$ grub2-mkconfig -o /boot/grub/grub.cfg
/usr/sbin/grub2-probe: error: cannot restore the original directory.
Most users/admins call grub2-mkconfig from their home directory, so grant it search rights on the home directory (but no more).
type=AVC msg=audit(1486280243.141:685): avc: denied { getattr } for pid=24648 comm="30_os-prober" path="/root" dev="sda" ino=1179649 scontext=staff_u:sysadm_r:bootloader_t:s0-s0:c0.c1023 tcontext=root:object_r:user_home_dir_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1486280243.141:686): avc: denied { search } for pid=24648 comm="30_os-prober" name="root" dev="sda" ino=1179649 scontext=staff_u:sysadm_r:bootloader_t:s0-s0:c0.c1023 tcontext=root:object_r:user_home_dir_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1486280243.165:687): avc: denied { getattr } for pid=24652 comm="40_custom" path="/root" dev="sda" ino=1179649 scontext=staff_u:sysadm_r:bootloader_t:s0-s0:c0.c1023 tcontext=root:object_r:user_home_dir_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1486280243.165:688): avc: denied { search } for pid=24652 comm="40_custom" name="root" dev="sda" ino=1179649 scontext=staff_u:sysadm_r:bootloader_t:s0-s0:c0.c1023 tcontext=root:object_r:user_home_dir_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1486280243.175:689): avc: denied { getattr } for pid=24653 comm="41_custom" path="/root" dev="sda" ino=1179649 scontext=staff_u:sysadm_r:bootloader_t:s0-s0:c0.c1023 tcontext=root:object_r:user_home_dir_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1486280243.175:690): avc: denied { search } for pid=24653 comm="41_custom" name="root" dev="sda" ino=1179649 scontext=staff_u:sysadm_r:bootloader_t:s0-s0:c0.c1023 tcontext=root:object_r:user_home_dir_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1486280243.188:691): avc: denied { search } for pid=24578 comm="grub-mkconfig" name="root" dev="sda" ino=1179649 scontext=staff_u:sysadm_r:bootloader_t:s0-s0:c0.c1023 tcontext=root:object_r:user_home_dir_t:s0 tclass=dir permissive=0
Gentoo-Bug: https://bugs.gentoo.org/537652
---
policy/modules/admin/bootloader.te | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/policy/modules/admin/bootloader.te b/policy/modules/admin/bootloader.te
index 3fad7cb..962cfd0 100644
--- a/policy/modules/admin/bootloader.te
+++ b/policy/modules/admin/bootloader.te
@@ -140,7 +140,7 @@ seutil_read_loadpolicy(bootloader_t)
seutil_dontaudit_search_config(bootloader_t)
userdom_use_user_terminals(bootloader_t)
-userdom_dontaudit_search_user_home_dirs(bootloader_t)
+userdom_search_user_home_dirs(bootloader_t)
ifdef(`distro_debian',`
allow bootloader_t bootloader_tmp_t:{ dir file } { relabelfrom relabelto };
--
2.10.2
commit b0c13980d224c49207315154905eb7fcb90f289d
broke grub-mkconfig which needs to be able to update the grub.cfg file.
Remove the fcontext for grub.cfg so it can update the file.
$ grub-mkconfig -o /boot/grub/grub.cfg
Generating grub configuration file ...
