A %preun script in my rpm package is failing. It's running a binary that sends a signal to a running process, and SELinux blocks the signal:
Raw Audit Messagestype=AVC msg=audit(1589082060.526:1156): avc: denied { signal } for pid=672912 comm="courierlogger" scontext=unconfined_u:unconfined_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=process permissive=0
When the signal fails, sigkill is tried again, which is also blocked: Raw Audit Messagestype=AVC msg=audit(1589082160.527:1172): avc: denied { sigkill } for pid=672912 comm="courierlogger" scontext=unconfined_u:unconfined_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=process permissive=0
The binary that's sending the signals: $ ls -alZ /usr/sbin/courierlogger-rwxr-xr-x. 1 daemon daemon system_u:object_r:courier_exec_t:s0 25296 May 9 23:19 /usr/sbin/courierlogger
This is not my SELinux policy that labeled this binary. Apparently Fedora has a selinux policy that decided to show up here, but something is not working correctly.
That binary is attempting to sigkill this process:unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 673700 673699 0 00:14 ? 00:00:00 /usr/lib/courier/sbin/couriertcpd -address=0 -maxprocs=40 - maxperip=4 -access=/etc/courier/imapaccess.dat -nodnslookup -noidentlookup
The process is running as unconfined_t. Again, my rpm packages do not have any selinux configuration in them, this is all, apparently, something stock that came with Fedora.
As best as I can figure out what's going on here: the %preun is in an rpm subpackage. The main rpm package starts all the daemons from a system unit, and they run as unconfined. The subpackage's %preun runs a script that runs this binary that signals the existing process, but the %preun script executes in some kind of a confined state.
There is no issue using "systemctl stop" to stop the entire group of processes, only with using a script that attempts to signal one of process to gracefully shut itself down. Looking for ideas how to get this working. I think I need a way to run %preun scripts as unconfined, but I'm not sure. I haven't had much luck trying to find useful selinux documentation.
Attachment:
pgp7mkWBozAUU.pgp
Description: PGP signature
_______________________________________________ users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx
