SELinux is preventing useradd from using the net_admin capability.

[Shakhar Dasgupta <shakhardasgupta@xxxxxxxxx>]

Hi everyone,

I am not sure whether this should be considered a bug. For testing Testcase_desktop_login, I needed two user accounts. I created the root and first user account during installation. I logged in using the first user account and tried to create the second account using "Settings -> User". After using the root password, I created a new account. Then I got an SELinux Alert. It looks like this:
------------------------------------------------------------------------------------------------------------------
SELinux is preventing useradd from using the net_admin capability.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that useradd should have the net_admin capability by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'useradd' --raw | audit2allow -M my-useradd
# semodule -X 300 -i my-useradd.pp

Additional Information:
Source Context                system_u:system_r:useradd_t:s0
Target Context                system_u:system_r:useradd_t:s0
Target Objects                Unknown [ capability ]
Source                        useradd
Source Path                   useradd
Port                          <Unknown>
Host                          localhost.localdomain
Source RPM Packages          
Target RPM Packages          
Policy RPM                    selinux-policy-3.13.1-251.fc26.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     localhost-live
Platform                      Linux localhost-live 4.11.0-2.fc26.x86_64 #1 SMP
                              Tue May 9 15:24:49 UTC 2017 x86_64 x86_64
Alert Count                   14
First Seen                    2017-06-01 04:13:56 EDT
Last Seen                     2017-06-01 04:13:56 EDT
Local ID                      24e05744-a44a-4e10-86f8-5e915802562a

Raw Audit Messages
type=AVC msg=audit(1496304836.749:254): avc:  denied  { net_admin } for  pid=2300 comm="useradd" capability=12  scontext=system_u:system_r:useradd_t:s0 tcontext=system_u:system_r:useradd_t:s0 tclass=capability permissive=0


Hash: useradd,useradd_t,useradd_t,capability,net_admin
------------------------------------------------------------------------------------------------------------------

Note: I used Fedora 26 Beta Candidate-1.4 Workstation Live image.

Thank you,

Shakhar

_______________________________________________
test mailing list -- test@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to test-leave@xxxxxxxxxxxxxxxxxxxxxxx