Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1518043 - All accounts failed to login after changing selinux from disabled to enforcing
Summary: All accounts failed to login after changing selinux from disabled to enforcing
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.5
Hardware: All
OS: Linux
Target Milestone: rc
: ---
Assignee: Lukas Vrabec
QA Contact: BaseOS QE Security Team
Depends On:
TreeView+ depends on / blocked
Reported: 2017-11-28 02:30 UTC by cuzhang
Modified: 2017-12-04 14:29 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2017-12-04 14:29:22 UTC
Target Upstream Version:

Attachments (Terms of Use)

Description cuzhang 2017-11-28 02:30:52 UTC
All accounts failed to login after re-enable selinux

Version-Release number of selected component (if applicable):

How reproducible:
Disable selinux, then enable selinux

Steps to Reproduce:
1.make sure current selinux is disabled(if not, please modify SELINUX value to disabled in /etc/selinux/config, then reboot os to take change effect)
2. modify selinux from disabled to enforcing(modify /etc/selinux/config SELINUX=enforcing, reboot os)

$ cat /etc/selinux/config 


3.make an attempt to login OS and all accounts will be failed.

Actual results:
All accounts failed to login 

Expected results:
login successfully, and OS  works well

Additional info:

Comment 2 Petr Lautrbach 2017-11-28 07:42:16 UTC
Please attach AVC denial messages after you reboot and log in in permissive mode:

1. /etc/selinux/config


2. reboot
3. login
4. ausearch -m AVC,USER_AVC -ts recent

You can find also some useful information in the output of 'journalctl -b'. Look for rhel-autorelabel.service

Comment 3 cuzhang 2017-11-29 07:11:16 UTC
Nov 29 12:22:02 yafu-laptop python: SELinux is preventing /usr/libexec/accounts-daemon from open access on the file /etc/shadow.#012#012*****  

Plugin restorecon (94.8 confidence) suggests   ************************#012#012If you want to fix the label. #012/etc/shadow default label should be shadow_t.#012
Then you can run restorecon.#012Do#012# /sbin/restorecon -v /etc/shadow#012#012*****  

Plugin catchall_labels (5.21 confidence) suggests   *******************#012#012If you want to allow accounts-daemon to have open access on the shadow file#012Then you need to change the label on /etc/shadow#012Do#012# semanage fcontext -a -t FILE_TYPE '/etc/shadow'#012where FILE_TYPE is one of the following: NetworkManager_tmp_t, abrt_helper_exec_t, abrt_tmp_t, abrt_upload_watch_tmp_t, abrt_var_cache_t, abrt_var_run_t, accountsd_exec_t, accountsd_var_lib_t, admin_crontab_tmp_t, alsa_home_t, alsa_tmp_t, amanda_tmp_t, anon_inodefs_t, antivirus_home_t, antivirus_tmp_t, apcupsd_tmp_t, apmd_tmp_t, arpwatch_tmp_t, asterisk_tmp_t, audio_home_t, auditadm_sudo_tmp_t, auth_home_t, autofs_t, automount_tmp_t, awstats_tmp_t, bacula_tmp_t, bin_t, bitlbee_tmp_t, bluetooth_helper_tmp_t, bluetooth_helper_tmpfs_t, bluetooth_tmp_t, boinc_proje
ct_tmp_t, boinc_tmp_t, boot_t, bootloader_tmp_t, bugzilla_tmp_t, cache_home_t, cardmgr_dev_t, ccs_tmp_t, cdcc_tmp_t, cert_t, chrome_sandbox_home_t, chrome_sandbox_tmp_t, cifs_t, cinder_api_tmp_t, cinder_backup_tmp_t, cinder_scheduler_tmp_t, cinder_volume_tmp_t, cloud_init_tmp_t, cluster_conf_t, cluster_tmp_t, cluster_var_lib_t, cluster_var_run_t, cobbler_tmp_t, cockpit_tmp_t, collectd_script_tmp_t, colord_tmp_t, comsat_tmp_t, condor_master_tmp_t, condor_schedd_tmp_t, condor_startd_tmp_t, config_home_t, conman_tmp_t, consolekit_log_t, container_home_t, container_runtime_tmp_t, couchdb_tmp_t, cpu_online_t, crack_tmp_t, crond_tmp_t, crontab_tmp_t, ctdbd_tmp_t, cups_pdf_tmp_t, cupsd_lpd_tmp_t, cupsd_tmp_t, cvs_home_t, cvs_tmp_t, cyphesis_tmp_t, cyrus_tmp_t, data_home_t, dbadm_sudo_tmp_t, dbskkd_tmp_t, dbus_home_t,

Comment 4 Lukas Vrabec 2017-12-03 20:53:17 UTC
It looks like your system is mislabeled. Could you you please run system in PERMISSIVE MODE like is suggested in comment#2 and then run: 

# restorecon -Rv / 


Comment 5 cuzhang 2017-12-04 01:50:57 UTC
Login successfully after excuton 'restorecon -Rv /'.

Comment 6 Lukas Vrabec 2017-12-04 14:29:22 UTC
Yep, When you switching from disabled to permissive or enforcing you need to fix labels on system. This is not policy issue. Closing this.

Note You need to log in before you can comment on or make changes to this bug.