‘groupadd test’ returns: groupadd: failure while writing changes to /etc/group It seems to be caused by changes introduced in latest version of shadow to files lib/commonio.[ch] After copying them over from 4.1.4.3 version and building things seems to work properly. Particularly I suspect the changes to commonio_close() causing breakage. from src/groupadd.c if (gr_close () == 0) { fprintf (stderr, _("%s: failure while writing changes to %s\n"), Prog, gr_dbname ()); exit (E_GRP_UPDATE); } from lib/groupio.c int gr_close (void) { return commonio_close (&group_db); } Reproducible: Always Portage 2.1.10.49 (hardened/linux/amd64/selinux, gcc-4.5.3, glibc-2.14.1-r2, 3.2.6-hardened x86_64) ================================================================= System uname: Linux-3.2.6-hardened-x86_64-Intel-R-_Core-TM-_i3_CPU_M_350_@_2.27GHz-with-gentoo-2.1 Timestamp of tree: Fri, 02 Mar 2012 22:00:01 +0000 app-shells/bash: 4.2_p20 dev-lang/python: 2.7.2-r3, 3.2.2 dev-util/cmake: 2.8.7-r3 dev-util/pkgconfig: 0.26 sys-apps/baselayout: 2.1 sys-apps/openrc: 0.9.9.2 sys-apps/sandbox: 2.5 sys-devel/autoconf: 2.13, 2.68 sys-devel/automake: 1.9.6-r3, 1.11.3 sys-devel/binutils: 2.22-r1 sys-devel/gcc: 4.5.3-r2, 4.7.0_alpha20120114::hardened-dev sys-devel/gcc-config: 1.5.1 sys-devel/libtool: 2.4.2 sys-devel/make: 3.82-r3 sys-kernel/linux-headers: 3.2-r1 (virtual/os-headers) sys-libs/glibc: 2.14.1-r2 Repositories: gentoo x11 hardened-dev my_local_overlay ACCEPT_KEYWORDS="amd64 ~amd64" ACCEPT_LICENSE="* -@EULA Intel-SDP PUEL skype-eula" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-march=native -O2 -pipe" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/config /usr/share/gnupg/qualified.txt /usr/share/themes/oxygen-gtk/gtk-2.0" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/php/apache2-php5.4/ext-active/ /etc/php/cgi-php5.4/ext-active/ /etc/php/cli-php5.4/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo" CXXFLAGS="-march=native -O2 -pipe" DISTDIR="/usr/portage/distfiles" FEATURES="assume-digests binpkg-logs distlocks ebuild-locks fixlafiles news parallel-fetch protect-owned sandbox selinux sesandbox sfperms splitdebug strict unknown-features-warn unmerge-logs unmerge-orphans userfetch" FFLAGS="" GENTOO_MIRRORS="http://distfiles.gentoo.org" LANG="en_US.UTF-8" LDFLAGS="-Wl,-O1 -Wl,--as-needed" LINGUAS="en en_GB en_US pl pl_PL" MAKEOPTS="-j4" PKGDIR="/usr/portage/packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages" PORTAGE_TMPDIR="/var/tmp" PORTDIR="/usr/portage" PORTDIR_OVERLAY="/var/lib/layman/x11 /var/lib/layman/hardened-development /usr/local/portage" SYNC="rsync://rsync.gentoo.org/gentoo-portage" USE="X acpi alsa amd64 bash-completion berkdb bzip2 cairo cli consolekit cracklib crypt cups cxx dbus dri gdbm gif gpm hardened iconv jpeg justify kde lm_sensors mmx modules mudflap multilib ncurses networkmanager nls nptl nptlonly open_perms opengl openmp pam pax_kernel pcre png policykit pppd qt3support qt4 readline selinux semantic-desktop session sse sse2 ssl ssse3 sysfs system-sqlite tcpd tiff truetype udev unicode urandom usb v4l vim-syntax xinerama xorg zlib zsh-completion" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="kexi words flow plan stage tables krita karbon braindump" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ubx" INPUT_DEVICES="evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="en en_GB en_US pl pl_PL" PHP_TARGETS="php5-3" RUBY_TARGETS="ruby19" USERLAND="GNU" VIDEO_CARDS="nouveau" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" Unset: CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LC_ALL, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS
Created attachment 304219 [details, diff] fix security_getenforce check Patch fixing security_getenforce check, as it would only work in permissive mode. from manpage: security_getenforce returns 0 if SELinux is running in permissive mode, 1 if it is running in enforcing mode, and -1 on error.
There is still an issue of /etc/group ending with wrong file context. staff_u:object_r:shadow_t instead of system_u:object_r:etc_t
Created attachment 304233 [details, diff] apply correct file context to newly created file This patch fixes applying file context when creating files (/etc/group+ or /etc/gshadow+ which are later renamed to /etc/group and /etc/gshadow respectively) It also needs policy to allow groupadd to get correct file context so it can read the file contexts. Mar 4 17:24:43 localhost kernel: [13738.174468] type=1400 audit(1330878283.695:66213): avc: denied { getattr } for pid=9367 comm="groupadd" path="/etc/selinux/strict/contexts/files/file_contexts" dev="dm-0" ino=7414649 scontext=staff_u:sysadm_r:groupadd_t tcontext=staff_u:object_r:file_context_t tclass=file Mar 4 17:26:14 localhost kernel: [13828.303027] type=1400 audit(1330878374.005:66240): avc: denied { search } for pid=9514 comm="groupadd" name="contexts" dev="dm-0" ino=7414263 scontext=staff_u:sysadm_r:groupadd_t tcontext=system_u:object_r:default_context_t tclass=dir Mar 4 17:27:46 localhost kernel: [13920.837383] type=1400 audit(1330878466.725:66315): avc: denied { search } for pid=9781 comm="groupadd" name="files" dev="dm-0" ino=7414270 scontext=staff_u:sysadm_r:groupadd_t tcontext=system_u:object_r:file_context_t tclass=dir Mar 4 17:29:07 localhost kernel: [14001.196402] type=1400 audit(1330878547.239:66351): avc: denied { read } for pid=9966 comm="groupadd" name="file_contexts" dev="dm-0" ino=7414661 scontext=staff_u:sysadm_r:groupadd_t tcontext=staff_u:object_r:file_context_t tclass=file Mar 4 17:30:34 localhost kernel: [14088.586871] type=1400 audit(1330878634.805:66384): avc: denied { open } for pid=10114 comm="groupadd" name="file_contexts" dev="dm-0" ino=7414662 scontext=staff_u:sysadm_r:groupadd_t tcontext=staff_u:object_r:file_context_t tclass=file
Comment on attachment 304219 [details, diff] fix security_getenforce check This patch is actually not needed to make it work again. It works fine when policy allows reading of file contexts.
Patch suggested to upstream on http://lists.alioth.debian.org/pipermail/pkg-shadow-devel/2012-March/009205.html is about as close as it can be to yours ;-)
Created attachment 306787 [details, diff] shadow-4.1.5-selinux patch Patch as suggested from Peter Vrabec on shadow mailinglist. They both do the same (well, the latter one resets the contexts later in the process, and immediately goes to the "fail" block on error) so it doesn't hurt to pick either one. However, I'm always fond to use patches verified by others as well ;)
base-system team, can you apply this patch to sys-apps/shadow-4.1.5 please?
sure ... i've got another fix or two that should go into 4.1.5
should be all set now in the tree; thanks for the report! Commit message: Add patch for groupadd on selinux http://sources.gentoo.org/sys-apps/shadow/files/shadow-4.1.5-selinux-groupadd.patch?rev=1.1 http://sources.gentoo.org/sys-apps/shadow/shadow-4.1.5-r2.ebuild?rev=1.1
