Clean install of Fedora 39 on Dell notebook was working, but recent update not getting 50 selerts??

[Michael D. Setzer II]

Did a clean install of Fedora 39 on a Dell Latitude 5580 and was 
working fine.
After a recent updated started have it get like 50 alerts that almost 
all were to add exceptions.
tried changing it from enforcing to permissive but no change
then changed targetted to minimum and no change.
Go thru the alerts and delete all, and they just popped up again 
and again.
Tried to report, but it would except my login and password?
Ended up disabling selinux to get machine to not have alerts.

Tried to login to the bugzillia with my id on main machine, and it 
would not accept password. Did the change option, and entered 
new password that showed as Good, but then it came with 
message that some system is being used, and Good wasn't good 
enough. Had to use one of those generated passwords to get it to 
show strong, and then it changed password??

All my Fedora 38 machines are working fine. Have another 
machine that I upgraded from 38 to 39, and it seems to have no 
problems. 

Got frustrated and ended up just disabling the selinux completely.
Seems strange that it starts reporting all this issues, and option to 
fix them are almost all to add selinux exceptions?

Thanks.

+------------------------------------------------------------+
 Michael D. Setzer II - Computer Science Instructor (Retired)     
 mailto:[e-mail]                            
 mailto:[e-mail]
 mailto:[e-mail]
 Guam - Where America's Day Begins                        
 G4L Disk Imaging Project maintainer 
 http://sourceforge.net/projects/g4l/
+------------------------------------------------------------+

[old sixpack13]

...
>  
>  Got frustrated and ended up just disabling the selinux completely.
>  Seems strange that it starts reporting all this issues, and option to 
>  fix them are almost all to add selinux exceptions?
>   
sudo fixfiles -B onboot
OR
sudo touch /.autorelabel
and
reboot

[Samuel Sieb]

On 12/7/23 00:22, Michael D. Setzer II via users wrote:
>  Got frustrated and ended up just disabling the selinux completely.
>  Seems strange that it starts reporting all this issues, and option to
>  fix them are almost all to add selinux exceptions? 
I think it will always give you an option to add exceptions, but that's 
not necessarily the only or best option.

Are the errors from Fedora packages or from things you've done?

Do you have examples?

[Michael D. Setzer II]

On 7 Dec 2023 at 23:06, Samuel Sieb wrote:

Date sent:      	Thu, 7 Dec 2023 23:06:08 -0800
Subject:        	Re: Clean install of Fedora 39 on Dell notebook 
was working, but
	recent update not getting 50 selerts??
To:             	users(a)lists.fedoraproject.org
From:           	Samuel Sieb <samuel(a)sieb.net&gt;
Send reply to:  	Community support for Fedora users 
<users(a)lists.fedoraproject.org&gt;

>  On 12/7/23 00:22, Michael D. Setzer II via users wrote:
>  > Got frustrated and ended up just disabling the selinux completely.
>  > Seems strange that it starts reporting all this issues, and option to
>  > fix them are almost all to add selinux exceptions?
>  
>  I think it will always give you an option to add exceptions, but that's 
>  not necessarily the only or best option.
>  
>  Are the errors from Fedora packages or from things you've done?
>  
>  Do you have examples? 
There were 50 of them, and most seemed to be linux files.
Only exception was some were about files in my users BOINC 
directory for files in einstein directory.

Had enforcing set, so changed it to permissive, but same things 
after reboot. Then tried changing the targetted to minimal, and 
again they kept coming back after deleting. 

Looked at my other machine with Fedora 39, and it has enforcing 
and Targetted as status with no issues. It is an ancient Lenovo R60 
with 4G ram, but can only see 3G, but selinux doesn't have any 
issues. Did a dnf update to see if that might have been something, 
but it continued with no messages after reboot.


Some messages talked about need to do restorecon and did those, 
but those messages came back saying to do it again. So, ended up 
just disabling the selinux completely. 

Also, noticed that CPU temp seems about 30 degrees lower than 
with the selinux runing, but might have nothing to do with it. Have 
Boinc running on 8 threads and with the nvidia GPU on the Dell.

Never had issues with selinux with few exceptions. Think I've done 
two exceptions in past just to see. Most times, deleting and they 
don't come back.

Will try turning selinux back on at some point, and see if it comes 
back or not. Just working fine with the selinux disabled. Wish the 
messages actually gave more info.

Thanks for reply. 


>  --
>  _______________________________________________
>  users mailing list -- users(a)lists.fedoraproject.org
>  To unsubscribe send an email to users-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]
>  Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

+------------------------------------------------------------+
 Michael D. Setzer II - Computer Science Instructor (Retired)     
 mailto:[e-mail]                            
 mailto:[e-mail]
 mailto:[e-mail]
 Guam - Where America's Day Begins                        
 G4L Disk Imaging Project maintainer 
 http://sourceforge.net/projects/g4l/
+------------------------------------------------------------+

[Tim]

On Fri, 2023-12-08 at 17:28 +1000, Michael D. Setzer II:
>  Will try turning selinux back on at some point, and see if it comes 
>  back or not. Just working fine with the selinux disabled. Wish the 
>  messages actually gave more info. 
 
Once you've run with SELinux off, you then have to do a lot of SELinux
context restorecons to set the contexts of any files that have been
written to what they need to be, if you turn it back on later.

If you can run with it set to permissive (SELinux is running, but not
disallowing things), files will get written with the right contexts,
and you'll have less homework to fix things up.

Moral of the story - if you intend to re-enable SELinux, the sooner you
do it the less work you have to do.

-- 
 
uname -rsvp
Linux 3.10.0-1160.102.1.el7.x86_64 #1 SMP Tue Oct 17 15:42:21 UTC 2023 x86_64
 
Boilerplate:  All unexpected mail to my mailbox is automatically deleted.
I will only get to see the messages that are posted to the mailing list.

[Michael D. Setzer II]

On 8 Dec 2023 at 23:16, Tim via users wrote:

Subject:        	Re: Clean install of Fedora 39 on Dell notebook 
was working, but
	recent update not getting 50 selerts??
To:             	mikes(a)guam.net, Community support for Fedora 
users
 	<users(a)lists.fedoraproject.org&gt;, Samuel Sieb 
<samuel(a)sieb.net&gt;
Date sent:      	Fri, 08 Dec 2023 23:16:42 +1030
Send reply to:  	Community support for Fedora users 
<users(a)lists.fedoraproject.org&gt;
From:           	Tim via users <users(a)lists.fedoraproject.org&gt;
Copies to:      	Tim <ignored_mailbox(a)yahoo.com.au&gt;

>  On Fri, 2023-12-08 at 17:28 +1000, Michael D. Setzer II:
>  > Will try turning selinux back on at some point, and see if it comes 
>  > back or not. Just working fine with the selinux disabled. Wish the 
>  > messages actually gave more info.
>   
>  Once you've run with SELinux off, you then have to do a lot of SELinux
>  context restorecons to set the contexts of any files that have been
>  written to what they need to be, if you turn it back on later.
>  
>  If you can run with it set to permissive (SELinux is running, but not
>  disallowing things), files will get written with the right contexts,
>  and you'll have less homework to fix things up.
>  
>  Moral of the story - if you intend to re-enable SELinux, the sooner you
>  do it the less work you have to do. 
Problem was a bunch of the selinux errors it was showing talked 
about resetting things but it mentions FILETYPE and then gave a 
ton of options for that value, and I had no clue which one should be 
applied. 

I currently have 6 Fedora machines at home, so time isn't an issue. 
4 are running Fedora 38 and this notebook and and ancient Lenovo 
R60 are both running Fedora 39. Strange the Lenovo has had no 
selinux issue, and is set to enforce and targetted??
 

