Missing SELinux rules (was: Empty `bootupctl status` since 0.2.20) #694

travier · 2024-07-29T14:31:48Z

On a fresh Fedora Silverblue Rawhide installation:

root@fedora:~# bootupctl status
Running as unit: bootupd.service

This is likely due to something we missed in #663.

We should likely call systemd-run with --pty or --pipe: https://www.freedesktop.org/software/systemd/man/latest/systemd-run.html#--pty

The text was updated successfully, but these errors were encountered:

travier · 2024-07-29T14:33:46Z

Hum, we already are using --pipe, so looks like something else is not working as expected.

travier · 2024-07-29T14:40:05Z

Looks like we also need --service-type=oneshot

travier · 2024-07-29T14:40:30Z

~~and --remain-after-exit~~. Not this one, we would habe to stop /reset it every time.

travier · 2024-07-29T14:48:22Z

If for whatever reason the previous command fails, then I need to systemctl reset-failed before calling bootupd again.

root@fedora:~# systemd-run --unit bootupd --property=MountFlags=slave --service-type=oneshot --pipe bootupctl status
Running as unit: bootupd.service
root@fedora:~# systemd-run --unit bootupd --property=MountFlags=slave --service-type=oneshot --pty bootupctl status
Running as unit: bootupd.service; invocation ID: c111d0e1cebe4401bb89af4cfa5358f1
Press ^] three times within 1s to disconnect TTY.

root@fedora:~# systemd-run --unit bootupd --property=MountFlags=slave --service-type=oneshot --pty bootupctl status
Failed to start transient service unit: Unit bootupd.service was already loaded or has a fragment file.
root@fedora:~# systemctl status bootupd.service
× bootupd.service - /usr/bin/bootupctl status
     Loaded: loaded (/run/systemd/transient/bootupd.service; transient)
  Transient: yes
    Drop-In: /usr/lib/systemd/system/service.d
             └─10-timeout-abort.conf
     Active: failed (Result: signal) since Mon 2024-07-29 16:46:17 CEST; 14s ago
 Invocation: c111d0e1cebe4401bb89af4cfa5358f1
    Process: 4624 ExecStart=/usr/bin/bootupctl status (code=killed, signal=HUP)
   Main PID: 4624 (code=killed, signal=HUP)
   Mem peak: 3M
        CPU: 32ms

Jul 29 16:46:17 fedora systemd[1]: Starting bootupd.service - /usr/bin/bootupctl status...
Jul 29 16:46:17 fedora systemd[1]: bootupd.service: Main process exited, code=killed, status=1/HUP
Jul 29 16:46:17 fedora systemd[1]: bootupd.service: Failed with result 'signal'.
Jul 29 16:46:17 fedora systemd[1]: Failed to start bootupd.service - /usr/bin/bootupctl status.
root@fedora:~# systemd-run --unit bootupd --property=MountFlags=slave --service-type=oneshot --pty bootupctl status
Failed to start transient service unit: Unit bootupd.service was already loaded or has a fragment file.

travier · 2024-07-29T15:23:34Z

Ah, I think I understand now. We need to --wait for the unit to start and terminate. Might need --quiet as well.

travier · 2024-07-29T15:26:29Z

Hum, I still don't get any output with:

systemd-run --unit bootupd --property=MountFlags=slave --service-type=oneshot --pipe --wait --quiet -- bootupctl status

and using --pty makes it fail with SIGHUP.

HuijingHei · 2024-07-29T15:30:05Z

No such issue on fcos-rawhide 41.20240720.91.0

[root@cosa-devsh ~]# bootupctl status
Running as unit: bootupd.service
Component BIOS
  Installed: grub2-tools-1:2.06-124.fc41.x86_64
  Update: At latest version
Component EFI
  Installed: grub2-efi-x64-1:2.06-124.fc41.x86_64,shim-x64-15.8-3.x86_64
  Update: At latest version
No components are adoptable.
CoreOS aleph version: 41.20240720.91.0
Boot method: EFI
[root@cosa-devsh ~]# rpm-ostree status
State: idle
Deployments:
● ostree-remote-image:fedora:docker://quay.io/fedora/fedora-coreos:rawhide
                   Digest: sha256:a96de6e7fb733d8db53a126c6829a5c2d881d92c9eb3c646b60a694b5dfc2f41
                  Version: 41.20240720.91.0 (2024-07-20T12:47:28Z)

travier · 2024-07-29T15:57:24Z

One likely notable difference is that Fedora CoreOS Rawhide still uses systemd 255.

travier · 2024-07-29T16:34:33Z

Might be systemd/systemd#32917

HuijingHei · 2024-07-31T08:29:48Z

Hit this when do testing for https://bugzilla.redhat.com/show_bug.cgi?id=2300306, with upgrade selinux to selinux-policy-41.10-1.20240729144215211154.pr2271.13.g8bed6eac7.fc40.noarch.

Set selinux to permissive to run setenforce 0, then the output looks good, so the root cause might be fedora-selinux/selinux-policy@0cbc7da

travier · 2024-07-31T09:26:00Z

semanage permissive -a bootupd_t gets me the status back on Silverblue 41.

cgwalters · 2024-07-31T12:26:11Z

Ugh...I knew the selinux policy would break a ton of things, we should never have done that.

HuijingHei · 2024-08-19T14:17:09Z

Test with latest selinux-policy, bootupctl status works, but still have selinux avc denied log

[root@cosa-devsh ~]# bootupctl status
Running as unit: bootupd.service
Component BIOS
  Installed: grub2-tools-1:2.12-4.fc41.x86_64
  Update: At latest version
Component EFI
  Installed: grub2-efi-x64-1:2.12-4.fc41.x86_64,shim-x64-15.8-3.x86_64
  Update: At latest version
No components are adoptable.
Boot method: EFI
[root@cosa-devsh ~]# rpm -q bootupd
bootupd-0.2.20-2.fc41.x86_64
[root@cosa-devsh ~]# rpm -q selinux-policy
selinux-policy-41.14-1.fc41.noarch
[root@cosa-devsh ~]# ausearch -m avc
----
time->Mon Aug 19 14:14:21 2024
type=AVC msg=audit(1724076861.158:158): avc:  denied  { search } for  pid=2129 comm="bootupctl" name="/" dev="vda4" ino=128 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir permissive=0

travier · 2024-08-20T16:39:26Z

That's likely coreos/fedora-coreos-tracker#1771

See coreos/bootupd#694

travier · 2024-09-02T14:39:16Z

Looks like this has been fixed in the SELinux policy that landed in F41.

travier · 2024-09-02T15:14:55Z

I spoke too soon, I can still see some issues on Silverblue:

type=AVC msg=audit(1725290040.770:429): avc:  denied  { getattr } for  pid=4524 comm="bootupctl" path="/boot/efi/EFI/BOOT/BOOTIA32.EFI" dev="vda1" ino=142 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:dosfs_t:s0 tclass=file permissive=1
type=AVC msg=audit(1725290040.770:430): avc:  denied  { read } for  pid=4524 comm="bootupctl" name="BOOTIA32.EFI" dev="vda1" ino=142 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:dosfs_t:s0 tclass=file permissive=1
type=AVC msg=audit(1725290040.770:431): avc:  denied  { open } for  pid=4524 comm="bootupctl" path="/boot/efi/EFI/BOOT/BOOTIA32.EFI" dev="vda1" ino=142 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:dosfs_t:s0 tclass=file permissive=1
type=AVC msg=audit(1725290040.862:432): avc:  denied  { read } for  pid=4524 comm="bootupctl" name="EFI" dev="vda1" ino=113 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:dosfs_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1725290040.863:433): avc:  denied  { write } for  pid=4524 comm="bootupctl" path=2F626F6F742F233234202864656C6574656429 dev="vda2" ino=24 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:boot_t:s0 tclass=file permissive=1
type=AVC msg=audit(1725290040.869:434): avc:  denied  { link } for  pid=4524 comm="bootupctl" name="#24" dev="vda2" ino=24 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:boot_t:s0 tclass=file permissive=1
type=AVC msg=audit(1725290040.869:435): avc:  denied  { rename } for  pid=4524 comm="bootupctl" name=".tmp.X84SiQFG.tmp" dev="vda2" ino=24 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:boot_t:s0 tclass=file permissive=1

travier · 2024-09-02T15:45:49Z

Filed: fedora-selinux/selinux-policy#2334

See coreos/bootupd#694

travier · 2024-09-03T17:54:54Z

Part 2 in fedora-selinux/selinux-policy#2341

travier · 2024-09-04T17:05:31Z

Freeze exception for F41: https://bugzilla.redhat.com/show_bug.cgi?id=2309742

HuijingHei · 2024-09-26T06:48:33Z

Part 3 in fedora-selinux/selinux-policy#2362

This was referenced Aug 22, 2024

Graceful recover after a failure #707

Closed

Extend bootupd test to include testing adoption and updates coreos/fedora-coreos-tracker#1788

Open

HuijingHei added a commit to HuijingHei/fedora-coreos-config that referenced this issue Aug 29, 2024

tests: verify bootupctl status output is not empty

aa791ba

See coreos/bootupd#694

HuijingHei added a commit to HuijingHei/fedora-coreos-config that referenced this issue Aug 29, 2024

tests: verify bootupctl status output is not empty

26659c0

See coreos/bootupd#694

HuijingHei mentioned this issue Aug 29, 2024

tests: verify bootupctl status output is not empty coreos/fedora-coreos-config#3130

Merged

HuijingHei added a commit to HuijingHei/fedora-coreos-config that referenced this issue Sep 2, 2024

tests: verify bootupctl status output is not empty

6f71005

See coreos/bootupd#694

travier closed this as completed Sep 2, 2024

travier reopened this Sep 2, 2024

travier pushed a commit to coreos/fedora-coreos-config that referenced this issue Sep 3, 2024

tests: verify bootupctl status output is not empty

e726f1f

See coreos/bootupd#694

travier added jira For syncing with Jira bug Something isn't working labels Sep 3, 2024

travier changed the title ~~Empty bootupctl status since 0.2.20~~ Missing SELinux rules (was: Empty bootupctl status since 0.2.20) Sep 3, 2024

travier mentioned this issue Sep 4, 2024

Help SELinux team with SELinux failures on Rawhide coreos/fedora-coreos-tracker#1768

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Missing SELinux rules (was: Empty `bootupctl status` since 0.2.20) #694

Missing SELinux rules (was: Empty `bootupctl status` since 0.2.20) #694

travier commented Jul 29, 2024

travier commented Jul 29, 2024

travier commented Jul 29, 2024

travier commented Jul 29, 2024 •

edited

Loading

travier commented Jul 29, 2024

travier commented Jul 29, 2024

travier commented Jul 29, 2024 •

edited

Loading

HuijingHei commented Jul 29, 2024

travier commented Jul 29, 2024

travier commented Jul 29, 2024

HuijingHei commented Jul 31, 2024 •

edited

Loading

travier commented Jul 31, 2024

cgwalters commented Jul 31, 2024

HuijingHei commented Aug 19, 2024

travier commented Aug 20, 2024

travier commented Sep 2, 2024

travier commented Sep 2, 2024 •

edited

Loading

travier commented Sep 2, 2024

travier commented Sep 3, 2024

travier commented Sep 4, 2024

HuijingHei commented Sep 26, 2024

Missing SELinux rules (was: Empty bootupctl status since 0.2.20) #694

Missing SELinux rules (was: Empty bootupctl status since 0.2.20) #694

Comments

travier commented Jul 29, 2024

travier commented Jul 29, 2024

travier commented Jul 29, 2024

travier commented Jul 29, 2024 • edited Loading

travier commented Jul 29, 2024

travier commented Jul 29, 2024

travier commented Jul 29, 2024 • edited Loading

HuijingHei commented Jul 29, 2024

travier commented Jul 29, 2024

travier commented Jul 29, 2024

HuijingHei commented Jul 31, 2024 • edited Loading

travier commented Jul 31, 2024

cgwalters commented Jul 31, 2024

HuijingHei commented Aug 19, 2024

travier commented Aug 20, 2024

travier commented Sep 2, 2024

travier commented Sep 2, 2024 • edited Loading

travier commented Sep 2, 2024

travier commented Sep 3, 2024

travier commented Sep 4, 2024

HuijingHei commented Sep 26, 2024

Missing SELinux rules (was: Empty `bootupctl status` since 0.2.20) #694

Missing SELinux rules (was: Empty `bootupctl status` since 0.2.20) #694

travier commented Jul 29, 2024 •

edited

Loading

travier commented Jul 29, 2024 •

edited

Loading

HuijingHei commented Jul 31, 2024 •

edited

Loading

travier commented Sep 2, 2024 •

edited

Loading