Package Details: setroubleshoot-server 3.3.23-1

Git Clone URL: https://aur.archlinux.org/setroubleshoot.git (read-only, click to copy)
Package Base: setroubleshoot
Description: SELinux troubleshoot server
Upstream URL: https://pagure.io/setroubleshoot
Licenses: GPL2
Groups: selinux
Submitter: IooNag
Maintainer: IooNag
Last Packager: IooNag
Votes: 1
Popularity: 0.000000
First Submitted: 2019-04-28 16:48 (UTC)
Last Updated: 2021-07-03 14:44 (UTC)

Latest Comments

IooNag commented on 2023-11-18 11:07 (UTC)

This package is maintained on https://github.com/archlinuxhardened/selinux/tree/master/setroubleshoot . If you want to help maintaining it, please submit a Pull Request there before requesting an orphan request.

zhs commented on 2020-09-25 15:59 (UTC)

There are two issues with this package. I have found a way to solve one but am still scratching my head over the other.

  1. In the PKGBUILD you should add --localstatedir=/var/lib to the invocation of configure script in build(). Without this change setroubleshoot attempts to find its state files under /usr/var/lib i.e., ${prefix}/var/lib, instead of the intended /var/lib, where the package_() functions create the directories for it.

  2. As the other user has already commented setroubleshoot invokes get_installed_policy() from selinux-python utility library. The daemon is run via dbus as the user 'setroubleshoot' who does not have read access to the directory /etc/selinux/${policy_name}/policy (this directory is owned by root and chmod 700). This results in the call to get_installed_policy() to fail enumerating installed policies and to raise the exception. Changing the permissions on this directory fixes the error but is likely an incorrect solution.

2a. Up to setroubleshoot 3.1.x the dbus unit would run setroubleshoot as root but some time around 5 years ago it changed this in this commit

https://pagure.io/setroubleshoot/c/98591bf7421f17c2d7d1b4bda8eb4cab63d1bda4?branch=master

and now runs it as 'setroubleshoot.' I have no idea how the filesystem and user/group permissions on Fedora are that allow this user access to the compiled policy store under, for example, /etc/selinux/refpolicy-arch/policy (or /etc/selinux/targeted/policy as it would be on Fedora).

2b. I noticed multiple instances of this setroubleshoot error reported to CentOS and Fedora bug trackers. These have been repeatedly allowed to lapse to EOL, left unanswered, or marked as duplicates of similarly unanswered bug reports.

P.S. Overall, the userland tools around SELinux all seem dilapidated and barely given any attention.

huskiesrock1884 commented on 2019-05-05 19:23 (UTC)

SETroubleshootd seems to think that there is no SELinux policy installed on my system, while sepolicy shows up in both /usr/lib/python{2,3}.7/site-packages and my SELinux policy is in fact refpolicy-arch. I've set SELinux to permissive for the duration of this issue, from which it is normally enforcing.

Here are my journalctl entries indicating the problem: https://pasteboard.co/IdkFC3v.jpg