[SELinux] safe-reload: line 28: /tmp/tmp.CsZIRQ2u1R: Permission denied

[Al2Klimov]

Describe the bug

I can't reload Icinga 2 with SELinux enabled.

To Reproduce

1. systemctl reload icinga2.service
2. systemctl status icinga2.service

Expected behavior

• Drop safe-reload and use ExecReload=kill -HUP $MAINPID like everyone else (especially as we have sd_notify() systemd about what we're doing right now #7874).

Your Environment

Include as many relevant details about the environment you experienced the problem in

• Version used (icinga2 --version): icinga2-2.14.5+568.g9cc397128-1744726796.fc42.x86_64
• Operating System and version: Fedora 42

Additional context

• Build Fedora 42 packages icinga-packaging#318

[yhabteab]

I couldn't reproduce this! Do you have any special permissions set for the /tmp directory and did you even install the icinga2-selinux package? Actually, the safe-reload script changes the context of the just created tmp file, so I don't know how you triggered the Permission denied error:

[root@fd41 ~]# cat /etc/os-release
NAME="Fedora Linux"
VERSION="42 (Cloud Edition)"
RELEASE_TYPE=stable
ID=fedora
VERSION_ID=42
...
[root@fd41 ~]# ls -lZ /tmp/
-rw-------. 1 root root system_u:object_r:icinga2_tmp_t:s0 2113 Apr 16 11:21 tmp.aChR75XhBn

[Al2Klimov]

did you even install the icinga2-selinux package?

Admittedly not. But it doesn't help either!

Apr 16 12:09:48 akf42.novalocal systemd[1]: Reloading icinga2.service - Icinga host/service/network monitoring system...
░░ Subject: A reload job for unit icinga2.service has begun execution
░░ Defined-By: systemd
░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
░░
░░ A reload job for unit icinga2.service has begun execution.
░░
░░ The job identifier is 11530.
Apr 16 12:09:48 akf42.novalocal safe-reload[28167]: Validating config files: Done
Apr 16 12:09:48 akf42.novalocal safe-reload[28167]: Reloading Icinga 2:
Apr 16 12:09:48 akf42.novalocal systemd[1]: icinga2.service: Control process exited, code=exited, status=7/NOTRUNNING
░░ Subject: Unit process exited
░░ Defined-By: systemd
░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
░░
░░ An ExecReload= process belonging to unit icinga2.service has exited.
░░
░░ The process' exit code is 'exited' and its exit status is 7.
Apr 16 12:09:48 akf42.novalocal systemd[1]: Reload failed for icinga2.service - Icinga host/service/network monitoring system.
░░ Subject: A reload job for unit icinga2.service has finished
░░ Defined-By: systemd
░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
░░
░░ A reload job for unit icinga2.service has finished.
░░
░░ The job identifier is 11530 and the job result is failed.

However, it seems the v41 snapshots are also affected.

[Al2Klimov]

v40 is not affected! 🎉

[Al2Klimov]

😅

v40

system_u:system_r:icinga2_t:s0  icinga      2579       1  0 12:36 ?        00:00:00   /usr/lib64/icinga2/sbin/icinga2 --no-stack-rlimit daemon --close-stdio -e
system_u:system_r:icinga2_t:s0  icinga      2756    2579  0 12:36 ?        00:00:00     /usr/lib64/icinga2/sbin/icinga2 --no-stack-rlimit daemon --close-stdio -
system_u:system_r:icinga2_t:s0  icinga      2762    2756  0 12:36 ?        00:00:00       /usr/lib64/icinga2/sbin/icinga2 --no-stack-rlimit daemon --close-stdio

v41

system_u:system_r:unconfined_service_t:s0 icinga 3125  1  0 12:24 ?        00:00:00   /usr/lib64/icinga2/sbin/icinga2 --no-stack-rlimit daemon --close-stdio -e
system_u:system_r:unconfined_service_t:s0 icinga 3147 3125  0 12:24 ?      00:00:00     /usr/lib64/icinga2/sbin/icinga2 --no-stack-rlimit daemon --close-stdio -
system_u:system_r:unconfined_service_t:s0 icinga 3152 3147  0 12:24 ?      00:00:00       /usr/lib64/icinga2/sbin/icinga2 --no-stack-rlimit daemon --close-stdio

[Al2Klimov]

[root@akf41 ~]# aureport -a

AVC Report
===============================================================
# date time comm subj syscall class permission obj result event
===============================================================
1. 04/16/2025 12:24:14 safe-reload system_u:system_r:icinga2_t:s0 0 file getattr system_u:object_r:var_run_t:s0 denied 245
2. 04/16/2025 12:53:46 safe-reload system_u:system_r:icinga2_t:s0 0 file getattr system_u:object_r:var_run_t:s0 denied 248
3. 04/16/2025 12:56:03 safe-reload system_u:system_r:icinga2_t:s0 0 file getattr system_u:object_r:var_run_t:s0 denied 251
4. 04/16/2025 12:56:03 cat system_u:system_r:icinga2_t:s0 0 file read system_u:object_r:var_run_t:s0 denied 252
5. 04/16/2025 12:56:03 cat system_u:system_r:icinga2_t:s0 0 file open system_u:object_r:var_run_t:s0 denied 253
6. 04/16/2025 12:56:03 safe-reload system_u:system_r:icinga2_t:s0 0 process signal system_u:system_r:unconfined_service_t:s0 denied 254
7. 04/16/2025 12:56:07 safe-reload system_u:system_r:icinga2_t:s0 0 file getattr system_u:object_r:var_run_t:s0 denied 257
8. 04/16/2025 12:56:20 safe-reload system_u:system_r:icinga2_t:s0 0 file getattr system_u:object_r:var_run_t:s0 denied 260
[root@akf41 ~]#