Release 1.22.1 and selinux #13245

New Issue

GiteaMirror · 2025-11-02T10:36:07-06:00

GiteaMirror commented

2025-11-02 10:36:07 -06:00

Originally created by @sharmay on GitHub (Jul 5, 2024).

Description

After upgrading 1.22.0 to 1.22.1, service is not starting on latest AlmaLinux 9 due to lot of selinux denials.

Some log audit.log entries when running in permissive mode

type=AVC msg=audit(1720182414.705:7927): avc:  denied  { map } for  pid=22362 comm="gitea" path="/home/gitea/gitea-data/data/indexers/issues.bleve/store/root.bolt" dev="vda3" ino=11272267 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
type=AVC msg=audit(1720182414.805:7928): avc:  denied  { read } for  pid=22362 comm="gitea" name="3" dev="vda3" ino=11403412 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:user_home_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1720187426.343:7931): avc:  denied  { lock } for  pid=22362 comm="gitea" path="/home/gitea/gitea-data/data/indexers/issues.bleve/store/root.bolt" dev="vda3" ino=11272267 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1

If I switch back to gitea-1.22.0-linux-amd64, I don't see any denials even when selinux is enforcing.

Gitea Version

gitea-1.22.1-linux-amd64

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

Using systemd example service file

Database

PostgreSQL

Originally created by @sharmay on GitHub (Jul 5, 2024). ### Description After upgrading 1.22.0 to 1.22.1, service is not starting on latest AlmaLinux 9 due to lot of selinux denials. Some log audit.log entries when running in permissive mode ``` type=AVC msg=audit(1720182414.705:7927): avc: denied { map } for pid=22362 comm="gitea" path="/home/gitea/gitea-data/data/indexers/issues.bleve/store/root.bolt" dev="vda3" ino=11272267 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 type=AVC msg=audit(1720182414.805:7928): avc: denied { read } for pid=22362 comm="gitea" name="3" dev="vda3" ino=11403412 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:user_home_t:s0 tclass=dir permissive=1 type=AVC msg=audit(1720187426.343:7931): avc: denied { lock } for pid=22362 comm="gitea" path="/home/gitea/gitea-data/data/indexers/issues.bleve/store/root.bolt" dev="vda3" ino=11272267 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 ``` If I switch back to gitea-1.22.0-linux-amd64, I don't see any denials even when selinux is enforcing. ### Gitea Version gitea-1.22.1-linux-amd64 ### Can you reproduce the bug on the Gitea demo site? Yes ### Log Gist _No response_ ### Screenshots _No response_ ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? Using systemd example service file ### Database PostgreSQL

GiteaMirror added the type/bug label 2025-11-02 10:36:07 -06:00

GiteaMirror closed this issue

2025-11-02 10:36:08 -06:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#13245