Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.

Bug 1518043

Summary: All accounts failed to login after changing selinux from disabled to enforcing
Product: Red Hat Enterprise Linux 7 Reporter: cuzhang <cuzhang>
Component: selinux-policyAssignee: Lukas Vrabec <lvrabec>
Status: CLOSED NOTABUG QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: high Docs Contact:
Priority: unspecified    
Version: 7.5CC: cuzhang, lvrabec, mgrepl, mmalik, plautrba, ssekidde
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-12-04 14:29:22 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description cuzhang 2017-11-28 02:30:52 UTC
All accounts failed to login after re-enable selinux

Version-Release number of selected component (if applicable):
RHEL7.5

How reproducible:
Disable selinux, then enable selinux

Steps to Reproduce:
1.make sure current selinux is disabled(if not, please modify SELINUX value to disabled in /etc/selinux/config, then reboot os to take change effect)
2. modify selinux from disabled to enforcing(modify /etc/selinux/config SELINUX=enforcing, reboot os)

$ cat /etc/selinux/config 

...
SELINUX=enforcing
...


3.make an attempt to login OS and all accounts will be failed.

Actual results:
All accounts failed to login 

Expected results:
login successfully, and OS  works well

Additional info:

Comment 2 Petr Lautrbach 2017-11-28 07:42:16 UTC
Please attach AVC denial messages after you reboot and log in in permissive mode:

1. /etc/selinux/config

SELINUX=permissive

2. reboot
3. login
4. ausearch -m AVC,USER_AVC -ts recent

You can find also some useful information in the output of 'journalctl -b'. Look for rhel-autorelabel.service

Comment 3 cuzhang 2017-11-29 07:11:16 UTC
Nov 29 12:22:02 yafu-laptop python: SELinux is preventing /usr/libexec/accounts-daemon from open access on the file /etc/shadow.#012#012*****  

Plugin restorecon (94.8 confidence) suggests   ************************#012#012If you want to fix the label. #012/etc/shadow default label should be shadow_t.#012
Then you can run restorecon.#012Do#012# /sbin/restorecon -v /etc/shadow#012#012*****  

Plugin catchall_labels (5.21 confidence) suggests   *******************#012#012If you want to allow accounts-daemon to have open access on the shadow file#012Then you need to change the label on /etc/shadow#012Do#012# semanage fcontext -a -t FILE_TYPE '/etc/shadow'#012where FILE_TYPE is one of the following: NetworkManager_tmp_t, abrt_helper_exec_t, abrt_tmp_t, abrt_upload_watch_tmp_t, abrt_var_cache_t, abrt_var_run_t, accountsd_exec_t, accountsd_var_lib_t, admin_crontab_tmp_t, alsa_home_t, alsa_tmp_t, amanda_tmp_t, anon_inodefs_t, antivirus_home_t, antivirus_tmp_t, apcupsd_tmp_t, apmd_tmp_t, arpwatch_tmp_t, asterisk_tmp_t, audio_home_t, auditadm_sudo_tmp_t, auth_home_t, autofs_t, automount_tmp_t, awstats_tmp_t, bacula_tmp_t, bin_t, bitlbee_tmp_t, bluetooth_helper_tmp_t, bluetooth_helper_tmpfs_t, bluetooth_tmp_t, boinc_proje
ct_tmp_t, boinc_tmp_t, boot_t, bootloader_tmp_t, bugzilla_tmp_t, cache_home_t, cardmgr_dev_t, ccs_tmp_t, cdcc_tmp_t, cert_t, chrome_sandbox_home_t, chrome_sandbox_tmp_t, cifs_t, cinder_api_tmp_t, cinder_backup_tmp_t, cinder_scheduler_tmp_t, cinder_volume_tmp_t, cloud_init_tmp_t, cluster_conf_t, cluster_tmp_t, cluster_var_lib_t, cluster_var_run_t, cobbler_tmp_t, cockpit_tmp_t, collectd_script_tmp_t, colord_tmp_t, comsat_tmp_t, condor_master_tmp_t, condor_schedd_tmp_t, condor_startd_tmp_t, config_home_t, conman_tmp_t, consolekit_log_t, container_home_t, container_runtime_tmp_t, couchdb_tmp_t, cpu_online_t, crack_tmp_t, crond_tmp_t, crontab_tmp_t, ctdbd_tmp_t, cups_pdf_tmp_t, cupsd_lpd_tmp_t, cupsd_tmp_t, cvs_home_t, cvs_tmp_t, cyphesis_tmp_t, cyrus_tmp_t, data_home_t, dbadm_sudo_tmp_t, dbskkd_tmp_t, dbus_home_t,

Comment 4 Lukas Vrabec 2017-12-03 20:53:17 UTC
It looks like your system is mislabeled. Could you you please run system in PERMISSIVE MODE like is suggested in comment#2 and then run: 

# restorecon -Rv / 

Thanks,
Lukas.

Comment 5 cuzhang 2017-12-04 01:50:57 UTC
Login successfully after excuton 'restorecon -Rv /'.

Comment 6 Lukas Vrabec 2017-12-04 14:29:22 UTC
Yep, When you switching from disabled to permissive or enforcing you need to fix labels on system. This is not policy issue. Closing this.