Wow! I just upgraded to f38 from f37, and I’m getting hundreds of selinux-related audit reports.
The vast majority of them are coming from read requests by ‘systemd-resolved’ for the file /etc/resolv.conf, although some of them are from vpn-related command requests to that same file.
I following the advice in the system-update documentation on cleaning up after the dnf system-update reboot and executed sudo fixfiles -B onboot and re-booted. That did not fix things with selinux for me.
Hey Villy, thanks for this suggestion! And, yep, it did work.
I do have the continual problem that upon reboot, this link gets recreated with the original context that I showed earlier. I’m using Mullvad VPN application, which might be the culprit. I’ll work to track that down from here…
Thanks again, everyone, for your kind attention to my little issue!
This is telling me that before the systemd-resolved service is started, NetworkManager has already removed, then relinked /etc/resolv.conf to /run/systemd/resolve/stub-resolv.conf. When it does this relinking the link is given SELinux context system_u:object_r:NetworkManager_etc_rw_t:s0.
I believe that the above is the root of all of my troubles. Can anyone suggest how I might take this further towards a resolution?
It is more a question of what customizations has been done in the past. Or if Mullvad has installed some SELinux rules incompatible with Fedoras SELinux configurations. This will be hard to diagnose remotely; it all depends on the history of the system all the way back to the first installation.
So it seems that the match in the file_contexts regexp is being overridden by the explicit match in file_contexts.local, or that the fact it’s in that latter file is the reason regardless of it being an explicit match. Maybe one of my other VPN applications has created this situation. (Confession: I also had ProtonVPN installed for the first round of dnf system-upgrade...; I removed it prior to the second round with --setopt=keepcache=1.)
If I catfilecontexts.local, I see the following:
# This file is auto-generated by libsemanage
# Do not edit directly.
However I got to this point is a complete mystery.
Okay, on to the next mystery in my little epic…
I’m a little confused by this one. Would this not change the context to what I already have in file_contexts.local? Is there a way to remove this latter entry all together?
That is exactly what is happening, and what I suspected was the case. file_contexts.local is your local modifications of the SELinux rules and will override the Fedora provided rules. You should be able to use the system-config-selinux tool to remove that entry and that should solve your problem.