https://bugzilla.novell.com/show_bug.cgi?id=811368 https://bugzilla.novell.com/show_bug.cgi?id=811368#c2 Frederic Crozat changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |ASSIGNED CC| |fcrozat@suse.com, | |rmilasan@suse.com InfoProvider|fcrozat@suse.com | --- Comment #2 from Frederic Crozat 2013-03-25 14:17:23 UTC --- I'm not udev maintainer, robert is (cc him). To me, it looks like udevd in initrd should take care of setting labels for /dev/null and /dev/kmsg, before systemd and "main" udevd are started. It might be worth to get udev debug output to see what is going on (I think you need to boot with udev.log-priority=debug but I'm not 100% sure) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=811368 https://bugzilla.novell.com/show_bug.cgi?id=811368#c Robert Milasan changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P4 - Low Platform|Other |All AssignedTo|vcizek@suse.com |rmilasan@suse.com -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=811368 https://bugzilla.novell.com/show_bug.cgi?id=811368#c5 --- Comment #5 from Vitezslav Cizek 2013-03-25 17:06:42 CET --- I can confirm that I haven't met this bug on 12.3. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=811368 https://bugzilla.novell.com/show_bug.cgi?id=811368#c7 --- Comment #7 from Robert Milasan 2013-03-26 07:24:20 UTC --- I haven't spent too much time, it look very similar to this bug the commit. Anyway, as Frederic said systemd/udev hasn't changed since 12.3 which pretty much means kernel issue. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=811368 https://bugzilla.novell.com/show_bug.cgi?id=811368#c Vitezslav Cizek changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |NEEDINFO InfoProvider| |jeffm@suse.com -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=811368 https://bugzilla.novell.com/show_bug.cgi?id=811368#c Jiri Slaby changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |ASSIGNED InfoProvider|jslaby@suse.com | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=811368 https://bugzilla.novell.com/show_bug.cgi?id=811368#c11 Vitezslav Cizek changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |ASSIGNED InfoProvider|vcizek@suse.com | --- Comment #11 from Vitezslav Cizek 2013-06-17 11:09:37 CEST --- security:SELinux/selinux-policy -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=811368 https://bugzilla.novell.com/show_bug.cgi?id=811368#c13 Vitezslav Cizek changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |ASSIGNED InfoProvider|vcizek@suse.com | --- Comment #13 from Vitezslav Cizek 2013-06-26 11:23:59 CEST --- (In reply to comment #12)

I do not see what you report, I can boot the system normally.

I see login running as kernel_t, this looks like you didn't relabel the system. Our kernel defaults to apparmour, so selinux isn't enabled. Thus the policy can't relabel the filesystem upon install. You should restart the system, run restorecon -R / and then reboot again to correctly labeled system. You can check the guide at: https://en.opensuse.org/SDB:SELinux

There are two other failures here though: [ 3.605820] type=1400 audit(1371493942.594:3): avc: denied { associate } for pid=369 comm="restorecon" name="xconsole" dev="devtmpfs" ino=6531 scontext=system_u:object_r:xconsole_device_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=filesystem [ 13.577555] type=1400 audit(1371493952.566:4): avc: denied { transition } for pid=1821 comm="login" path="/bin/bash" dev="sda1" ino=535765 scontext=system_u:system_r:kernel_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=process

Are you running up-to-date system? What kernel version do you have?

