My server is CentOS 7.4. I installed setroubleshoot-server (Version is 3.2.28.) via yum, so that cockpit can collect SELinux alerts. Then I find some error logs in /var/log/message:
Feb 1 23:29:32 0x01 dbus[524]: [system] Rejected send message, 1 matched rules; type="method_call", sender=":1.338" (uid=1000 pid=13163 comm="cockpit-bridge ") interface="org.freedesktop.DBus.Properties" member="GetAll" error name="(unset)" requested_reply="0" destination="org.fedoraproject.SetroubleshootFixit" (uid=0 pid=13598 comm="/usr/bin/python /usr/share/setroubleshoot/Setroubl")
Feb 1 23:29:32 0x01 dbus-daemon: dbus[524]: [system] Rejected send message, 1 matched rules; type="method_call", sender=":1.338" (uid=1000 pid=13163 comm="cockpit-bridge ") interface="org.freedesktop.DBus.Properties" member="GetAll" error name="(unset)" requested_reply="0" destination="org.fedoraproject.SetroubleshootFixit" (uid=0 pid=13598 comm="/usr/bin/python /usr/share/setroubleshoot/Setroubl")
Feb 1 23:29:32 0x01 dbus[524]: [system] Rejected send message, 1 matched rules; type="method_call", sender=":1.338" (uid=1000 pid=13163 comm="cockpit-bridge ") interface="org.freedesktop.DBus.Properties" member="GetAll" error name="(unset)" requested_reply="0" destination="org.fedoraproject.SetroubleshootFixit" (uid=0 pid=13598 comm="/usr/bin/python /usr/share/setroubleshoot/Setroubl")
Feb 1 23:29:32 0x01 dbus-daemon: dbus[524]: [system] Rejected send message, 1 matched rules; type="method_call", sender=":1.338" (uid=1000 pid=13163 comm="cockpit-bridge ") interface="org.freedesktop.DBus.Properties" member="GetAll" error name="(unset)" requested_reply="0" destination="org.fedoraproject.SetroubleshootFixit" (uid=0 pid=13598 comm="/usr/bin/python /usr/share/setroubleshoot/Setroubl")
Also, I try to run setroubleshootd with root, the shell shows the following message:
org.freedesktop.DBus.Error.AccessDenied: Connection ":1.454" is not allowed to own the service "org.fedoraproject.Setroubleshootd" due to security policies in the configuration file
I inserted <allow own="org.fedoraproject.Setroubleshootd"/> into /etc/dbus-1/system.d/org.fedoraproject.Setroubleshootd.conf:
......
<policy user="root">
<allow own="org.fedoraproject.Setroubleshootd"/>
<allow send_destination="org.fedoraproject.Setroubleshootd"/>
</policy>
......
After server reboot, I try to run setroubleshoot again, there's no error message displayed.
However, I'm not good at DBus and Setroubleshoot, so I'm nor sure the line I inserted will solve the problem or make another big security chaos.
My server is CentOS 7.4. I installed setroubleshoot-server (Version is 3.2.28.) via yum, so that cockpit can collect SELinux alerts. Then I find some error logs in
/var/log/message:Also, I try to run setroubleshootd with root, the shell shows the following message:
I inserted
<allow own="org.fedoraproject.Setroubleshootd"/>into/etc/dbus-1/system.d/org.fedoraproject.Setroubleshootd.conf:After server reboot, I try to run setroubleshoot again, there's no error message displayed.
However, I'm not good at DBus and Setroubleshoot, so I'm nor sure the line I inserted will solve the problem or make another big security chaos.