Bug 1308770

Summary:	ssh-keygen fails on the kvm image from RH website and hostname doesn't change properly
Product:	Red Hat Enterprise Linux 7	Reporter:	David Hill <dhill>
Component:	selinux-policy	Assignee:	Lukas Vrabec <lvrabec>
Status:	CLOSED NOTABUG	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	low	Docs Contact:
Priority:	medium
Version:	7.2	CC:	dhill, lvrabec, mgrepl, mmalik, plautrba, pvrabec, ssekidde
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-10-23 13:57:51 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description David Hill 2016-02-16 00:28:23 UTC

Description of problem:

[root@undercloud-rhosp8 audit]# cat audit.log | grep denied
type=AVC msg=audit(1455581062.544:32): avc:  denied  { getattr } for  pid=698 comm="mountpoint" path="/sys/fs/cgroup/systemd" dev="cgroup" ino=7083 scontext=system_u:system_r:sshd_keygen_t:s0 tcontext=system_u:object_r:cgroup_t:s0 tclass=dir
type=USER_AVC msg=audit(1455581819.619:325): pid=522 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.28 spid=20379 tpid=20378 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
type=AVC msg=audit(1455581826.978:457): avc:  denied  { create } for  pid=21057 comm="systemd-journal" name="4093bf66a4a4444886ac88feb9f56896" scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:initrc_var_log_t:s0 tclass=dir
[root@undercloud-rhosp8 audit]# cat audit.log | grep denied | audit2allow -R

require {
	type sshd_keygen_t;
	type syslogd_t;
	type initrc_var_log_t;
	type systemd_hostnamed_t;
	class dir create;
}

#============= sshd_keygen_t ==============
fs_relabel_cgroup_dirs(sshd_keygen_t)

#============= syslogd_t ==============
allow syslogd_t initrc_var_log_t:dir create;

#============= systemd_hostnamed_t ==============
init_dbus_send_script(systemd_hostnamed_t)


Version-Release number of selected component (if applicable):


How reproducible:
Everytime

Steps to Reproduce:
1. Get KVM image
2. Boot KVM image
3. Inject S01customize.local in it

Actual results:
SElinux blocks it

Expected results:
Shouldn't it be unconfined at this point?

Additional info:

Comment 5 David Hill 2017-09-04 12:09:29 UTC

I'm deploying in permissive in order to catch these kind of errors but I'm now using the RHEL 7.4 images and I don't think I've seen these errors.  I'll update if I see it again.

Comment 6 Lukas Vrabec 2017-10-23 13:57:51 UTC

Thanks David for information. I'll close this BZ as NOTABUG, if you don't seen these errors. Feel free to re-open it, if you catch it again. 

Thanks,
Lukas.