Bug 1367834
| Summary: | New cloud-init version requires dhclient to call cloud-init | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Brent Baude <bbaude> | ||||
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | high | ||||||
| Version: | 7.3 | CC: | bbaude, dapospis, lars, lvrabec, mgrepl, mmalik, plautrba, pvrabec, ssekidde | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | x86_64 | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | selinux-policy-3.13.1-95.el7 | Doc Type: | If docs needed, set a value | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2016-11-04 02:37:07 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
Could you attach raw AVC msgs? Thank you. Please, re-run your scenario after installing the latest selinux-policy* packages (3.13.1-96.el7). Let us know, if the scenario generates any SELinux denials. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-2283.html The needinfo request[s] on this closed bug have been removed as they have been unresolved for 1000 days |
Created attachment 1191662 [details] TE policy file. Description of problem: A new version of cloud-init that supports the effort to provision RHEL Atomic on Microsoft Azure requires some a new policy that allows dhclient/dhclient hooks to call cloud-init. A sample of the log: type=AVC msg=audit(1471446337.842:847): avc: denied { getattr } for pid=5514 comm="dhclient-script" path="/usr/bin/cloud-init" dev="sda2" ino=34851037 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=system_u:object_r:cloud_init_exec_t:s0 tclass=file type=SYSCALL msg=audit(1471446337.842:847): arch=c000003e syscall=4 success=no exit=-13 a0=1320e70 a1=7ffdea8a8ec0 a2=7ffdea8a8ec0 a3=4 items=0 ppid=5472 pid=5514 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=2 comm="dhclient-script" exe="/usr/bin/bash" subj=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1471446337.842:848): avc: denied { getattr } for pid=5514 comm="dhclient-script" path="/usr/bin/cloud-init" dev="sda2" ino=34851037 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=system_u:object_r:cloud_init_exec_t:s0 tclass=file type=SYSCALL msg=audit(1471446337.842:848): arch=c000003e syscall=4 success=no exit=-13 a0=1320e70 a1=7ffdea8a8ec0 a2=7ffdea8a8ec0 a3=4 items=0 ppid=5472 pid=5514 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=2 comm="dhclient-script" exe="/usr/bin/bash" subj=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 key=(null) type=NETFILTER_CFG msg=audit(1471446338.312:849): table=filter family=2 entries=79 [root@baude-rhel-ci3 dhclient.d]# audit2allow -a #============= dhcpc_t ============== allow dhcpc_t cloud_init_exec_t:file { execute getattr read open ioctl execute_no_trans }; allow dhcpc_t cloud_var_lib_t:file { read getattr open }; allow dhcpc_t cloud_var_lib_t:lnk_file read; allow dhcpc_t ldconfig_exec_t:file { read execute open execute_no_trans }; allow dhcpc_t var_run_t:file unlink; I will attach the policy.