[Bug 1232670] New: [SELinux] importctl cannot write to /var/lib/extensions
https://bugzilla.suse.com/show_bug.cgi?id=1232670 Bug ID: 1232670 Summary: [SELinux] importctl cannot write to /var/lib/extensions Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team@suse.de Reporter: kukuk@suse.com QA Contact: qa-bugs@suse.de Target Milestone: --- Found By: --- Blocker: --- Importing sysext images with importctl does not work, since SELinux blocks writing in that directory: node122:~ # importctl pull-raw --class=sysext https://download.opensuse.org/repositories/home:/kukuk:/sysext/mkosi/gcc-20.... --verify=no Enqueued transfer job 1. Press C-c to continue download in background. Pulling 'https://download.opensuse.org/repositories/home:/kukuk:/sysext/mkosi/gcc-20....', saving as 'gcc-20.2.x86-64'. Operating on image directory '/var/lib/extensions'. Failed to create /var/lib/extensions/.#verityebe0580e99f54026: Permission denied Verity integrity file could not be retrieved, proceeding without. Failed to create /var/lib/extensions/.#roothash96cdb063d430dc58: Permission denied Root hash file could not be retrieved, proceeding without. Failed to create /var/lib/extensions/.#roothash.p7s70c3902ea1954e95: Permission denied Root hash signature file could not be retrieved, proceeding without. Downloading 241.2M for https://download.opensuse.org/repositories/home:/kukuk:/sysext/mkosi/gcc-20..... Failed to create /var/lib/extensions/.#rawd292069b0f58e5ea: Permission denied Failed to retrieve image file. Exiting. type=SERVICE_START msg=audit(1730372760.872:336): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-importd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' type=AVC msg=audit(1730372764.279:337): avc: denied { write } for pid=2413 comm="systemd-pull" name="extensions" dev="dm-0" ino=143939 scontext=system_u:system_r:systemd_importd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1730372764.282:338): avc: denied { write } for pid=2413 comm="systemd-pull" name="extensions" dev="dm-0" ino=143939 scontext=system_u:system_r:systemd_importd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1730372764.289:339): avc: denied { write } for pid=2413 comm="systemd-pull" name="extensions" dev="dm-0" ino=143939 scontext=system_u:system_r:systemd_importd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1730372767.479:340): avc: denied { write } for pid=2413 comm="systemd-pull" name="extensions" dev="dm-0" ino=143939 scontext=system_u:system_r:systemd_importd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=dir permissive=0 type=SERVICE_STOP msg=audit(1730372797.529:341): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-importd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1232670 Thorsten Kukuk <kukuk@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|security-team@suse.de |cathy.hu@suse.com -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1232670 Filippo Bonazzi <filippo.bonazzi@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |filippo.bonazzi@suse.com Assignee|cathy.hu@suse.com |filippo.bonazzi@suse.com -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1232670 https://bugzilla.suse.com/show_bug.cgi?id=1232670#c1 --- Comment #1 from Thorsten Kukuk <kukuk@suse.com> --- importctl is also not allowed to download portable images. Means create /var/lib/portables if it does not exit and writing into it if it exists: type=AVC msg=audit(1730732931.911:259): avc: denied { write } for pid=10839 comm="systemd-pull" name="lib" dev="dm-1" ino=259 scontext=system_u:system_r:systemd_importd_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1730732931.914:260): avc: denied { write } for pid=10839 comm="systemd-pull" name="lib" dev="dm-1" ino=259 scontext=system_u:system_r:systemd_importd_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1730732931.918:261): avc: denied { write } for pid=10839 comm="systemd-pull" name="lib" dev="dm-1" ino=259 scontext=system_u:system_r:systemd_importd_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1730732932.484:262): avc: denied { write } for pid=10839 comm="systemd-pull" name="lib" dev="dm-1" ino=259 scontext=system_u:system_r:systemd_importd_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1730732952.661:263): avc: denied { write } for pid=10854 comm="systemd-pull" name="portables" dev="dm-1" ino=217616 scontext=system_u:system_r:systemd_importd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1730732952.668:264): avc: denied { write } for pid=10854 comm="systemd-pull" name="portables" dev="dm-1" ino=217616 scontext=system_u:system_r:systemd_importd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1730732952.671:265): avc: denied { write } for pid=10854 comm="systemd-pull" name="portables" dev="dm-1" ino=217616 scontext=system_u:system_r:systemd_importd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1730732953.231:266): avc: denied { write } for pid=10854 comm="systemd-pull" name="portables" dev="dm-1" ino=217616 scontext=system_u:system_r:systemd_importd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=dir permissive=0 # importctl pull-raw https://download.opensuse.org/repositories/home:/kukuk:/sysext/mkosi/strace-... --verify=no --class=portable -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1232670 https://bugzilla.suse.com/show_bug.cgi?id=1232670#c2 --- Comment #2 from Thorsten Kukuk <kukuk@suse.com> --- Same for /var/lib/confexts/ # importctl pull-raw https://download.opensuse.org/repositories/home:/kukuk:/sysext/mkosi/strace-... --verify=no --class=confext -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1232670 https://bugzilla.suse.com/show_bug.cgi?id=1232670#c3 Filippo Bonazzi <filippo.bonazzi@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kukuk@suse.com Status|NEW |IN_PROGRESS Flags| |needinfo?(kukuk@suse.com) --- Comment #3 from Filippo Bonazzi <filippo.bonazzi@suse.com> --- Sorry for taking so long. Can you try with the policy in https://build.opensuse.org/package/show/home:fbonazzi:branches:security:SELi... ? Can you also test that everything you want to do with these images then works? -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1232670 https://bugzilla.suse.com/show_bug.cgi?id=1232670#c4 Thorsten Kukuk <kukuk@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(kukuk@suse.com) | --- Comment #4 from Thorsten Kukuk <kukuk@suse.com> --- (In reply to Filippo Bonazzi from comment #3)
Sorry for taking so long. Can you try with the policy in https://build.opensuse.org/package/show/home:fbonazzi:branches:security: SELinux/selinux-policy ?
Works fine for me, but I could only fully test extensions, as we don't build the other images yet in OBS.
Can you also test that everything you want to do with these images then works?
The extensions do work. -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1232670 https://bugzilla.suse.com/show_bug.cgi?id=1232670#c5 --- Comment #5 from Filippo Bonazzi <filippo.bonazzi@suse.com> --- Ok thanks, I will consider the fix validated for now. Of course if anything further comes up we can fix it (I imagine much quicker). We will send the fix to Factory soon. -- You are receiving this mail because: You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠suse.com