Joined: 22 May 2007
|Posted: Sun Jul 02, 2017 9:59 am Post subject: [SOLVED] SELinux cron unauthorized
For a while I'm trying to fix my cron jobs with SELinux.
I can't seem to figure out where to change the context label and how should they be in order to run cron jobs from crontab, not even sure that this is the real problem though.
Each time when I restart my cron daemon (cronie, but have tried vixie-cron, fcron, dcron and maybe others too), I get this error message in /var/log/cron.log:
|Jul 2 12:30:18 serveris crond: (CRON) INFO (RANDOM_DELAY will be scaled with factor 20% if used.)
Jul 2 12:30:18 serveris crond: ((null)) Unauthorized SELinux context=system_u:system_r:system_cronjob_t file_context=system_u:object_r:user_cron_spool_t (/etc/crontab)
Jul 2 12:30:18 serveris crond: (root) FAILED (loading cron table)
Jul 2 12:30:18 serveris crond: (CRON) INFO (running with inotify support)
From the Gentoo SELinux Cron guide ( https://wiki.gentoo.org/wiki/SELinux/cron ) as much as I understood then the crontab should have the same context.
|ls -laZ /etc | grep crontab
-rw-r--r--. 1 root root system_u:object_r:user_cron_spool_t 485 Jul 1 21:58 crontab
The /etc/crontab had a different context label, it was for user root, I did change it (but did not help):
|chcon -u root /etc/crontab |
I also have these booleans enabled:
|getsebool -a | grep cron
cron_can_relabel --> on
cron_userdomain_transition --> on
fcron_crond --> on
Have changed these booleans, but also did not help (did try to enable allow_execmod too, but no luck).
The audit.log (/var/log/audit/audit.log) also does not have anything usefull: https://pastebin.com/EhBpFNka
By using the Gentoo SELinux installation guide ( https://wiki.gentoo.org/wiki/SELinux/Installation ) I was not able to add the SELinux root user:
|semanage user -m -R "staff_r sysadm_r system_r" root
ValueError: SELinux user root is not defined
Do I need it...? Though:
|semanage user -l
SELinux User SELinux Roles
root staff_r sysadm_r system_r
staff_u staff_r sysadm_r system_r
Could someone please help me find the problem?
I did manage to get cron working, but I still get the same error message.
Finnaly got cron to execute, context label issue:
|-rw-r--r--. 1 root root root:object_r:system_cron_spool_t 608 Jul 12 21:19 /etc/crontab |