Re: [atomic-devel] can fedora atomic 23 be upgraded to 24

[Miroslav Grepl <mgrepl redhat com>]

On 06/22/2016 04:59 PM, Eric Paris wrote:
> It would make sense if rpm-ostreed ran as non init_t and if that type
> have MAC_ADMIN. Not much we that can be done to fix it now, but we
> could fix policy for 24->25...
> 
> -Eric
> 
> On Wed, 2016-06-22 at 10:56 -0400, Micah Abbott wrote:
>> On 06/22/2016 09:34 AM, Muayyad AlSadi wrote:
>>> now, it gave me
>>>
>>> error: fsetxattr: Invalid argument
>>>
>>> I'll try "setenforce 0" and and see
>>
>> I saw the same.
>>
>> The following journal entries look relevant:
>>
>> Jun 22 14:54:04 rhel-atomic-7.2-test audit[1286]: AVC
>> avc:  denied  { 
>> mac_admin } for  pid=1286 comm="pool" capability=33 
>> scontext=system_u:system_r:init_t:s0 
>> tcontext=system_u:system_r:init_t:s0 tclass=capability2 permissive=0
>> Jun 22 14:54:04 rhel-atomic-7.2-test audit: SELINUX_ERR op=setxattr 
>> invalid_context="system_u:object_r:systemd_rfkill_unit_file_t:s0"
>> Jun 22 14:54:04 rhel-atomic-7.2-test audit[1286]: SYSCALL
>> arch=c000003e 
>> syscall=190 success=no exit=-22 a0=2b a1=7fd16c0091f1
>> a2=7fd16c009202 
>> a3=30 items=0 ppid=1 pid=1286 auid=4294967295 uid=0 gid=0 euid=0
>> suid=0 
>> fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="pool" 
>> exe="/usr/libexec/rpm-ostreed" subj=system_u:system_r:init_t:s0
>> key=(null)
>> Jun 22 14:54:04 rhel-atomic-7.2-test audit: PROCTITLE 
>> proctitle="/usr/libexec/rpm-ostreed"
>> Jun 22 14:54:04 rhel-atomic-7.2-test audit[1288]: AVC
>> avc:  denied  { 
>> mac_admin } for  pid=1288 comm="pool" capability=33 
>> scontext=system_u:system_r:init_t:s0 
>> tcontext=system_u:system_r:init_t:s0 tclass=capability2 permissive=0
>> Jun 22 14:54:04 rhel-atomic-7.2-test audit: SELINUX_ERR op=setxattr 
>> invalid_context="system_u:object_r:systemd_resolved_unit_file_t:s0"
>> Jun 22 14:54:04 rhel-atomic-7.2-test audit[1288]: SYSCALL
>> arch=c000003e 
>> syscall=190 success=no exit=-22 a0=2d a1=7fd188009fa1
>> a2=7fd188009fb2 
>> a3=32 items=0 ppid=1 pid=1288 auid=4294967295 uid=0 gid=0 euid=0
>> suid=0 
>> fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="pool" 
>> exe="/usr/libexec/rpm-ostreed" subj=system_u:system_r:init_t:s0
>> key=(null)
>> Jun 22 14:54:04 rhel-atomic-7.2-test audit: PROCTITLE 
>> proctitle="/usr/libexec/rpm-ostreed"
>>

Colin,
correct me if I am wrong but AFAIK we know about this issue and we have
a bug. Let me find the bug.

-- 
Miroslav Grepl
Senior Software Engineer, SELinux Solutions
Red Hat, Inc.