>  
>  -- 
>   
>  uname -rsvp
>  Linux 3.10.0-1160.102.1.el7.x86_64 #1 SMP Tue Oct 17 15:42:21 UTC 2023 x86_64
>   
>  Boilerplate:  All unexpected mail to my mailbox is automatically deleted.
>  I will only get to see the messages that are posted to the mailing list.
>   
>  --
>  _______________________________________________
>  users mailing list -- users(a)lists.fedoraproject.org
>  To unsubscribe send an email to users-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]
>  Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

+------------------------------------------------------------+
 Michael D. Setzer II - Computer Science Instructor (Retired)     
 mailto:[e-mail]                            
 mailto:[e-mail]
 mailto:[e-mail]
 Guam - Where America's Day Begins                        
 G4L Disk Imaging Project maintainer 
 http://sourceforge.net/projects/g4l/
+------------------------------------------------------------+

[Tim]

On Fri, 2023-12-08 at 23:42 +1000, Michael D. Setzer II:
>  Problem was a bunch of the selinux errors it was showing talked 
>  about resetting things but it mentions FILETYPE and then gave a 
>  ton of options for that value, and I had no clue which one should be 
>  applied.  
Generally, if it's just that the SELinux contexts are missing,
restorecon along with the filepath sets them to what they need to be
(most contexts are based on file location, your files in home should
normally get a certain type of context, a web server's files in the
standard location should get a web serving type of context, etc).

If someone's developed a new type of context, it ought to get applied
in the same way (automatically when created, or when restorecon is
used, based on the filepath).

And relabelling does that.  After installing some new SELinux rules,
the procedure sets a flag to cause relabelling, and that'll take done
after the next boot.

Exceptions occur when you want a different type of context in an usual
place.  Such as you might be serving web pages from a different file
path.  You need to create your own rules so files get given the
necessary contexts automatically, and you need to set the contexts on
any existing files (there).

Alerts about things are (allegedly) faults.  Such as right now I have
an alert that:

The source process:  cups-pk-helper-   (with a truncated name, grrr!)
Attempted this access:  read
On this sock_file: cups.sock

If I look more into the logs the full name is listed:

comm=cups-pk-helper-
exe=/usr/libexec/cups-pk-helper-mechanism

So...  Is it supposed to be able to read that file?  My guess would be
yes, based on the names.  Why isn't it getting it right by itself? 
Dunno, my guess would be a bug.  Can I fix it?  Perhaps.  The file
could be randomly stuffed due to a crash, or power outage.  But if it
keeps creating it wrong, perhaps not.  Does it matter?  Dunno, printing
was working last time I tried it.  But printing is always fickle.

 
-- 
 
uname -rsvp
Linux 3.10.0-1160.102.1.el7.x86_64 #1 SMP Tue Oct 17
15:42:21 UTC 2023 x86_64
 
Boilerplate:  All unexpected mail to my
mailbox is automatically deleted. I will only get to see the messages
that are posted to the mailing list.

[Michael D. Setzer II]

On 9 Dec 2023 at 18:02, Tim wrote:

Subject:        	Re: Clean install of Fedora 39 on Dell notebook 
was working, but
	recent update not getting 50 selerts??
From:           	Tim <ignored_mailbox(a)yahoo.com.au&gt;
To:             	mikes(a)guam.net, Community support for Fedora 
users
 	<users(a)lists.fedoraproject.org&gt;
Date sent:      	Sat, 09 Dec 2023 18:02:43 +1030

Did a dnf reinstall * to see if maybe somethings had installed 
before something else. Then reenabled selinux and rebooted.
Originally go then 50 messages again that seemed to be same.
Unfortunately, the setrouble browser has a option to show the 50 
messages summary, but I can do a ctrl-a to highlight them all but 
ctrl-C does not work to copy them..
Deleted them all. They didn't immediately come back.
Did just get 12 pop up, and these are for sshd and mandb?

last one is mandb 
setattr
index.db

SELINUX Alert browser doesn't let on copy top part or if you were 
trying part? also doesn't let copy the list of all info??

Does let one copy this part, but have no clue what FILE_TYPE 
would be used, or where this index.db file is located?

First 3 are sshd with read, open, getattr all with inactive.mod
Then 9 with mandb with create, write, ioctl, read, open, rename, 
unlink, lock, setattr. with 29605, 29605, xscreensaver.1.gz (3 
times), 29605, index.db, 29605, index.db.

Did have 2 earlier ones that were with boinc, and talked about 
missing selinux type boinc_t??

Since can't copy stuff from here is what would copy for last one?


