-
Bug
-
Resolution: Done-Errata
-
Minor
-
rhel-9.4
-
selinux-policy-38.1.28-1.el9
-
None
-
None
-
sst_security_selinux
-
ssg_security
-
14
-
None
-
QE ack
-
False
-
-
No
-
None
-
-
Pass
-
Automated
-
Release Note Not Required
-
None
What were you trying to do that didn't work?
already described in https://bugzilla.redhat.com/show_bug.cgi?id=2240159
Please provide the package NVR for which bug is seen:
selinux-policy-38.1.27-1.el9.noarch
selinux-policy-targeted-38.1.27-1.el9.noarch
How reproducible:
always
Steps to reproduce
- get a RHEL-9.4 machine (the targeted policy is active)
- run the automated test: https://src.fedoraproject.org/tests/selinux/blob/main/f/selinux-policy/systemd-localed
- search for SELinux denials
Expected results
No SELinux denials.
Actual results
---- type=PROCTITLE msg=audit(11/15/2023 20:07:45.108:1648) : proctitle=/usr/lib/systemd/systemd-localed type=PATH msg=audit(11/15/2023 20:07:45.108:1648) : item=1 name=/etc/X11/xorg.conf.d nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(11/15/2023 20:07:45.108:1648) : item=0 name=/etc/X11/ inode=33600699 dev=fd:00 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(11/15/2023 20:07:45.108:1648) : cwd=/ type=SYSCALL msg=audit(11/15/2023 20:07:45.108:1648) : arch=x86_64 syscall=mkdirat success=no exit=EACCES(Permission denied) a0=AT_FDCWD a1=0x56495d1ff093 a2=0755 a3=0x0 items=2 ppid=1 pid=148407 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=systemd-localed exe=/usr/lib/systemd/systemd-localed subj=system_u:system_r:systemd_localed_t:s0 key=(null) type=AVC msg=audit(11/15/2023 20:07:45.108:1648) : avc: denied { create } for pid=148407 comm=systemd-localed name=xorg.conf.d scontext=system_u:system_r:systemd_localed_t:s0 tcontext=system_u:object_r:xserver_etc_t:s0 tclass=dir permissive=0 ---
Additional information:
- clones
-
RHEL-16715 SELinux prevents the systemd-localed from creating the /etc/X11/xorg.conf.d directory [rhel-8]
-
- Closed
-
- links to
-
RHBA-2023:121166 selinux-policy bug fix and enhancement update
- mentioned on
(1 mentioned on)