Bug 1243403

Summary: avc: denied { read } for pid=22817 comm="iptables" name="xtables.lock" dev="tmpfs"
Product: Red Hat Enterprise Linux 7 Reporter: Kaushik Banerjee <kbanerje>
Component: selinux-policyAssignee: Lukas Vrabec <lvrabec>
Status: CLOSED ERRATA QA Contact: Milos Malik <mmalik>
Severity: unspecified Docs Contact:
Priority: high    
Version: 7.2CC: lvrabec, mgrepl, mmalik, mnovacek, plautrba, pvrabec, ssekidde, todoleza
Target Milestone: rcKeywords: Regression
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: selinux-policy-3.13.1-48.el7 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-11-19 10:40:26 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Kaushik Banerjee 2015-07-15 11:30:19 UTC 
Description of problem:
The beaker jobs (e.g. https://beaker.engineering.redhat.com/jobs/1014569) run on RHEL7.2 throws AVCs related to:

type=AVC msg=audit(1436945964.227:416): avc:  denied  { read } for  pid=22817 comm="iptables" name="xtables.lock" dev="tmpfs" ino=65562 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=file

AND

type=AVC msg=audit(1436945964.326:430): avc:  denied  { read } for  pid=22841 comm="ip6tables" name="xtables.lock" dev="tmpfs" ino=65562 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=file

Version-Release number of selected component (if applicable):
selinux-policy-3.13.1-30.el7.noarch

How reproducible:
Always
Comment 2 Lukas Vrabec 2015-07-15 11:53:50 UTC 
Hi,
Where is "xtables.lock" stored?
Comment 3 Milos Malik 2015-07-15 12:21:17 UTC 
# strings `which iptables` | grep lock
  --wait	-w [seconds]	wait for the xtables lock
Another app is currently holding the xtables lock. 
  --wait	-w [seconds]	wait for the xtables lock
/run/xtables.lock
Another app is currently holding the xtables lock; waiting (%ds) for it to exit...
flock
#
Comment 4 Miroslav Grepl 2015-08-04 15:38:43 UTC 
Ok and do we know how it is created?
Comment 5 Milos Malik 2015-08-04 18:56:25 UTC 
Either "service iptables restart" or "service network restart".
Comment 7 Miroslav Grepl 2015-08-07 09:59:27 UTC 
*** Bug 1247180 has been marked as a duplicate of this bug. ***
Comment 10 Lukas Vrabec 2015-08-11 12:44:57 UTC 
commit 6154c0648aecf0e8314a0bc94c5fe662c1ec67dc
Author: Lukas Vrabec <lvrabec>
Date:   Tue Aug 11 10:10:41 2015 +0200

    Label /var/run/xtables.* as iptables_var_run_t
    Resolves: #1243403

[root@dell-pem805-01 run]# sudo systemctl restart firewalld 
[root@dell-pem805-01 run]# sudo systemctl status firewalld 
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
   Active: active (running) since Tue 2015-08-11 08:43:46 EDT; 7s ago
 Main PID: 29825 (firewalld)
   CGroup: /system.slice/firewalld.service
           └─29825 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid

Aug 11 08:43:46 dell-pem805-01.rhts.eng.bos.redhat.com systemd[1]: Starting firewalld - dynamic firewall daemon...
Aug 11 08:43:46 dell-pem805-01.rhts.eng.bos.redhat.com systemd[1]: Started firewalld - dynamic firewall daemon.

[root@dell-pem805-01 run]# ls -Z /var/run/xtables.lock 
-rw-------. root root system_u:object_r:iptables_var_run_t:s0 /var/run/xtables.lock
Comment 20 Miroslav Grepl 2015-09-10 15:17:33 UTC 
*** Bug 1260682 has been marked as a duplicate of this bug. ***
Comment 23 errata-xmlrpc 2015-11-19 10:40:26 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2300.html