-
Bug
-
Resolution: Unresolved
-
Normal
-
rhel-10.1
-
selinux-policy-42.1.5-1.el10
-
Yes
-
Important
-
1
-
rhel-security-selinux
-
25
-
1
-
QE ack
-
False
-
False
-
-
No
-
SELINUX 250827: 11
-
-
Pass
-
Automated
-
Release Note Not Required
-
Unspecified
-
Unspecified
-
Unspecified
-
None
What were you trying to do that didn't work?
Recently hit a new avc warning
[root@rhel-10-upk ~]# setenforce 0
[root@rhel-10-upk ~]#
[root@rhel-10-upk ~]# cat /etc/exports
/export_test *(rw,no_root_squash)
[root@rhel-10-upk ~]# systemctl daemon-reload
[root@rhel-10-upk ~]# grep denied /var/log/audit/audit.log
type=AVC msg=audit(1753755310.006:325): avc: denied { add_name } for pid=6490 comm="nfs-server-gene" name="nfs-server.service.d" scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:object_r:systemd_generator_unit_file_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1753755310.006:325): avc: denied { create } for pid=6490 comm="nfs-server-gene" name="nfs-server.service.d" scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:object_r:systemd_generator_unit_file_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1753755310.007:326): avc: denied { create } for pid=6490 comm="nfs-server-gene" name="order-with-mounts.conf" scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:object_r:systemd_generator_unit_file_t:s0 tclass=file permissive=1
type=AVC msg=audit(1753755310.007:326): avc: denied { write } for pid=6490 comm="nfs-server-gene" path="/run/systemd/generator/nfs-server.service.d/order-with-mounts.conf" dev="tmpfs" ino=2314 scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:object_r:systemd_generator_unit_file_t:s0 tclass=file permissive=1
[root@rhel-10-upk ~]# rpm -qa selinux-policy\*
selinux-policy-42.1.3-1.el10.noarch
selinux-policy-targeted-42.1.3-1.el10.noarch
selinux-policy-targeted-extra-42.1.3-1.el10.noarch
selinux-policy-extra-42.1.3-1.el10.noarch
[root@rhel-10-upk ~]#
What is the impact of this issue to you?
Please provide the package NVR for which the bug is seen:
How reproducible is this bug?:
Steps to reproduce
- mkdir -p /export_test
- echo '/export_test *(rw)' > /etc/exports
- systemctl daemon-reload
Expected results
Actual results
- links to
-
RHBA-2025:147963
selinux-policy bug fix and enhancement update
