It would make sense if rpm-ostreed ran as non init_t and if that type have MAC_ADMIN. Not much we that can be done to fix it now, but we could fix policy for 24->25...
-Eric On Wed, 2016-06-22 at 10:56 -0400, Micah Abbott wrote: > On 06/22/2016 09:34 AM, Muayyad AlSadi wrote: > > now, it gave me > > > > error: fsetxattr: Invalid argument > > > > I'll try "setenforce 0" and and see > > I saw the same. > > The following journal entries look relevant: > > Jun 22 14:54:04 rhel-atomic-7.2-test audit[1286]: AVC > avc: denied { > mac_admin } for pid=1286 comm="pool" capability=33 > scontext=system_u:system_r:init_t:s0 > tcontext=system_u:system_r:init_t:s0 tclass=capability2 permissive=0 > Jun 22 14:54:04 rhel-atomic-7.2-test audit: SELINUX_ERR op=setxattr > invalid_context="system_u:object_r:systemd_rfkill_unit_file_t:s0" > Jun 22 14:54:04 rhel-atomic-7.2-test audit[1286]: SYSCALL > arch=c000003e > syscall=190 success=no exit=-22 a0=2b a1=7fd16c0091f1 > a2=7fd16c009202 > a3=30 items=0 ppid=1 pid=1286 auid=4294967295 uid=0 gid=0 euid=0 > suid=0 > fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="pool" > exe="/usr/libexec/rpm-ostreed" subj=system_u:system_r:init_t:s0 > key=(null) > Jun 22 14:54:04 rhel-atomic-7.2-test audit: PROCTITLE > proctitle="/usr/libexec/rpm-ostreed" > Jun 22 14:54:04 rhel-atomic-7.2-test audit[1288]: AVC > avc: denied { > mac_admin } for pid=1288 comm="pool" capability=33 > scontext=system_u:system_r:init_t:s0 > tcontext=system_u:system_r:init_t:s0 tclass=capability2 permissive=0 > Jun 22 14:54:04 rhel-atomic-7.2-test audit: SELINUX_ERR op=setxattr > invalid_context="system_u:object_r:systemd_resolved_unit_file_t:s0" > Jun 22 14:54:04 rhel-atomic-7.2-test audit[1288]: SYSCALL > arch=c000003e > syscall=190 success=no exit=-22 a0=2d a1=7fd188009fa1 > a2=7fd188009fb2 > a3=32 items=0 ppid=1 pid=1288 auid=4294967295 uid=0 gid=0 euid=0 > suid=0 > fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="pool" > exe="/usr/libexec/rpm-ostreed" subj=system_u:system_r:init_t:s0 > key=(null) > Jun 22 14:54:04 rhel-atomic-7.2-test audit: PROCTITLE > proctitle="/usr/libexec/rpm-ostreed" >