mv: cannot move '/boot/grub/grub.cfg.new' to '/boot/grub/grub.cfg':
Permission denied
type=AVC msg=audit(1486273313.557:26703): avc: denied { unlink } for pid=10757 comm="mv" name="grub.cfg" dev="md1" ino=10070 scontext=staff_u:sysadm_r:bootloader_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bootloader_etc_t:s0 tclass=file permissive=0
type=SYSCALL msg=audit(1486273313.557:26703): arch=c000003e syscall=82 success=no exit=-13 a0=3a93725fbef a1=3a93725fc07 a2=0 a3=2 items=4 ppid=9489 pid=10757 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts3 ses=4 comm="mv" exe="/bin/mv" subj=staff_u:sysadm_r:bootloader_t:s0-s0:c0.c1023 key=(null)
type=CWD msg=audit(1486273313.557:26703): cwd="/root"
type=PATH msg=audit(1486273313.557:26703): item=0 name="/boot/grub/" inode=10041 dev=09:01 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bootloader_run_t:s0 nametype=PARENT
type=PATH msg=audit(1486273313.557:26703): item=1 name="/boot/grub/" inode=10041 dev=09:01 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bootloader_run_t:s0 nametype=PARENT
type=PATH msg=audit(1486273313.557:26703): item=2 name="/boot/grub/grub.cfg.new" inode=10072 dev=09:01 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=staff_u:object_r:bootloader_run_t:s0 nametype=DELETE
type=PATH msg=audit(1486273313.557:26703): item=3 name="/boot/grub/grub.cfg" inode=10070 dev=09:01 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bootloader_etc_t:s0 nametype=DELETE
---
policy/modules/admin/bootloader.fc | 3 ---
1 file changed, 3 deletions(-)
diff --git a/policy/modules/admin/bootloader.fc b/policy/modules/admin/bootloader.fc
index c43c428..d62e8e3 100644
--- a/policy/modules/admin/bootloader.fc
+++ b/policy/modules/admin/bootloader.fc
@@ -1,9 +1,6 @@
/boot/grub.* -d gen_context(system_u:object_r:bootloader_run_t,s0)
/boot/grub.*/.* gen_context(system_u:object_r:bootloader_run_t,s0)
-/boot/grub.*/grub.cfg -- gen_context(system_u:object_r:bootloader_etc_t,s0)
-/boot/grub.*/grub.conf -- gen_context(system_u:object_r:bootloader_etc_t,s0)
-
/etc/lilo\.conf.* -- gen_context(system_u:object_r:bootloader_etc_t,s0)
/etc/yaboot\.conf.* -- gen_context(system_u:object_r:bootloader_etc_t,s0)
/etc/grub.d(/.*)? -- gen_context(system_u:object_r:bootloader_etc_t,s0)
--
2.10.2
On Sun, Feb 05, 2017 at 03:47:28PM +0800, Jason Zaman wrote:
> commit b0c13980d224c49207315154905eb7fcb90f289d
> broke grub-mkconfig which needs to be able to update the grub.cfg file.
> Remove the fcontext for grub.cfg so it can update the file.
Bah, dont apply this. its still broken
>
> $ grub-mkconfig -o /boot/grub/grub.cfg
> Generating grub configuration file ...
> mv: cannot move '/boot/grub/grub.cfg.new' to '/boot/grub/grub.cfg':
> Permission denied
>
> type=AVC msg=audit(1486273313.557:26703): avc: denied { unlink } for pid=10757 comm="mv" name="grub.cfg" dev="md1" ino=10070 scontext=staff_u:sysadm_r:bootloader_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bootloader_etc_t:s0 tclass=file permissive=0
> type=SYSCALL msg=audit(1486273313.557:26703): arch=c000003e syscall=82 success=no exit=-13 a0=3a93725fbef a1=3a93725fc07 a2=0 a3=2 items=4 ppid=9489 pid=10757 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts3 ses=4 comm="mv" exe="/bin/mv" subj=staff_u:sysadm_r:bootloader_t:s0-s0:c0.c1023 key=(null)
> type=CWD msg=audit(1486273313.557:26703): cwd="/root"
> type=PATH msg=audit(1486273313.557:26703): item=0 name="/boot/grub/" inode=10041 dev=09:01 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bootloader_run_t:s0 nametype=PARENT
> type=PATH msg=audit(1486273313.557:26703): item=1 name="/boot/grub/" inode=10041 dev=09:01 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bootloader_run_t:s0 nametype=PARENT
> type=PATH msg=audit(1486273313.557:26703): item=2 name="/boot/grub/grub.cfg.new" inode=10072 dev=09:01 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=staff_u:object_r:bootloader_run_t:s0 nametype=DELETE
> type=PATH msg=audit(1486273313.557:26703): item=3 name="/boot/grub/grub.cfg" inode=10070 dev=09:01 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bootloader_etc_t:s0 nametype=DELETE
> ---
> policy/modules/admin/bootloader.fc | 3 ---
> 1 file changed, 3 deletions(-)
>
> diff --git a/policy/modules/admin/bootloader.fc b/policy/modules/admin/bootloader.fc
> index c43c428..d62e8e3 100644
> --- a/policy/modules/admin/bootloader.fc
> +++ b/policy/modules/admin/bootloader.fc
> @@ -1,9 +1,6 @@
> /boot/grub.* -d gen_context(system_u:object_r:bootloader_run_t,s0)
> /boot/grub.*/.* gen_context(system_u:object_r:bootloader_run_t,s0)
>
> -/boot/grub.*/grub.cfg -- gen_context(system_u:object_r:bootloader_etc_t,s0)
> -/boot/grub.*/grub.conf -- gen_context(system_u:object_r:bootloader_etc_t,s0)
> -
> /etc/lilo\.conf.* -- gen_context(system_u:object_r:bootloader_etc_t,s0)
> /etc/yaboot\.conf.* -- gen_context(system_u:object_r:bootloader_etc_t,s0)
> /etc/grub.d(/.*)? -- gen_context(system_u:object_r:bootloader_etc_t,s0)
> --
> 2.10.2
>