resetting /proc/thread-self/attr/fscreate results in 'Invalid Argument'
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| libselinux (Ubuntu) |
Won't Fix
|
Undecided
|
Unassigned | ||
| linux (Ubuntu) |
Won't Fix
|
Undecided
|
Unassigned | ||
Bug Description
root@ubuntu:~# useradd -g 100 tst003
useradd: failure while writing changes to /etc/passwd
root@ubuntu:~# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: permissive
Mode from config file: permissive
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: requested (insecure)
Max kernel policy version: 31
The problem does not occur when SELinux is complete disabled.
Please note that a very similar problem occurs using groupadd:
root@ubuntu:~# groupadd tstgrp001
groupadd: failure while writing changes to /etc/group
= journal =
(Please note that there is *no* AVC!)
May 05 05:11:44 ubuntu useradd[756]: new user: name=tst003, UID=1004, GID=100, home=/home/tst003, shell=/bin/sh
May 05 05:11:44 ubuntu audit[756]: ADD_USER pid=756 uid=0 auid=1002 ses=1 subj=unconfined
May 05 05:11:44 ubuntu useradd[756]: failure while writing changes to /etc/passwd
May 05 05:11:44 ubuntu audit[756]: ADD_USER pid=756 uid=0 auid=1002 ses=1 subj=unconfined
May 05 05:11:44 ubuntu useradd[756]: failed adding user 'tst003', data deleted
= ltrace =
[pid 1074] SYS_write(12, "root:x:"..., 1360) = 1360
[pid 1074] <... fflush resumed> ) = 0
[pid 1074] fileno(
[pid 1074] fsync(12, 0x5595b21c62e0, 0, 0x7ff933d5c154 <unfinished ...>
[pid 1074] SYS_fsync(12) = 0
[pid 1074] <... fsync resumed> ) = 0
[pid 1074] fclose(
[pid 1074] SYS_close(12) = 0
[pid 1074] <... fclose resumed> ) = 0
[pid 1074] utime(0x7ffee34
[pid 1074] SYS_utime(
[pid 1074] <... utime resumed> ) = 0
[pid 1074] fclose(
[pid 1074] SYS_close(5) = 0
[pid 1074] <... fclose resumed> ) = 0
[pid 1074] setfscreatecon(0, 0x5595b21af118, 1, 2 <unfinished ...>
[pid 1074] SYS_openat(
[pid 1074] SYS_write(5, nil, 0) = -22
[pid 1074] SYS_close(5) = 0
[pid 1074] <... setfscreatecon resumed> ) = 0xffffffff
[pid 1074] free(0x5595b21b
[pid 1074] free(0x5595b21b
[pid 1074] strlen("x") = 1
[pid 1074] memset(
[pid 1074] free(0x5595b21b
[pid 1074] free(0x5595b21b
[pid 1074] free(0x5595b21b
[pid 1074] free(0x5595b21b
= strace =
write(12, "root:x:"..., 1360) = 1360
fsync(12) = 0
close(12) = 0
utime("
close(5) = 0
openat(AT_FDCWD, "/proc/
write(5, NULL, 0) = -1 EINVAL (Invalid argument)
close(5) = 0
= Version Information =
root@ubuntu:~# lsb_release -rd
Description: Ubuntu 18.04 LTS
Release: 18.04
root@ubuntu:~# dpkg -l | grep passwd | grep -v base-pa
ii passwd 1:4.5-1ubuntu1 amd64 change and administer password and group data
root@ubuntu:~# dpkg -l | grep selinux
ii libselinux1:amd64 2.7-2build2 amd64 SELinux runtime shared libraries
ii python3-selinux 2.7-2build2 amd64 Python3 bindings to SELinux shared libraries
ii selinux-basics 0.5.6 all SELinux basic support
ii selinux-
ii selinux-policy-dev 2:2.20180114-1 all Headers from the SELinux reference policy for building modules
ii selinux-utils 2.7-2build2 amd64 SELinux utility programs
root@ubuntu:~# uname -a
Linux ubuntu 4.15.0-20-generic #21-Ubuntu SMP Tue Apr 24 06:16:15 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
| Andreas Florath (ansreas) wrote | #1 |
| Andreas Florath (ansreas) wrote | #2 |
| affects: | shadow (Ubuntu) → libselinux (Ubuntu) |
| summary: |
- useradd fails when selinux is set to permissive + resetting /proc/thread-self/attr/fscreate results in 'Invalid Argument' |
| Igor Klyuchnikov (mouth.shut) wrote | #3 |
| Launchpad Janitor (janitor) wrote | #4 |
| Changed in libselinux (Ubuntu): | |
| status: | New → Confirmed |
| Igor Klyuchnikov (mouth.shut) wrote | #5 |
| Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote Missing required logs. | #6 |
| Changed in linux (Ubuntu): | |
| status: | New → Incomplete |
| tags: | added: bionic |
| Andreas Florath (ansreas) wrote | #7 |
| Matthias Klose (doko) wrote | #8 |
| Changed in libselinux (Ubuntu): | |
| status: | Confirmed → Won't Fix |
| Changed in linux (Ubuntu): | |
| status: | Incomplete → Won't Fix |
It looks that the root cause affects multiple packages.
Observations: programs like lvchange have a similar problem:
# lvresize -L +1M /dev/mapper/vg-home
SELinux context reset: setfscreatecon failed: Invalid argument
SELinux context reset: setfscreatecon failed: Invalid argument
...
It looks that the problem might be in the libselinux (procattr.c setprocattrcon_
ret = write(fd, NULL, 0); /* clear */
This always returns 'Invalid argument'.
I was not able to reproduce this with standard system tools (echo, cat, tee, ...).
Therefore I wrote some lines of C (attached):
root@ubuntu:~# strace -f ./w2
...
openat(AT_FDCWD, "/proc/
write(3, NULL, 0) = -1 EINVAL (Invalid argument)
dup(2) = 4
fcntl(4, F_GETFL) = 0x2 (flags O_RDWR)
brk(NULL) = 0x55af7b32a000
brk(0x55af7b34b000) = 0x55af7b34b000
fstat(4, {st_mode=
write(4, "write: Invalid argument\n", 24write: Invalid argument
) = 24
close(4) = 0
rt_sigprocmask(
rt_sigprocmask(
getpid() = 10408
gettid() = 10408
tgkill(10408, 10408, SIGABRT) = 0
rt_sigprocmask(
--- SIGABRT {si_signo=SIGABRT, si_code=SI_TKILL, si_pid=10408, si_uid=0} ---
+++ killed by SIGABRT +++
Aborted
I have no idea if this write(fd, NULL, 0) should work to reset the attribute (then it might be a kernel /proc problem) or if the library needs to use another mechanism to reset the content.