Fedora 14 NTP and SELinux

[Rahul Sundaram]

Hi

Read a couple of reviews and blog posts mentioning this,  if you use ntp
via firstboot in Fedora 14 and you login, you get SELinux warnings on
login.  I tried testing this in a vm and this is very much reproducible
and is such a jarring user experience.  What can we do to avoid these
class of problems for the next release?

Rahul

[Gregory Maxwell]

On Mon, Nov 29, 2010 at 1:05 AM, Rahul Sundaram <metherid(a)gmail.com&gt; wrote:
>  Hi
>
>  Read a couple of reviews and blog posts mentioning this,  if you use ntp
>  via firstboot in Fedora 14 and you login, you get SELinux warnings on
>  login.  I tried testing this in a vm and this is very much reproducible
>  and is such a jarring user experience.  What can we do to avoid these
>  class of problems for the next release? 
Not having so many fedora developers, testers, and redhat staff
running with selinux in disabled/in permissive mode would be a good
start.


Can you link to the reviews?  I'm pretty sure I enabled ntp in first
boot on all the systems I've installed F14 on and I don't recall
seeing alerts on the first login— and it's something I would have
reported if I noticed it.

[Rahul Sundaram]

On 11/29/2010 11:55 AM, Gregory Maxwell wrote:
>  On Mon, Nov 29, 2010 at 1:05 AM, Rahul Sundaram  wrote:
> > Hi
> >
> > Read a couple of reviews and blog posts mentioning this,  if you use ntp
> > via firstboot in Fedora 14 and you login, you get SELinux warnings on
> > login.  I tried testing this in a vm and this is very much reproducible
> > and is such a jarring user experience.  What can we do to avoid these
> > class of problems for the next release?
>  Not having so many fedora developers, testers, and redhat staff
>  running with selinux in disabled/in permissive mode would be a good
>  start. 
That's a bit of chicken and egg problem. 

>  Can you link to the reviews?  I'm pretty sure I enabled ntp in
> first
>  boot on all the systems I've installed F14 on and I don't recall
>  seeing alerts on the first login— and it's something I would have
>  reported if I noticed it. 
I don't have all of them but here are a few links

http://ignore-your.tv/2010/11/14/fedora-14/

http://www.dedoimedo.com/computers/fedora-14.html

https://bugzilla.redhat.com/show_bug.cgi?id=622796

Rahul

[Michal Jaegermann]

On Mon, Nov 29, 2010 at 11:35:05AM +0530, Rahul Sundaram wrote:
>  
>  Read a couple of reviews and blog posts mentioning this,  if you use ntp
>  via firstboot in Fedora 14 and you login, you get SELinux warnings on
>  login. 
Do you mean something like these in logs?

 NULL security context for user, but SELinux in permissive mode, continuing ()
 NULL security context for user, but SELinux in permissive mode, continuing ()
 NULL security context for user, but SELinux in permissive mode, continuing ()
 NULL security context for user, but SELinux in permissive mode, continuing ()
 NULL security context for user, but SELinux in permissive mode, continuing ()
 NULL security context for user, but SELinux in permissive mode, continuing ()

I am getting these on machines upgraded from Fedora 12 to 14 and
that is after autorelabel and 'restorecon -RF ...' on various
directories.  These are from /var/log/cron and there is not much
more anywhere which would allow to define local policies to get
around that.  All these machines had no problems with SELinux before
an upgrade.

Originally after an upgrade and after an initial relabelling it was
impossible to login with SELinux in an enforcing mode (at least
remotely and that is pretty nasty if you do not have a local
console) but more relabelling apparently helped with that.

I am also collecting these:

 Unauthorized SELinux context, but SELinux in permissive mode, continuing (/etc/
crontab)
 Unauthorized SELinux context, but SELinux in permissive mode, continuing (/etc/
cron.d/sa-update)
 Unauthorized SELinux context, but SELinux in permissive mode, continuing (/etc/
cron.d/smolt)
 Unauthorized SELinux context, but SELinux in permissive mode, continuing (/etc/
cron.d/0hourly)
 Unauthorized SELinux context, but SELinux in permissive mode, continuing (/var/
spool/cron/root)

selinux-policy-targeted-3.9.7-12.fc14 if somebody cares.

>  I tried testing this in a vm and this is very much reproducible
>  and is such a jarring user experience. 
I should likely write bugzilla reports but I sort of gave up on
SELinux and do expect nasty things after every upgrade so these are
at the very bottom of my queue.  An impossible to understand and
control security is of not a real use.

