Bug 1222736 - [SELinux] systemd-gpt-auto-generator blocked by SELinux
Summary: [SELinux] systemd-gpt-auto-generator blocked by SELinux
Status: RESOLVED FIXED
Alias: None
Product: openSUSE Tumbleweed
Classification: openSUSE
Component: Security (show other bugs)
Version: Current
Hardware: Other Other
: P5 - None : Normal (vote)
Target Milestone: ---
Assignee: Cathy Hu
QA Contact: E-mail List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-04-12 15:18 UTC by Richard Brown
Modified: 2024-05-16 12:04 UTC (History)
1 user (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Richard Brown 2024-04-12 15:18:32 UTC
Pretty straight forward it seems, looks like SELinux doesn't like systemd-gpt-auto-generator and systemd-fstab-generator doing their thing. Logs below

This has minor impact right now on openSUSE Aeon which is using a Discoverable Partition Standard (DPS) compliant partition standard, which is probably what triggers systemd-gpt-auto-generator from doing it's thing

But practically speaking those same Aeon users are unlikely to notice an issue as the root filesystem is also defined properly in /etc/fstab and won't be any time soon

Will be a problem for anyone not using Aeon someday though

Apr 12 19:02:27 localhost (sd-exec-[761]: /usr/lib/systemd/system-generators/systemd-gpt-auto-generator failed with exit status 1.
Apr 12 19:02:27 localhost systemd-gpt-auto-generator[769]: Failed to create symlink "/run/systemd/generator.late/local-fs.target.wants/systemd-remount-fs.service": No such file or directory
Apr 12 19:02:27 localhost kernel: audit: type=1400 audit(1712941346.966:6): avc:  denied  { write } for  pid=769 comm="systemd-gpt-aut" name="generator.late" dev="tmpfs" ino=597 scontext=system_u:system_r:systemd_gpt_generator_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=dir permissive=0
Apr 12 19:02:27 localhost kernel: audit: type=1400 audit(1712941346.926:5): avc:  denied  { map_read map_write } for  pid=769 comm="systemd-gpt-aut" scontext=system_u:system_r:systemd_gpt_generator_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=bpf permissive=0
Apr 12 19:02:27 localhost kernel: audit: type=1400 audit(1712941346.919:4): avc:  denied  { map_read map_write } for  pid=767 comm="systemd-fstab-g" scontext=system_u:system_r:systemd_fstab_generator_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=bpf permissive=0
Comment 1 Cathy Hu 2024-04-15 14:48:17 UTC
I submitted to security:SELinux:
https://build.opensuse.org/package/show/security:SELinux/selinux-policy

Could you please test this and report if that solved the complete issue? Thanks!
Comment 2 Richard Brown 2024-04-17 14:48:50 UTC
It seems to have solved the issue, thanks!
Comment 3 Cathy Hu 2024-04-18 13:46:37 UTC
thanks, closing