On Fri, 31 Jul 2020 05:51:21 +0800 Ed Greshko ed.greshko@greshko.com wrote:
Well, it seems similar issues have come up in the past.
https://bugzilla.redhat.com/show_bug.cgi?id=1309108
and
https://bugzilla.redhat.com/show_bug.cgi?id=1298192
You may want to try the work around in comment 19 of that one.
I think it is already in place as the command
sesearch -A -s unconfined_t -t user_cron_spool_t -c file
found
allow application_domain_type user_cron_spool_t:file { append getattr ioctl lock read write }; allow crontab_domain user_cron_spool_t:file { append create getattr ioctl link lock open read rename setattr unlink write }; allow domain file_type:file map; [ domain_can_mmap_files ]:True allow files_unconfined_type file_type:file execmod; [ selinuxuser_execmod ]:True allow files_unconfined_type file_type:file { append audit_access create execute execute_no_trans getattr ioctl link lock map mounton open quotaon read relabelfrom relabelto rename setattr swapon unlink write }; allow unconfined_t user_cron_spool_t:file entrypoint; [ cron_userdomain_transition ]:True allow unconfined_t user_cron_spool_t:file { getattr ioctl read write };
and the second from the bottom is that workaround.
I think you should then wait on your BZ as well as you may want to join/ask on the selinux mailing list.
I agree, I'll wait a while to see if anything develops, and then ask there. Hey, it is F31, so going end of life in a few months, seems to work fine except for this corner case, so probably not a priority.