Factory updated last week, kernel-desktop-3.10.rc4-1.1.x86_64 Currently, the system isn't stuck in a loop, i can get to login prompt, but I keep getting: 2013-06-26T16:58:47.260230+02:00 dhcp88 kernel: [ 5.796749] type=1400 audit(1372258724.120:3): avc: denied { read } for pid=192 comm="systemd-tmpfile" path="/dev/null" dev="devtmpfs" ino=1673 scontext=system_u:system_r:systemd_tmpfiles_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=chr_file 2013-06-26T16:58:47.260264+02:00 dhcp88 kernel: [ 5.951865] type=1400 audit(1372258724.275:4): avc: denied { read } for pid=194 comm="systemd-journal" path="/dev/null" dev="devtmpfs" ino=1673 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=chr_file 2013-06-26T16:58:47.260265+02:00 dhcp88 kernel: [ 5.951893] type=1400 audit(1372258724.275:5): avc: denied { write } for pid=194 comm="systemd-journal" path="/dev/null" dev="devtmpfs" ino=1673 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=chr_file 2013-06-26T16:58:47.260265+02:00 dhcp88 kernel: [ 5.951897] type=1400 audit(1372258724.275:6): avc: denied { write } for pid=194 comm="systemd-journal" path="/dev/null" dev="devtmpfs" ino=1673 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=chr_file 2013-06-26T16:58:47.269962+02:00 dhcp88 kernel: [ 6.077661] type=1400 audit(1372258724.401:7): avc: denied { write } for pid=194 comm="systemd-journal" name="kmsg" dev="devtmpfs" ino=1679 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=chr_file 2013-06-26T16:58:47.269963+02:00 dhcp88 kernel: [ 6.107837] type=1400 audit(1372258724.431:8): avc: denied { read write } for pid=194 comm="systemd-journal" name="kmsg" dev="devtmpfs" ino=1679 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=chr_file 2013-06-26T16:58:47.269963+02:00 dhcp88 kernel: [ 6.111853] type=1400 audit(1372258724.435:9): avc: denied { read } for pid=194 comm="systemd-journal" name="urandom" dev="devtmpfs" ino=1678 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=chr_file 2013-06-26T16:58:47.269965+02:00 dhcp88 kernel: [ 6.137986] type=1400 audit(1372258724.461:10): avc: denied { read } for pid=203 comm="systemd-journal" path="/dev/null" dev="devtmpfs" ino=1673 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=chr_file 2013-06-26T16:58:47.269965+02:00 dhcp88 kernel: [ 6.139799] type=1400 audit(1372258724.461:11): avc: denied { write } for pid=203 comm="systemd-journal" path="/dev/null" dev="devtmpfs" ino=1673 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=chr_file 2013-06-26T16:58:47.269968+02:00 dhcp88 kernel: [ 6.139818] type=1400 audit(1372258724.463:12): avc: denied { write } for pid=203 comm="systemd-journal" path="/dev/null" dev="devtmpfs" ino=1673 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=chr_file So at least /dev/null and /dev/kmsg are getting the default label for /dev files. This prevents journal from starting: systemd[1]: Starting Journal Service... systemd[1]: systemd-journald.service start request repeated too quickly, refusing to start. systemd[1]: systemd-journald.socket got notified about service death (failed permanently: yes) systemd[1]: systemd-journald.socket changed running -> failed systemd[1]: Unit systemd-journald.socket entered failed state. systemd[1]: Job systemd-journald.service/start finished, result=failed systemd[1]: Failed to start Journal Service. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=811368 https://bugzilla.novell.com/show_bug.cgi?id=811368#c15 Frederic Crozat changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|jslaby@suse.com |mmarek@suse.com --- Comment #15 from Frederic Crozat 2013-10-03 17:04:38 UTC --- I've reproduced the issue but I'm still a newbie on SELinux. Looking at the policy for udev, it seems missing some stuff : - /usr/lib/udev/rules.d/* isn't labelled at all as udev rules (well, same issue on Fedora 19). Only stuff in /etc/udev/rules.d is. I don't know if it is wanted or not. The following devices are not created by udev nor systemd but by one of mkinitrd script, and since udev only relabel devices when they are created, it might explain why they have an incorrect label on startup : " mknod -m 0666 /dev/tty c 5 0 mknod -m 0600 /dev/console c 5 1 mknod -m 0666 /dev/ptmx c 5 2 mknod -m 0666 /dev/null c 1 3 mknod -m 0600 /dev/kmsg c 1 11 mknod -m 0660 /dev/snapshot c 10 231 mknod -m 0666 /dev/random c 1 8 mknod -m 0644 /dev/urandom c 1 9 " after comparing boot with dracut, I found the issue : loading selinux policy shouldn't be done in mkinitrd itself (when booting with systemd) but left to systemd, which will take care of loading selinux policy at startup (before udev and journald are started) and will relabel /dev and /run. I'd suggest to disable the selinux_load_policy "/root" line in /lib/mkinitrd/scripts/boot-boot.sh when systemd has been detected as the init system (if you want to keep compatibility with the old sysvinit otherwise, just remove the entire selinux stuff from mkinitrd). Once it is done, labelling of /dev and /run will work fine (tested on a VM) reassigning to mkinitrd maintainer -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=811368 Michal Marek changed: What |Removed |Added ---------------------------------------------------------------------------- Status|CONFIRMED |RESOLVED Resolution|--- |WONTFIX --- Comment #17 from Michal Marek --- We dropped mkinitrd in favor of dracut. -- You are receiving this mail because: You are on the CC list for the bug.