=":1.90" (uid=0 pid=1731 comm="/usr/bin/rpm-ostree status "
>     label="sysadm_u:sysadm_r:sysadm_t:s0-s0:c0.c1023")
>     interface="org.projectatomic.rpmostree1.Sysroot"
>     member="RegisterClient" error name="(unset)" requested_reply="0"
>     destination="org.projectatomic.rpmostree1" (uid=0 pid=1734
>     comm="/usr/bin/rpm-ostree start-daemon "
>     label="system_u:system_r:install_t:s0")
>     ---------------------------------------------------------------
> 
>     NOTE: I ssh the machine.
>     A few settings if it can help:
> 
>     ----------------------
>     gab@poppy➤➤ ~ % id -Z
>     sysadm_u:sysadm_r:sysadm_t:s0-s0:c0.c1023
> 
>     gab@poppy➤➤ ~ % semanage login -l
>     ValueError: SELinux policy is not managed or store cannot be accessed.
>     root@poppy➤➤ ~ # semanage login -l
> 
>     Login Name           SELinux User         MLS/MCS Range        Service
> 
>     __default__          unconfined_u         s0-s0:c0.c1023       *
>     gab                  sysadm_u             s0-s0:c0.c1023       *
>     root                 system_u             s0-s0:c0.c1023       *
> 
>     gab@poppy➤➤ ~ % sestatus
>     SELinux status:                 enabled
>     SELinuxfs mount:                /sys/fs/selinux
>     SELinux root directory:         /etc/selinux
>     Loaded policy name:             targeted
>     Current mode:                   enforcing
>     Mode from config file:          enforcing
>     Policy MLS status:              enabled
>     Policy deny_unknown status:     allowed
>     Memory protection checking:     actual (secure)
>     Max kernel policy version:      31
> 
>     gab@poppy➤➤ ~ # cat /etc/sudoers.d/gab
> 
>     gab ALL=(ALL) TYPE=sysadm_t ROLE=sysadm_r ALL
> 
>     gab@poppy➤➤ ~ # ls -alZ /etc/sudoers.d/
>     total 24
>     drwxr-x---.  2 root root system_u:object_r:etc_t:s0       42 Aug 31
>     15:05 .
>     drwxr-xr-x. 90 root root system_u:object_r:etc_t:s0     8192 Aug 31
>     17:09 ..
>     -rw-r--r--.  1 root root unconfined_u:object_r:etc_t:s0   71 Aug 31
>     14:42 gab
>     -rw-r--r--.  1 root root unconfined_u:object_r:etc_t:s0   72 Aug 31
>     15:04 gabx
>     -rw-r--r--.  1 root root unconfined_u:object_r:etc_t:s0  120 Aug 12
>     11:53 louis
> 
>     No more alerts:
>     gab@poppy➤➤ ~ % sealert -b
>     /usr/bin/sealert:32: DeprecationWarning: Importing dbus.glib to use
>     the GLib main loop with dbus-python is deprecated.
>     Instead, use this sequence:
> 
>         from dbus.mainloop.glib import DBusGMainLoop
> 
>         DBusGMainLoop(set_as_default=True)
> 
>       import dbus.glib
>     gab@poppy➤➤ ~ %
>     -----------------------------------------------
> 
>     What can I do to fix the ostree status and more globally fix any
>     SELinux remaing issues. The server has yet to be set up and I don't
>     want to go ahead with lying around issues.
> 
> 
> EDIT:
> 
> I deleted the mapping of user gab:
> ------------
> # semanage login -d gab
> gab@poppy➤➤ ~ % id -Z
> unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
> 
> Now:
> gab@poppy➤➤ ~ % rpm-ostree status
> State: idle
> AutomaticUpdates: disabled
> Deployments:
> ......
> ---------------------
> 
> Everything is OK. What did I wrong with my mapping? How can I change
> user gab from unconfined_u to sysadm_u? Or maybe best is to keep gab as
> unconfined?
> 

Hi,

Could you please put SELinux to permissive mode for testin purposes:

# setenforce 0

Add maaping for user gab (sysadm_u) as you did and logout/login try to
reproduce the issue and attach output from:

# ausearch -m AVC,USER_AVC -ts boot

Thanks,
Lukas.

> 
> 
>     Thank you for help.
> 
> 
> _______________________________________________
> selinux mailing list -- [email protected]
> To unsubscribe send an email to [email protected]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
> 


-- 
Lukas Vrabec
Senior Software Engineer, Security Technologies
Red Hat, Inc.

_______________________________________________
selinux mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
signature.asc (application/pgp-signature, 488 B)