You need to change the label on index.db
# semanage fcontext -a -t FILE_TYPE 'index.db'
where FILE_TYPE is one of the following: boot_t, cert_t, device_t, 
dhcpc_state_t, etc_aliases_t, etc_mail_t, etc_runtime_t, faillog_t, 
fonts_t, getty_lock_t, httpd_lock_t, initrc_state_t, initrc_tmp_t, 
initrc_var_log_t, initrc_var_run_t, ipsec_mgmt_lock_t, 
ipsec_var_run_t, iptables_lock_t, krb5_host_rcache_t, 
krb5kdc_lock_t, lastlog_t, local_login_lock_t, locale_t, lvm_lock_t, 
mnt_t, net_conf_t, postgresql_db_t, postgresql_lock_t, 
semanage_read_lock_t, semanage_trans_lock_t, sshd_key_t, 
sysctl_fs_t, sysctl_t, system_conf_t, system_dbusd_var_lib_t, 
systemd_passwd_var_run_t, udev_rules_t, udev_var_run_t, 
user_home_dir_t, user_home_t, var_lib_t, var_lock_t, var_log_t, 
var_spool_t, wtmp_t, xdm_lock_t.
Then execute:
restorecon -v 'index.db'
+------------------------------------------------------------+
 Michael D. Setzer II - Computer Science Instructor (Retired)     
 mailto:[e-mail]                            
 mailto:[e-mail]
 mailto:[e-mail]
 Guam - Where America's Day Begins                        
 G4L Disk Imaging Project maintainer 
 http://sourceforge.net/projects/g4l/
+------------------------------------------------------------+

[Thomas Cameron]

On 12/9/23 07:36, Michael D. Setzer II via users wrote:
>  On 9 Dec 2023 at 18:02, Tim wrote:
>  
>  Subject:        	Re: Clean install of Fedora 39 on Dell notebook
>  was working, but
>  	recent update not getting 50 selerts??
>  From:           	Tim <ignored_mailbox(a)yahoo.com.au&gt;
>  To:             	mikes(a)guam.net, Community support for Fedora
>  users
>    	<users(a)lists.fedoraproject.org&gt;
>  Date sent:      	Sat, 09 Dec 2023 18:02:43 +1030
>  
>  Did a dnf reinstall * to see if maybe somethings had installed
>  before something else. Then reenabled selinux and rebooted.
>  Originally go then 50 messages again that seemed to be same.
>  Unfortunately, the setrouble browser has a option to show the 50
>  messages summary, but I can do a ctrl-a to highlight them all but
>  ctrl-C does not work to copy them..
>  Deleted them all. They didn't immediately come back.
>  Did just get 12 pop up, and these are for sshd and mandb?
>  
>  last one is mandb
>  setattr
>  index.db
>  
>  SELINUX Alert browser doesn't let on copy top part or if you were
>  trying part? also doesn't let copy the list of all info??
>  
>  Does let one copy this part, but have no clue what FILE_TYPE
>  would be used, or where this index.db file is located?
>  
>  First 3 are sshd with read, open, getattr all with inactive.mod
>  Then 9 with mandb with create, write, ioctl, read, open, rename,
>  unlink, lock, setattr. with 29605, 29605, xscreensaver.1.gz (3
>  times), 29605, index.db, 29605, index.db.
>  
>  Did have 2 earlier ones that were with boinc, and talked about
>  missing selinux type boinc_t??
>  
>  Since can't copy stuff from here is what would copy for last one?
>  
>  
>  You need to change the label on index.db
>  # semanage fcontext -a -t FILE_TYPE 'index.db'
>  where FILE_TYPE is one of the following: boot_t, cert_t, device_t,
>  dhcpc_state_t, etc_aliases_t, etc_mail_t, etc_runtime_t, faillog_t,
>  fonts_t, getty_lock_t, httpd_lock_t, initrc_state_t, initrc_tmp_t,
>  initrc_var_log_t, initrc_var_run_t, ipsec_mgmt_lock_t,
>  ipsec_var_run_t, iptables_lock_t, krb5_host_rcache_t,
>  krb5kdc_lock_t, lastlog_t, local_login_lock_t, locale_t, lvm_lock_t,
>  mnt_t, net_conf_t, postgresql_db_t, postgresql_lock_t,
>  semanage_read_lock_t, semanage_trans_lock_t, sshd_key_t,
>  sysctl_fs_t, sysctl_t, system_conf_t, system_dbusd_var_lib_t,
>  systemd_passwd_var_run_t, udev_rules_t, udev_var_run_t,
>  user_home_dir_t, user_home_t, var_lib_t, var_lock_t, var_log_t,
>  var_spool_t, wtmp_t, xdm_lock_t.
>  Then execute:
>  restorecon -v 'index.db' 
The files should inherit either the label of the directory they're 
created in, or if a specific context has been set for a filename, it 
should get that context.

