Is it normal to get hundreds of SELinux denials every time `zypper dup` runs?

English Install/Boot/Login
1

Hi, I’m fairly new to openSUSE and SELinux.

As per the title, whenever I run zypper dup and accept the updates, there’s an initial pause, during which hundreds of SEtroubleshoot notifications appear, before the updates install, apparently with no issue, followed by another flurry of notifications when it finishes. Today’s update caused 424 denial alerts.

I haven’t knowingly added or altered any SELinux rules, so it should all be using the default Tumbleweed policy. However, I do remember enabling desktop notifications for some/all denials so I had some visibility of what SELinux was blocking, so maybe it’s normal for this to be happening quietly in a log file?

Here’s a snippet from /var/log/auth/audit.log. Most of it seems to be related to something dracut is doing (generating an initramfs or something?). None of this seems to be causing a problem.

type=AVC msg=audit(1789151852.574:1552): avc:  denied  { execute } for  pid=76484 comm="dracut" name="rpcbind" dev="dm-0" ino=1354947 scontext=system_u:system_r:sdbootutil_t:s0 tcontext=system_u:object_r:rpcbind_exec_t:s0 tclass=file permissive=1
type=AVC msg=audit(1789151852.575:1553): avc:  denied  { getattr } for  pid=76484 comm="dracut" path="/usr/sbin/rpc.statd" dev="dm-0" ino=1378193 scontext=system_u:system_r:sdbootutil_t:s0 tcontext=system_u:object_r:rpcd_exec_t:s0 tclass=file permissive=1
type=AVC msg=audit(1789151852.575:1554): avc:  denied  { execute } for  pid=76484 comm="dracut" name="rpc.statd" dev="dm-0" ino=1378193 scontext=system_u:system_r:sdbootutil_t:s0 tcontext=system_u:object_r:rpcd_exec_t:s0 tclass=file permissive=1
type=AVC msg=audit(1789151852.581:1555): avc:  denied  { getattr } for  pid=76484 comm="dracut" path="/usr/bin/ssh" dev="dm-0" ino=1186092 scontext=system_u:system_r:sdbootutil_t:s0 tcontext=system_u:object_r:ssh_exec_t:s0 tclass=file permissive=1
type=AVC msg=audit(1789151852.581:1556): avc:  denied  { execute } for  pid=76484 comm="dracut" name="ssh" dev="dm-0" ino=1186092 scontext=system_u:system_r:sdbootutil_t:s0 tcontext=system_u:object_r:ssh_exec_t:s0 tclass=file permissive=1
type=AVC msg=audit(1789151852.600:1557): avc:  denied  { read } for  pid=77367 comm="findmnt" name="var" dev="dm-0" ino=256 scontext=system_u:system_r:sdbootutil_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1789151852.600:1558): avc:  denied  { read } for  pid=77367 comm="findmnt" name="var" dev="dm-0" ino=256 scontext=system_u:system_r:sdbootutil_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1789151852.600:1559): avc:  denied  { read } for  pid=77367 comm="findmnt" name="var" dev="dm-0" ino=256 scontext=system_u:system_r:sdbootutil_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1789151852.600:1560): avc:  denied  { read } for  pid=77367 comm="findmnt" name="var" dev="dm-0" ino=256 scontext=system_u:system_r:sdbootutil_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1789151852.600:1561): avc:  denied  { read } for  pid=77367 comm="findmnt" name="var" dev="dm-0" ino=256 scontext=system_u:system_r:sdbootutil_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1789151852.600:1562): avc:  denied  { read } for  pid=77367 comm="findmnt" name="var" dev="dm-0" ino=256 scontext=system_u:system_r:sdbootutil_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1789151852.607:1563): avc:  denied  { getattr } for  pid=76484 comm="dracut" path="/usr/lib/systemd/systemd-pstore" dev="dm-0" ino=1343225 scontext=system_u:system_r:sdbootutil_t:s0 tcontext=system_u:object_r:systemd_pstore_exec_t:s0 tclass=file permissive=1
type=AVC msg=audit(1789151852.607:1564): avc:  denied  { execute } for  pid=76484 comm="dracut" name="systemd-pstore" dev="dm-0" ino=1343225 scontext=system_u:system_r:sdbootutil_t:s0 tcontext=system_u:object_r:systemd_pstore_exec_t:s0 tclass=file permissive=1
type=AVC msg=audit(1789151852.712:1565): avc:  denied  { create } for  pid=77695 comm="dracut-install" name="bin" scontext=system_u:system_r:sdbootutil_t:s0 tcontext=system_u:object_r:sdbootutil_tmp_t:s0 tclass=lnk_file permissive=1
type=AVC msg=audit(1789151852.712:1566): avc:  denied  { read } for  pid=77695 comm="dracut-install" name="bin" dev="dm-0" ino=4072270 scontext=system_u:system_r:sdbootutil_t:s0 tcontext=system_u:object_r:sdbootutil_tmp_t:s0 tclass=lnk_file permissive=1
type=AVC msg=audit(1789151852.717:1567): avc:  denied  { getattr } for  pid=77704 comm="rm" path="/var/tmp/dracut.dZb3Lp0/initramfs/bin" dev="dm-0" ino=4072270 scontext=system_u:system_r:sdbootutil_t:s0 tcontext=system_u:object_r:sdbootutil_tmp_t:s0 tclass=lnk_file permissive=1
type=AVC msg=audit(1789151852.717:1568): avc:  denied  { unlink } for  pid=77704 comm="rm" name="bin" dev="dm-0" ino=4072270 scontext=system_u:system_r:sdbootutil_t:s0 tcontext=system_u:object_r:sdbootutil_tmp_t:s0 tclass=lnk_file permissive=1
type=AVC msg=audit(1789151852.749:1569): avc:  denied  { read } for  pid=76484 comm="dracut" name="system.conf.d" dev="dm-0" ino=58876 scontext=system_u:system_r:sdbootutil_t:s0 tcontext=system_u:object_r:systemd_conf_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1789151852.750:1570): avc:  denied  { read } for  pid=77773 comm="dracut-install" name="systemd" dev="dm-0" ino=1339457 scontext=system_u:system_r:sdbootutil_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
type=AVC msg=audit(1789151852.750:1571): avc:  denied  { open } for  pid=77773 comm="dracut-install" path="/usr/lib/systemd/systemd" dev="dm-0" ino=1339457 scontext=system_u:system_r:sdbootutil_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=1
type=AVC msg=audit(1789151852.754:1572): avc:  denied  { getattr } for  pid=77773 comm="dracut-install" path="/usr/lib/systemd/system-generators/systemd-debug-generator" dev="dm-0" ino=1339453 scontext=system_u:system_r:sdbootutil_t:s0 tcontext=system_u:object_r:systemd_debug_generator_exec_t:s0 tclass=file permissive=1
type=AVC msg=audit(1789151852.754:1573): avc:  denied  { read } for  pid=77782 comm="cp" name="systemd-debug-generator" dev="dm-0" ino=1339453 scontext=system_u:system_r:sdbootutil_t:s0 tcontext=system_u:object_r:systemd_debug_generator_exec_t:s0 tclass=file permissive=1
type=AVC msg=audit(1789151852.754:1574): avc:  denied  { open } for  pid=77782 comm="cp" path="/usr/lib/systemd/system-generators/systemd-debug-generator" dev="dm-0" ino=1339453 scontext=system_u:system_r:sdbootutil_t:s0 tcontext=system_u:object_r:systemd_debug_generator_exec_t:s0 tclass=file permissive=1
2

I would say you have switched SELinux in permissive mode.

Please show the result of

sestatus

Did you ever do (as “root”)

touch /.autorelable

followed by a reboot?

3 
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      35

Definitely enforcing. Whatever dracut is trying to do, it’s not getting away with it.

I’ve never created /.autorelable.

4

I have to admit that in this case I do not understand why all the messages you showed do have permissive=1 at the end.

If you do touch /.autorelable followed by a system restart all policies will be applied to your system again on that restart (Beware that depending on the number of files in your system and the speed of your storage devices that restart can take longer as usual.).

It would be interesting to know, if that will cause any changes in your system.

5

Wow, I didn’t even notice that. Very strange. Everything should be enforcing. I don’t get any output from
semodule -l | grep permissive

Thanks, I’ll give this a try. restorecon -nrv / does report a few things under /etc as having the wrong label.

6

Looks like relabelling everything might have solved it. :+1:

7

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.