-
Bug
-
Resolution: Duplicate
-
Normal
-
None
-
rhel-9.4.z
-
None
-
No
-
None
-
rhel-sst-security-selinux
-
ssg_security
-
None
-
False
-
-
None
-
None
-
None
-
None
-
None
This has been seen in a couple of gating tests like:
https://dashboard.osci.redhat.com/#/details/brew-build-63578912
Running scriptlet: container-selinux-3:2.229.0-1.el9.noarch 19/23
Could not set context for /var/lib/selinux/targeted/tmp/commit_num: Permission denied
Could not set context for /var/lib/selinux/targeted/tmp/file_contexts: Permission denied
Could not set context for /var/lib/selinux/targeted/tmp/file_contexts.homedirs: Permission denied
Could not set context for /var/lib/selinux/targeted/tmp/homedir_template: Permission denied
Could not set context for /var/lib/selinux/targeted/tmp/modules_checksum: Permission denied
Could not set context for /var/lib/selinux/targeted/tmp/policy.kern: Permission denied
Could not set context for /var/lib/selinux/targeted/tmp/seusers: Permission denied
Could not set context for /var/lib/selinux/targeted/tmp/users_extra: Permission denied
Could not set context for /var/lib/selinux/targeted/tmp/seusers.linked: Permission denied
Could not set context for /var/lib/selinux/targeted/tmp/users_extra.linked: Permission denied
Could not set context for /var/lib/selinux/targeted/tmp/policy.linked: Permission denied
Could not set context for /var/lib/selinux/targeted/tmp/modules/400/permissive_rhcd_t/lang_ext: Permission denied
Could not set context for /var/lib/selinux/targeted/tmp/modules/400/permissive_rhcd_t/cil: Permission denied
Could not set context for /var/lib/selinux/targeted/tmp/modules/400/permissive_rhcd_t: Permission denied
Could not set context for /var/lib/selinux/targeted/tmp/modules/400/restraint/lang_ext: Permission denied
Could not set context for /var/lib/selinux/targeted/tmp/modules/400/restraint/hll: Permission denied
Could not set context for /var/lib/selinux/targeted/tmp/modules/400/restraint/cil: Permission denied
Could not set context for /var/lib/selinux/targeted/tmp/modules/400/restraint: Permission denied
Could not set context for /var/lib/selinux/targeted/tmp/modules/400/rhts/lang_ext: Permission denied
...
We also see a bunch of AVC messages such as:
type=PROCTITLE msg=audit(08/26/2024 04:16:13.956:1731) : proctitle=/usr/sbin/setsebool -P -N virt_use_nfs=1 virt_sandbox_use_all_caps=1
type=SYSCALL msg=audit(08/26/2024 04:16:13.956:1731) : arch=x86_64 syscall=lsetxattr success=no exit=EACCES(Permission denied) a0=0x5623b090a200 a1=0x7f40099a91c5 a2=0x5623b09d6820 a3=0x26 items=0 ppid=23150 pid=23151 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=7 comm=setsebool exe=/usr/sbin/setsebool subj=unconfined_u:unconfined_r:setsebool_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(08/26/2024 04:16:13.956:1731) : avc: denied
----
type=PROCTITLE msg=audit(08/26/2024 04:16:13.956:1732) : proctitle=/usr/sbin/setsebool -P -N virt_use_nfs=1 virt_sandbox_use_all_caps=1
type=SYSCALL msg=audit(08/26/2024 04:16:13.956:1732) : arch=x86_64 syscall=lsetxattr success=no exit=EACCES(Permission denied) a0=0x5623b090a200 a1=0x7f40099a91c5 a2=0x5623b09d6820 a3=0x26 items=0 ppid=23150 pid=23151 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=7 comm=setsebool exe=/usr/sbin/setsebool subj=unconfined_u:unconfined_r:setsebool_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(08/26/2024 04:16:13.956:1732) : avc: denied { relabelfrom }
for pid=23151 comm=setsebool name=hll dev="xvda4" ino=729809068 scontext=unconfined_u:unconfined_r:setsebool_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:semanage_store_t:s0 tclass=file permissive=0