Normally, if something's incorrectly labeled, you can just restorecon -v 
the file to see what it was changed to. In this example, I created an 
index.html in root's home directory and them moved it to /var/www/html. 
When I restorecon -vR /var/www it shows me what it WAS labeled, and what 
it was changed to:

[root@haproxy ~]# restorecon -vR /var/www/
Relabeled /var/www/html/index.html from 
unconfined_u:object_r:admin_home_t:s0 to 
unconfined_u:object_r:httpd_sys_content_t:s0

So if you're getting errors on mislabeled files, the first bet is to 
just do a restorecon -v on it, or restorecon -vR on the parent directory.

https://www.youtube.com/watch?v=_WOKRaM-HI4 for a less than 45 minute 
lesson on the basics of SELinux.

If you're running something which was compiled from source, for 
instance, it may not understand what SELinux label it's supposed to 
have, or even just not understand SELinux.

You might want to set the app to run unconfined. Description on how to 
do this is here: 
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...

Hope this is helpful.

Thomas

[Tim]

On Sun, 2023-12-10 at 17:07 -0600, Thomas Cameron via users wrote:
>  The files should inherit either the label of the directory
> they're 
>  created in, or if a specific context has been set for a filename, it 
>  should get that context.
>  
>  Normally, if something's incorrectly labeled, you can just restorecon -v 
>  the file to see what it was changed to. In this example, I created an 
>  index.html in root's home directory and them moved it to /var/www/html.  
Actually, that brings up another point, that I don't know if it's still
the case.

When you write a file to a specific place, the SELinux contexts are set
for what's usually expected at that file path.  e.g. Write a page.html
file in your homespace, and it'll get general context that won't be
readable by a webserver.

If you copied that file to another place, the copy will be written with
the expected contexts for that new place.  e.g. If you copied that
page.html to your webserver serving path, the copy will get contexts
that allow it to be web served.

If you moved a file to another place, the original contexts went with
the file.  e.g. Your page.html in your homespace with general purpose
contexts ends up in your webserver serving path still with general
purpose contexts that don't allow it to be served.

That kind of thing caused problems for people who migrated various
kinds of data from one point to another, instead of copying it, or
creating it in the right place to start with.
 
-- 
 
NB:  All unexpected mail to my mailbox is automatically deleted.
I will only get to see the messages that are posted to the list.
 
The following system info data is generated fresh for each post:
 
uname -rsvp
Linux 6.2.15-100.fc36.x86_64 #1 SMP PREEMPT_DYNAMIC Thu May 11 16:51:53
UTC 2023 x86_64

[Thomas Cameron]

>  Actually, that brings up another point, that I don't know if
> it's still
>  the case.
>  
>  When you write a file to a specific place, the SELinux contexts are set
>  for what's usually expected at that file path.  e.g. Write a page.html
>  file in your homespace, and it'll get general context that won't be
>  readable by a webserver.
>  
>  If you copied that file to another place, the copy will be written with
>  the expected contexts for that new place.  e.g. If you copied that
>  page.html to your webserver serving path, the copy will get contexts
>  that allow it to be web served.
>  
>  If you moved a file to another place, the original contexts went with
>  the file.  e.g. Your page.html in your homespace with general purpose
>  contexts ends up in your webserver serving path still with general
>  purpose contexts that don't allow it to be served.
>  
>  That kind of thing caused problems for people who migrated various
>  kinds of data from one point to another, instead of copying it, or
>  creating it in the right place to start with.
>     
Yup. In the video I linked to earlier, I talk about that problem. It's 
an easy mistake to make. Almost always, the solution is to just 
restorecon -vR the parent directory and you'll see what it was, and what 
it was changed to. Then it starts working.