   Michal

[Rahul Sundaram]

On 11/29/2010 01:27 PM, Michal Jaegermann wrote:
>  On Mon, Nov 29, 2010 at 11:35:05AM +0530, Rahul Sundaram wrote:
> > Read a couple of reviews and blog posts mentioning this,  if you use ntp
> > via firstboot in Fedora 14 and you login, you get SELinux warnings on
> > login.
>  Do you mean something like these in logs? 
Nope.  I have provided a bugzilla reference for more details.  Your
problem seems completely unrelated.

Rahul

[James Laska]

On Mon, 2010-11-29 at 11:35 +0530, Rahul Sundaram wrote:
>  Hi
>  
>  Read a couple of reviews and blog posts mentioning this,  if you use ntp
>  via firstboot in Fedora 14 and you login, you get SELinux warnings on
>  login.  I tried testing this in a vm and this is very much reproducible
>  and is such a jarring user experience.   
>  What can we do to avoid these class of problems for the next release?
At release time, the criteria [1] are written to include experiences
like this.

        "In most cases, there must be no SELinux 'AVC: denied' messages
        or abrt crash notifications on initial boot and subsequent login
        (see Blocker_Bug_FAQ)"

The gap here is that we don't spell out all configuration options in
firstboot and whether they should result in a clean login experience.
For something like the issue you mention, it would make a good
discussion topic as to whether it represents a valid release blocker.  I
can see arguments for both sides.  

Another gap is that we don't actively test/explore all firstboot
configuration options and their impact on setroubleshoot.

Thanks,
James

[1] http://fedoraproject.org/wiki/Fedora_14_Final_Release_Criteria

[Adam Williamson]

On Mon, 2010-11-29 at 09:27 -0500, James Laska wrote:
>  On Mon, 2010-11-29 at 11:35 +0530, Rahul Sundaram wrote:
>  > Hi
>  > 
>  > Read a couple of reviews and blog posts mentioning this,  if you use ntp
>  > via firstboot in Fedora 14 and you login, you get SELinux warnings on
>  > login.  I tried testing this in a vm and this is very much reproducible
>  > and is such a jarring user experience.  
>  
>  > What can we do to avoid these class of problems for the next release?
>  
>  At release time, the criteria [1] are written to include experiences
>  like this.
>  
>          "In most cases, there must be no SELinux 'AVC: denied' messages
>          or abrt crash notifications on initial boot and subsequent login
>          (see Blocker_Bug_FAQ)"
>  
>  The gap here is that we don't spell out all configuration options in
>  firstboot and whether they should result in a clean login experience.
>  For something like the issue you mention, it would make a good
>  discussion topic as to whether it represents a valid release blocker.  I
>  can see arguments for both sides.  
>  
>  Another gap is that we don't actively test/explore all firstboot
>  configuration options and their impact on setroubleshoot. 
I've been tracking the same issue and I recently added it to the
retrospective. We can probably broaden out the relevant test case:

https://fedoraproject.org/wiki/QA:Testcase_desktop_error_checks
-- 
Adam Williamson
Fedora QA Community Monkey
IRC: adamw | Fedora Talk: adamwill AT fedoraproject DOT org
http://www.happyassassin.net

[Bob Cochran]

I had this problem as well, on the x86_64 arch, for one of the late 
alpha or early beta builds. I did the install on a brand new hard drive. 
A few weeks elapsed, and I downloaded the release version of 14 -- the 
x86_64 DVD iso. I've just installed from this as a URL installation 
using the same hard drive that had the earlier build. I did an "use all 
space" installation and because I like encrypting my systems for added 
privacy, I had to supply the passphrase for the earlier build.

I can't remember whether the problem Rahul documents then happened to me 
on the release installation. During the install process I specified 
using the Fedora and Fedora updates repositories. So I got the latest 
versions of (everything that was updated) at install time.

Bob Cochran


On 11/29/2010 01:05 AM, Rahul Sundaram wrote:
>  Hi
>
>  Read a couple of reviews and blog posts mentioning this,  if you use ntp
>  via firstboot in Fedora 14 and you login, you get SELinux warnings on
>  login.  I tried testing this in a vm and this is very much reproducible
>  and is such a jarring user experience.  What can we do to avoid these
>  class of problems for the next release?
>
>  Rahul