I had a drive crash on a server running F34.  After replacing the drive and installing F35, I can't get openvpn-client@nbecker8 to start.  journalctl says: Dec 21 11:26:14 nbecker8 openvpn[80875]: Options error: In [CMD-LINE]:1: Error opening configuration file: /etc/openvpn/client/nbecker8.conf The file is there, and I don't see how there might be a permissions issue (I even tried chmod 755 /etc/openvpn/client).  All the files in /etc/openvpn are root.openvpn. I'm stumped how to debug this. If I run opevpn --config /etc/openvpn/client/nbecker8.conf, it works. Any ideas what's wrong or how to debug?

Probably selinux. I have these notes for configuring a commercial VPN provider to work. sudo ausearch -c 'openvpn' --raw | audit2allow -M my-openvpn sudo semodule -X 300 -i my-openvpn.pp

sudo ausearch -c 'openvpn' time->Tue Dec 21 14:10:56 2021 type=AVC msg=audit(1640113856.260:3683): avc: denied { open } for pid=120287 comm="openvpn" path="/etc/openvpn/client/nbecker8.conf" dev="nvme0n1p3" ino=167775 scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:object_r:fusefs_t:s0 tclass=file permissive=0 So this tells me the problem was indeed a denial to open that file. Although I've administered unix/linux systems since 1980's, selinux is a subject I've not had to learn about until now. On Tue, Dec 21, 2021 at 5:16 PM Jonathan Billings <billings(a)negate.org&gt; wrote: > > On Dec 21, 2021, at 14:03, Kevin Becker <kevin(a)kevinbecker.org&gt; wrote: > > > > Probably selinux. I have these notes for configuring a commercial VPN provider to work. > > > > sudo ausearch -c 'openvpn' --raw | audit2allow -M my-openvpn > > sudo semodule -X 300 -i my-openvpn.pp > > Ack! That’s not good advice. That’s basically saying: “whatever broken settings you have currently, let it be allowed” blindly. Is it set so open on can read all files on your file system now? Who knows! Maybe now it’s allowed to sniff your network traffic? You can’t tell! It is the selinux equivalent of just “chmod 777” you see people suggest for file permission problems. > > The appropriate first step is to use “restorecon” to relabel the files in /etc. Most likely that would have fixed it. > > The “audit2why” command might have mentioned a selinux Boolean or missing setting. > > -- > Jonathan Billings > _______________________________________________ > users mailing list -- users(a)lists.fedoraproject.org > To unsubscribe send an email to users-leave(a)lists.fedoraproject.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.org > Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure -- Those who don't understand recursion are doomed to repeat it

On 22/12/2021 20:30, Neal Becker wrote: > So what exactly would be the restorecon command to use here? The first question to answer is, what is the output of ls -Z /etc/openvpn/client/nbecker8.conf -- Did 황준호 die? _______________________________________________ users mailing list -- users(a)lists.fedoraproject.org To unsubscribe send an email to users-leave(a)lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.org Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

On 22/12/2021 21:26, Neal Becker wrote: > sudo ls -lZ /etc/openvpn/client > total 4 > -rw-r--r--. 1 root openvpn system_u:object_r:openvpn_etc_t:s0 3533 Jan > 27 2021 nbecker8.conf > > This looks the same as other objects in /etc/openvpn/, so I'm guessing > it's correctly labeled? > sudo ls -lZ /etc/openvpn/ > total 16 > drwxr-x---. 1 root openvpn system_u:object_r:openvpn_etc_t:s0 26 > Dec 15 14:14 client > drwxr-x---. 1 root openvpn system_u:object_r:openvpn_etc_t:s0 0 > Dec 15 14:14 server Yes, this actually looks OK. You can run restorecon -n -v /etc/openvpn/client/nbecker8.conf        -n     don't change any file labels (passive check).  To dis‐               play the files whose labels would be changed, add -v. It will probably tell you that the selinux context won't be changed. So, the question then becomes why the special module is needed.

time->Tue Dec 21 14:10:56 2021 type=AVC ... avc: denied { open } for pid=120287 comm="openvpn" path="/etc/openvpn/client/nbecker8.conf" dev="nvme0n1p3" ino=167775 scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:object_r:fusefs_t:s0 tclass=file permissive=0

That would require a bit more troubleshooting.  But, it is too late in my day to advise what that would entail.  :-(

On 23/12/2021 13:08, Todd Zullinger wrote: > Ed Greshko wrote: >> On 22/12/2021 21:26, Neal Becker wrote: >>> sudo ls -lZ /etc/openvpn/client >>> total 4 >>> -rw-r--r--. 1 root openvpn system_u:object_r:openvpn_etc_t:s0 3533 Jan >>> 27 2021 nbecker8.conf >>> >>> This looks the same as other objects in /etc/openvpn/, so I'm guessing >>> it's correctly labeled? >>> sudo ls -lZ /etc/openvpn/ >>> total 16 >>> drwxr-x---. 1 root openvpn system_u:object_r:openvpn_etc_t:s0 26 >>> Dec 15 14:14 client >>> drwxr-x---. 1 root openvpn system_u:object_r:openvpn_etc_t:s0 0 >>> Dec 15 14:14 server >> Yes, this actually looks OK. >> >> You can run >> >> restorecon -n -v /etc/openvpn/client/nbecker8.conf >> >> -n don't change any file labels (passive check). To dis‐ >> play the files whose labels would be changed, add -v. >> >> It will probably tell you that the selinux context won't be changed. >> >> So, the question then becomes why the special module is needed. > It seems that the selinux context is correct now, but the > AVC from Neal's earlier message showed the target file > context was fu./sefs_t (lightly re-formatted for clarity): > >> time->Tue Dec 21 14:10:56 2021 type=AVC ... >> avc: denied { open } for pid=120287 comm="openvpn" >> path="/etc/openvpn/client/nbecker8.conf" dev="nvme0n1p3" ino=167775 >> scontext=system_u:system_r:openvpn_t:s0 >> tcontext=system_u:object_r:fusefs_t:s0 tclass=file permissive=0 > At that time, /etc/openvpn/client/nbecker8.conf had the > wrong selinux context (tcontext) which would explain why the > openvpn process (scontext) was not allowed to access it. > >> That would require a bit more troubleshooting. But, it is >> too late in my day to advise what that would entail. :-( > With luck, that infomation is accurate and useful in: > satiating your boundless curiosity, Ed (letting you get on > with your day/night); and making selinux ever-so-slightly > less random-feeling and vexing for you, Neal. Slightly is > all I can manage, as I would never call myself an expert at > it. :) LOL... I believe you are quite correct when you note the content of the AVC has the selinux context for the target to be tcontext=system_u:object_r:fusefs_t:s0 which would be problematic. And, I admit that I really didn't look at the AVC. But, now I'm even more confused by this thread. I raised the question about the output of "ls -Z" on the target file in response to the question "would be the restorecon command to use". So, unless someone responded off-list and Neal ran restorecon against the file how did the context change? -- Did 황준호 die?; _______________________________________________ users mailing list -- users(a)lists.fedoraproject.org To unsubscribe send an email to users-leave(a)lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.org Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

If I create a file elsewhere and move or copy into the location, it's label is not changed (I'd need to use restorecon or another tool to change it):