New F33 selinux-policy build: https://koji.fedoraproject.org/koji/taskinfo?taskID=51737666
Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:
sudo dnf upgrade --refresh --advisory=FEDORA-2020-2be8afa1abPlease login to add feedback.
This update has been submitted for testing by zpytela.
This update's test gating status has been changed to 'ignored'.
This update's test gating status has been changed to 'waiting'.
This update's test gating status has been changed to 'ignored'.
#1870476 is fixed and the system boots. I haven't used this for long, though.
This update has been pushed to testing.
This update can be pushed to stable now if the maintainer wishes
Works
This update has been submitted for stable by bodhi.
works
Works fine
This update has been pushed to stable.
SELinux is preventing chronyd from read access on the file wlp3s0.sources.
* Plugin catchall (100. confidence) suggests ******
If you believe that chronyd should be allowed read access on the wlp3s0.sources file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing:
ausearch -c 'chronyd' --raw | audit2allow -M my-chronyd
semodule -X 300 -i my-chronyd.pp
@clnetbox Please show the AVC denials. We already have a bz https://bugzilla.redhat.com/show_bug.cgi?id=1880948
time->Fri Sep 25 08:09:14 2020 type=AVC msg=audit(1601014154.941:198): avc: denied { read } for pid=863 comm="chronyd" name="wlp3s0.sources" dev="tmpfs" ino=34309 scontext=system_u:system_r:chronyd_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file permissive=0
time->Fri Sep 25 08:09:15 2020 type=AVC msg=audit(1601014155.370:274): avc: denied { read } for pid=863 comm="chronyd" name="wlp3s0.sources" dev="tmpfs" ino=34309 scontext=system_u:system_r:chronyd_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file permissive=0
time->Fri Sep 25 08:09:15 2020 type=AVC msg=audit(1601014155.390:276): avc: denied { read } for pid=863 comm="chronyd" name="wlp3s0.sources" dev="tmpfs" ino=34309 scontext=system_u:system_r:chronyd_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file permissive=0
time->Fri Sep 25 08:09:15 2020 type=AVC msg=audit(1601014155.586:296): avc: denied { read } for pid=863 comm="chronyd" name="wlp3s0.sources" dev="tmpfs" ino=34309 scontext=system_u:system_r:chronyd_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file permissive=0
time->Fri Sep 25 08:09:15 2020 type=AVC msg=audit(1601014155.606:297): avc: denied { read } for pid=863 comm="chronyd" name="wlp3s0.sources" dev="tmpfs" ino=34309 scontext=system_u:system_r:chronyd_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file permissive=0
time->Fri Sep 25 08:14:27 2020 type=AVC msg=audit(1601014467.084:187): avc: denied { read } for pid=866 comm="chronyd" name="wlp3s0.sources" dev="tmpfs" ino=35165 scontext=system_u:system_r:chronyd_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file permissive=0
time->Fri Sep 25 08:14:27 2020 type=AVC msg=audit(1601014467.784:262): avc: denied { read } for pid=866 comm="chronyd" name="wlp3s0.sources" dev="tmpfs" ino=35165 scontext=system_u:system_r:chronyd_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file permissive=0
time->Fri Sep 25 08:14:27 2020 type=AVC msg=audit(1601014467.807:264): avc: denied { read } for pid=866 comm="chronyd" name="wlp3s0.sources" dev="tmpfs" ino=35165 scontext=system_u:system_r:chronyd_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file permissive=0
time->Fri Sep 25 08:14:27 2020 type=AVC msg=audit(1601014467.929:284): avc: denied { read } for pid=866 comm="chronyd" name="wlp3s0.sources" dev="tmpfs" ino=35165 scontext=system_u:system_r:chronyd_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file permissive=0
time->Fri Sep 25 08:14:27 2020 type=AVC msg=audit(1601014467.948:285): avc: denied { read } for pid=866 comm="chronyd" name="wlp3s0.sources" dev="tmpfs" ino=35165 scontext=system_u:system_r:chronyd_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file permissive=0
Thanks, the denials are the same, so let's continue in the referred bz. I'd like to find the action which triggers the denials.