Bug 1364513
| Summary: | selinux denial when bringing interface up or down with dhcp | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Jason Montleon <jmontleo> |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.2 | CC: | jmontleo, joden, lvrabec, mgrepl, mmalik, plautrba, pvrabec, ssekidde, yuma |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-10-30 09:59:15 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
I have one, if you can get to it this morning. My irc handles is oden. James offered to provide a host, removing the needinfo tag. Note it may be necessary to remove the fusor-selinux package if it is installed to see this error at this point. The problem could be system_u versus unconfined_u: scontext=system_u:system_r:policykit_t:s0 tcontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tclass=dbus What's your opinion Lukas? Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:3111 |
Description of problem: We are seeing the errors below when bringing interfaces up and down on RHEL 7.2 with dhcp enabled. The error does not appear when dhcp is not used, Adding the following fixes this: require { type dhcpc_t; type policykit_t; class dbus send_msg; } allow dhcpc_t policykit_t:dbus send_msg; allow policykit_t dhcpc_t:dbus send_msg; [root@sat62fusor ~]# ifdown em3 ** (pkttyagent:38203): WARNING **: Unable to register authentication agent: GDBus.Error:org.freedesktop.DBus.Error.AccessDenied: An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_call", sender=":1.902" (uid=0 pid=38203 comm="/usr/bin/pkttyagent --notify-fd 5 --fallback ") interface="org.freedesktop.PolicyKit1.Authority" member="RegisterAuthenticationAgentWithOptions" error name="(unset)" requested_reply="0" destination=":1.4" (uid=997 pid=1155 comm="/usr/lib/polkit-1/polkitd --no-debug ") Error registering authentication agent: GDBus.Error:org.freedesktop.DBus.Error.AccessDenied: An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_call", sender=":1.902" (uid=0 pid=38203 comm="/usr/bin/pkttyagent --notify-fd 5 --fallback ") interface="org.freedesktop.PolicyKit1.Authority" member="RegisterAuthenticationAgentWithOptions" error name="(unset)" requested_reply="0" destination=":1.4" (uid=997 pid=1155 comm="/usr/lib/polkit-1/polkitd --no-debug ") (g-dbus-error-quark, 9) [root@sat62fusor ~]# ifup em3 Determining IP information for em3... ** (pkttyagent:38365): WARNING **: Unable to register authentication agent: GDBus.Error:org.freedesktop.DBus.Error.AccessDenied: An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_call", sender=":1.909" (uid=0 pid=38365 comm="/usr/bin/pkttyagent --notify-fd 5 --fallback ") interface="org.freedesktop.PolicyKit1.Authority" member="RegisterAuthenticationAgentWithOptions" error name="(unset)" requested_reply="0" destination=":1.4" (uid=997 pid=1155 comm="/usr/lib/polkit-1/polkitd --no-debug ") Error registering authentication agent: GDBus.Error:org.freedesktop.DBus.Error.AccessDenied: An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_call", sender=":1.909" (uid=0 pid=38365 comm="/usr/bin/pkttyagent --notify-fd 5 --fallback ") interface="org.freedesktop.PolicyKit1.Authority" member="RegisterAuthenticationAgentWithOptions" error name="(unset)" requested_reply="0" destination=":1.4" (uid=997 pid=1155 comm="/usr/lib/polkit-1/polkitd --no-debug ") (g-dbus-error-quark, 9) done. [root@sat62fusor ~]# Version-Release number of selected component (if applicable): [root@sat62fusor ~]# cat /etc/redhat-release Red Hat Enterprise Linux Server release 7.2 (Maipo) [root@sat62fusor ~]# rpm -q selinux-policy-targeted dhclient selinux-policy-targeted-3.13.1-60.el7_2.7.noarch dhclient-4.2.5-42.el7.x86_64 How reproducible: Seems always if dhcp is used Steps to Reproduce: 1. Install RHEL 7.2 2. configure an interface to use dhcp 3. manually bring interface up or down Actual results: ugly message printed to the console. avc's logged in the audit.log Expected results: Interface comes up without errors Additional info: AVC's: type=USER_AVC msg=audit(1470405534.657:2639): pid=1109 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.DBus.Properties member=GetAll dest=:1.4 spid=35859 tpid=1155 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=system_u:system_r:policykit_t:s0 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' type=USER_AVC msg=audit(1470405534.658:2640): pid=1109 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.PolicyKit1.Authority member=RegisterAuthenticationAgentWithOptions dest=:1.4 spid=35859 tpid=1155 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=system_u:system_r:policykit_t:s0 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' type=USER_AVC msg=audit(1470405703.620:2665): pid=1109 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.831 spid=1155 tpid=36249 scontext=system_u:system_r:policykit_t:s0 tcontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' type=USER_AVC msg=audit(1470405728.648:2666): pid=1109 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=signal interface=org.freedesktop.PolicyKit1.Authority member=Changed dest=org.freedesktop.DBus spid=1155 tpid=36249 scontext=system_u:system_r:policykit_t:s0 tcontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' type=USER_AVC msg=audit(1470405728.648:2667): pid=1109 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.831 spid=1155 tpid=36249 scontext=system_u:system_r:policykit_t:s0 tcontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' type=USER_AVC msg=audit(1470405753.692:2668): pid=1109 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.832 spid=1155 tpid=36295 scontext=system_u:system_r:policykit_t:s0 tcontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'