Update selinux-policy https://koji.fedoraproject.org/koji/taskinfo?taskID=39199869
Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:
sudo dnf upgrade --refresh --advisory=FEDORA-2019-fefda9dd5ePlease log in to add feedback.
This update has been submitted for testing by zpytela.
This update's test gating status has been changed to 'waiting'.
This update's test gating status has been changed to 'ignored'.
This breaks gnome-software in openQA testing. Trying to install updates it just gets stuck at "Software catalog is being downloaded". The system journal shows quite a lot of AVCs, including ones for
flatpak_helper_twhich are probably the issue here:This update has been pushed to testing.
Bodhi is disabling automatic push to stable due to negative karma. The maintainer may push manually if they determine that the issue is not severe.
Works here, but with one -1 already, it should be fixed before it goes to stable.
There are multiple issues with this update - first it doesn't seem to install correctly:
And after rebooting the system, I'm locked out from logging in (both via GDM and TTY) until I reboot with
enforcing=0since setroubleshoot complains about two mislabeled files:Also I'm wondering why this package isn't a critpath package ...
Doesn't report "SELinux is preventing 11-dhclient from add_name access on the directory chrony.servers.wlp3s0." any longer, but generates new trouble.
https://bugzilla.redhat.com/show_bug.cgi?id=1770698#c29
EDIT: Sorry, nevermind, it's a critpath package after all, the icon is just really small in the new bodhi interface.
Not good at all! Broke system login with user accounts, root account and even emergency shell login. Had to add
selinux=0as a kernel parameter at boot to get into my system.This update has been obsoleted.
Unable to add local policy modules with this version using semodule. I end up getting
errors. Downgrading to the previous version (3.14.4-40.fc31) allows me to add local policies
During dnf update: Upgrading : rpm-plugin-selinux-4.15.1-1.fc31.x86_64 11/142 Upgrading : selinux-policy-3.14.4-42.fc31.noarch 12/142 Running scriptlet: selinux-policy-3.14.4-42.fc31.noarch 12/142 Running scriptlet: selinux-policy-targeted-3.14.4-42.fc31.noarch 13/142 Upgrading : selinux-policy-targeted-3.14.4-42.fc31.noarch 13/142 Running scriptlet: selinux-policy-targeted-3.14.4-42.fc31.noarch 13/142 Conflicting name type transition rules Binary policy creation failed at /var/lib/selinux/targeted/tmp/modules/200/container/cil:1786 Failed to generate binary /usr/sbin/semodule: Failed!
Hi All, Thank you for reports.
Both policies mentioned in the report are not shipped by selinux-policy package, (containers-selinux and flatpak) but we're investigating the issue.
Thanks, Lukas.
Workaround described here: https://bugzilla.redhat.com/show_bug.cgi?id=1776034#c5
There is also another workaround downgrade selinux-policcy to -41 + reinstall the package container-slienux https://bugzilla.redhat.com/show_bug.cgi?id=1776248#c5
Seems to be more of an issue with container-selinux:
https://github.com/containers/container-selinux/pull/84
I doubt it - I don't even have container-selinux installed on my system.
The openQA update tests are strictly limited to the update in question: we start from a disk image built by virt-install, update it from the stable update repository, then add a repository containing only packages from the update. The openQA test fails consistently when run on this update, but passes when run on other updates. So the problem is definitely caused by this update, not by anything else.
@adamwill, would it be possible to run testsuite with scratch builds? (I could provide scratch builds)
THanks, Lukas.
@adamwill, Sure this bodhi update caused issues in openQA tests. But it does not mean that the real bug was in selinux-policy. It could just reveal bug in container-selinux.
I rebuild the latest container-selinux from rawhide on f31[1] and I cannot reproduce BZ1776248 with selinux-policy-3.14.4-42.fc31.noarch + container-selinux-2:2.123.0-0.1.dev.git661a904.fc31.noarch
[1] https://koji.fedoraproject.org/koji/taskinfo?taskID=39375295
@lvrabec yes, I can test scratch builds. Just give me the link and I can fire it. @lslebodn , if you think this should be fixed by changing container-selinux, we need to confirm it with container-selinux devs and add a container-selinux build to this update...@dwalsh , ping on this?
