I don't have access to RHEL7 case. Should I open a new case? It is possibility related, but I can even get the current status and as I said, no avc denials.

Thanks,
Vadym

On Nov 24, 2014 2:37 AM, "Milos Malik" <mmalik@redhat.com> wrote:

Hi Vadym,

here are 2 bugs which describe similar symptoms:
 * https://bugzilla.redhat.com/show_bug.cgi?id=1014315 (Fedora)
 * https://bugzilla.redhat.com/show_bug.cgi?id=1132411 (RHEL-7)

Milos Malik

----- Original Message -----
> Hi,
>
> I stumbled on a case in RHEL7, where selinux blocks calls to systemd
> I know it's SELinux, because everything work properly after setenforce 0
>
> I added a simple manifest rules to puppet:
>
> exec { 'update TZ':
>   command => "/bin/timedatectl set-timezone ${timezone}",
>   unless  => "/bin/timedatectl status | /bin/grep -q ${timezone}",
> }
>
> what's interesting, even after I ran
>
> semodule --disable_dontaudit --build
>
> I don't see any denials.
>
> But then I created a simple cron job :
>
> # cat /etc/cron.d/debug
>
> * * * * * root /bin/timedatectl status &> /tmp/timedatectl.status
>
> # cat /tmp/timedatectl.status
>
> Failed to issue method call: Did not receive a reply. Possible causes
> include: the remote application did not send a reply, the message bus
> security policy blocked the reply, the reply timeout expired, or the
> network connection was broken.
>
> So it's not only puppet related.
>
> Is this intended behavior? Some boolean I have to change?
>
>
> Thanks,
>
> Vadym
>
> --
> selinux mailing list
> selinux@lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/selinux

--
selinux mailing list
selinux@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux