[Bug 1210140] New: [SELinux] can't install cockpit
http://bugzilla.opensuse.org/show_bug.cgi?id=1210140 Bug ID: 1210140 Summary: [SELinux] can't install cockpit Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team@suse.de Reporter: filippo.bonazzi@suse.com QA Contact: security-team@suse.de Found By: --- Blocker: --- Created attachment 866127 --> http://bugzilla.opensuse.org/attachment.cgi?id=866127&action=edit SELinux AVCs Operating System: openSUSE MicroOS SELinux status, mode and policy name: enabled, enforcing, targeted SELinux policy version and repository: Repository : openSUSE-Tumbleweed-Oss Name : selinux-policy-targeted Version : 20230321-1.1 Arch : noarch Vendor : openSUSE Installed Size : 24.0 MiB Installed : Yes (automatically) Status : up-to-date The software (incl. version) that is affected by the SELinux issue and the error message: cockpit SELinux Audit log: attached Any other important details: This is a fresh MicroOS VM from the qcow2 image [0]. I just created the VM, started it and added the root user. I installed cockpit following the instructions from [1]: $ transactional-update pkg install -t pattern microos-cockpit This completed and I rebooted the system. The instructions are evidently not enough, as many cockpit packages including cockpit are not installed by this, and of course the cockpit socket is not present and cockpit cannot be started. Therefore, I launched another transactional update to install cockpit: $ transactional-update pkg install cockpit This now breaks with this error: ``` (4/5) Installing: cockpit-ws-276.1-4.2.x86_64 [... SELinux: Could not open policy file <= /etc/selinux/targeted/policy/policy.33: Permission denied /usr/sbin/load_policy: Can't load policy: Permission denied grep: /etc/pam.d/cockpit: No such file or directory done] ``` There are several AVCs (attached), I'm not sure if they are related. [0] https://download.opensuse.org/tumbleweed/appliances/openSUSE-MicroOS.x86_64-... [1] https://documentation.suse.com/sle-micro/5.3/html/SLE-Micro-all/article-cock... -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1210140 Filippo Bonazzi <filippo.bonazzi@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|security-team@suse.de |jzerebecki@suse.com -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1210140 http://bugzilla.opensuse.org/show_bug.cgi?id=1210140#c1 --- Comment #1 from Filippo Bonazzi <filippo.bonazzi@suse.com> --- Hi Jan, I'm assigning to you as you're the cockpit maintainer. Cockpit has its own SELinux policy module, so this is not for us in the security team. cockpit-selinux was not installed when I installed the microos_cockpit pattern or the cockpit package itself. I think there's something wrong with the cockpit packaging or the install instructions (or both). -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1210140 Jan Zerebecki <jzerebecki@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|jzerebecki@suse.com |microos-bugs@suse.de -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1210140 Jan Zerebecki <jzerebecki@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jzerebecki@suse.com, | |luna.dragon@suse.com -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1210140 http://bugzilla.opensuse.org/show_bug.cgi?id=1210140#c2 --- Comment #2 from Jan Zerebecki <jzerebecki@suse.com> --- Luna, can you take a look? (In reply to Filippo Bonazzi from comment #1)
Hi Jan, I'm assigning to you as you're the cockpit maintainer.
There are multiple, you should instead assign the bugowner. I did that now. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1210140 http://bugzilla.opensuse.org/show_bug.cgi?id=1210140#c3 --- Comment #3 from Filippo Bonazzi <filippo.bonazzi@suse.com> --- My bad, thanks -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1210140 http://bugzilla.opensuse.org/show_bug.cgi?id=1210140#c4 --- Comment #4 from Luna D Dragon <luna.dragon@suse.com> --- I've tried reproducing this issue in clean vms using the iso and kvm images and have no been able to reproduce this. Would you mind checking if this is still an issue? -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1210140 http://bugzilla.opensuse.org/show_bug.cgi?id=1210140#c5 --- Comment #5 from Filippo Bonazzi <filippo.bonazzi@suse.com> --- Yes, this is still very much an issue. Expected behaviour: 1. Install VM[0] 2. Follow instructions[1] 3. Cockpit works Actual behaviour: 1. Install VM[0] 2. Follow instructions[1]. $ transactional-update pkg install -t pattern microos-cockpit $ systemctl reboot 3. Cockpit is still not present, can't enable cockpit.socket At this point this is already a bug. Let's try to fix it by doing something intuitive and elementary: 4. Try to install cockpit manually. $ transactional-update pkg install cockpit Shows this error: ``` (4/5) Installing: cockpit-ws-276.1-4.2.x86_64 [... SELinux: Could not open policy file <= /etc/selinux/targeted/policy /policy.33: Permission denied /usr/sbin/load_policy: Can't load policy: Permission denied grep: /etc/pam.d/cockpit: No such file or directory done] ``` $ systemctl reboot Snapshot will not boot, system rolls back automatically. [0] https://download.opensuse.org/tumbleweed/appliances/openSUSE-MicroOS.x86_64-... [1] https://documentation.suse.com/sle-micro/5.3/html/SLE-Micro-all/article-cock... -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1210140 http://bugzilla.opensuse.org/show_bug.cgi?id=1210140#c6 --- Comment #6 from Luna D Dragon <luna.dragon@suse.com> --- After looking into this more, this only occurs in the KVM/XEN image we provide, it does not occur on install made with the iso. The same error about `grep: /etc/pam.d/cockpit: No such file or directory` occurs but the install occurs and after rebooting cockpit is available. I believe there is some difference between the qcow2 images and the iso install. I will look into it asap -- You are receiving this mail because: You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠suse.com