On Fri, 31 Jul 2020 05:51:21 +0800 Ed Greshko <ed.greshko@xxxxxxxxxxx> wrote: > Well, it seems similar issues have come up in the past. > > https://bugzilla.redhat.com/show_bug.cgi?id=1309108 > > and > > https://bugzilla.redhat.com/show_bug.cgi?id=1298192 > > You may want to try the work around in comment 19 of that one. I think it is already in place as the command sesearch -A -s unconfined_t -t user_cron_spool_t -c file found allow application_domain_type user_cron_spool_t:file { append getattr ioctl lock read write }; allow crontab_domain user_cron_spool_t:file { append create getattr ioctl link lock open read rename setattr unlink write }; allow domain file_type:file map; [ domain_can_mmap_files ]:True allow files_unconfined_type file_type:file execmod; [ selinuxuser_execmod ]:True allow files_unconfined_type file_type:file { append audit_access create execute execute_no_trans getattr ioctl link lock map mounton open quotaon read relabelfrom relabelto rename setattr swapon unlink write }; allow unconfined_t user_cron_spool_t:file entrypoint; [ cron_userdomain_transition ]:True allow unconfined_t user_cron_spool_t:file { getattr ioctl read write }; and the second from the bottom is that workaround. > I think you should then wait on your BZ as well as you may want to > join/ask on the selinux mailing list. I agree, I'll wait a while to see if anything develops, and then ask there. Hey, it is F31, so going end of life in a few months, seems to work fine except for this corner case, so probably not a priority. _______________________________________________ users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx
