| Summary: | SELinux: emerging sys-kernel/gentoo-kernel fails with realabelto denial | ||
|---|---|---|---|
| Product: | Gentoo Linux | Reporter: | Emily Rowlands <gentoo> |
| Component: | SELinux | Assignee: | SE Linux Bugs <selinux> |
| Status: | UNCONFIRMED --- | ||
| Severity: | normal | ||
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
| Attachments: |
Extract of /var/log/audit.log from the merge phase (uncompressed size 1.7M)
emerge --info selinux-base selinux-base-policy |
||
Created attachment 726975 [details]
emerge --info selinux-base selinux-base-policy
Additional note: this audit.log was taken with dontaudit rules disabled. The { noatsecure rlimitinh siginh } do not appear after running `semodule -B` to re-enable them.
|
Created attachment 726972 [details] Extract of /var/log/audit.log from the merge phase (uncompressed size 1.7M) During copying files to /, the relabelto permission is denied to the portage_t domain. The full log will be attached but here's a summary generated by audit2allow: #============= gcc_config_t ============== allow gcc_config_t self:capability dac_read_search; #============= kmod_t ============== allow kmod_t portage_tmp_t:dir search; #============= portage_t ============== allow portage_t dmesg_exec_t:file relabelto; allow portage_t etc_runtime_t:file relabelto; allow portage_t etc_t:file relabelto; allow portage_t fsadm_exec_t:file relabelto; allow portage_t gcc_config_t:process { noatsecure rlimitinh siginh }; allow portage_t kmod_exec_t:file relabelto; allow portage_t kmod_t:process { noatsecure rlimitinh siginh }; allow portage_t ld_so_t:file relabelto; allow portage_t ldconfig_t:process { noatsecure rlimitinh siginh }; allow portage_t modules_dep_t:file relabelto; allow portage_t modules_object_t:file relabelto; allow portage_t mount_exec_t:file relabelto; allow portage_t portage_tmp_t:chr_file create; allow portage_t self:netlink_route_socket nlmsg_write; allow portage_t setfiles_t:process { noatsecure rlimitinh siginh }; allow portage_t shell_exec_t:file relabelto; allow portage_t udev_exec_t:file relabelto; allow portage_t udev_rules_t:file relabelto; allow portage_t udevadm_exec_t:file relabelto; allow portage_t usr_t:dir relabelto; allow portage_t usr_t:file relabelto; #============= setfiles_t ============== allow setfiles_t sysctl_kernel_t:dir search; Whilst this particular log and errorset is for sys-kernel/gentoo-kernel, I also experienced a similar failure when merging sys-fs/zfs-kmod. However, I did not see merge failures with sys-process/htop (although there were some AVC denials for { noatsecure rlimitinh siginh } ). emerge --info to follow