@adamwill, I worked with @dwalsh on fixes, so from my POV it's good to go, but let's wait for formal ack from @dwalsh. As @lslebodn proposed on IRC, this should be in group update selinux-policy + container-selinux package. BUT we need increase selinux-policy required in container-selinux package.
I can confirm the updated container-selinux-2.123.0-1.fc31 package does not trigger an error any longer on either of my systems together with selinux-policy-3.14.4-42.fc31.
so @dwalsh , could you update container-selinux to depend on a newer selinux-policy , and then we can add the new container-selinux build to this update and obsolete FEDORA-2019-edc1551b22 ? thanks!
In regard to BZ#1755396:
Package selinux-policy-3.14.4-42.fc31 works better - but the problem is not gone with it. I now find the following in dmesg:
[ 23.565628] audit: type=1130 audit(1574968794.744:64): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd- cryptsetup@luks\x2dstratis\x2dssd\x2dvg comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' [ 23.574364] device-mapper: table: 253:11: cache: unknown target type [ 23.574396] audit: type=1400 audit(1574968794.753:65): avc: denied { module_request } for pid=1058 comm="stratisd" kmod="dm-cache" scontext=system_u:system_r:stratisd_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system permissive=0 [ 23.575494] device-mapper: ioctl: error adding target to table [ 23.632232] device-mapper: table: 253:11: cache: unknown target type [ 23.632265] audit: type=1400 audit(1574968794.811:66): avc: denied { module_request } for pid=1058 comm="stratisd" kmod="dm-cache" scontext=system_u:system_r:stratisd_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system permissive=0 [ 23.633468] device-mapper: ioctl: error adding target to table [ 23.637369] audit: type=1130 audit(1574968794.816:67): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-cryptsetup@luks\x2dstratis\x2dhdd\x2dvg comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' [ 23.676220] device-mapper: table: 253:11: cache: unknown target type [ 23.676252] audit: type=1400 audit(1574968794.855:68): avc: denied { module_request } for pid=1058 comm="stratisd" kmod="dm-cache" scontext=system_u:system_r:stratisd_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system permissive=0 [ 23.677704] device-mapper: ioctl: error adding target to table
In regard to BZ#1755396, With the selinux warning browser, I see the following problems with selinux-policy-3.14.4-42.fc31:
adamwill edited this update.
New build(s):
Removed build(s):
Karma has been reset.
This update has been submitted for testing by adamwill.
OK, so I updated container-selinux's dependency on selinux-policy and bumped the update. Hopefully everything should work now, except possibly @aanno 's bug, but unless the update makes it worse, that's not a reason to -1 it. Please let us know if anyone still sees things worse than the previous stable policy.
@adamwill, thank you for your help, on my vms the update goes well with no errors reported and the system overall looks good. I am going to create another selinux-policy build soon for both f31 and f30 once this update and its f30 version get into stable repos as there are enough of new bugs which need to be addressed.
@aanno, there are a lot of unlabeled_t types which can mislead in troubleshooting, please test this build and then run ausearch again to identify additional possible missing permissions.
openQA updates all pass, so looks good to me too.
This update has been pushed to testing.
The upgrade to -43 still causes this scriptlet failure:
Note that I don't have container-selinux installed on this system.
Reinstalling this package with
sudo dnf reinstall selinux-policy-targetedworked, rebooted the system, and don't get any AVC denials (so far) ... so I'm withholding judgement for now, because of the scriptlet failureRegarding BZ#1755396 I find the following in /var/log/message:
This update can be pushed to stable now if the maintainer wishes
@decathorpe, did you have container-selinux installed at some point in the past? Please check if the module exists on the filesystem and try to remove it manually:
ls -la /var/lib/selinux/targeted/active/modules/200/container/ semodule -X200 -r container
This is a formated version of the 2 commands:
@zpytela yes, I once had that package installed (I think it was pulled in by podman, but I removed that container stuff again). the directory was present, but "semodule -X100 -r container" removed it. downgrading and upgrading selinux-policy again now works without problems, thanks :)
This update has been submitted for stable by adamwill.
This update has been pushed to stable.