| Summary: | psad fails to start due to SELinux denials | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Dominik 'Rathann' Mierzejewski <dominik> | ||||||
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> | ||||||
| Status: | CLOSED WONTFIX | QA Contact: | Milos Malik <mmalik> | ||||||
| Severity: | medium | Docs Contact: | |||||||
| Priority: | medium | ||||||||
| Version: | 7.2 | CC: | frank, lvrabec, mgrepl, mmalik, plautrba, pvrabec, ssekidde | ||||||
| Target Milestone: | rc | ||||||||
| Target Release: | --- | ||||||||
| Hardware: | All | ||||||||
| OS: | Linux | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2017-10-12 12:19:32 UTC | Type: | Bug | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Bug Depends On: | |||||||||
| Bug Blocks: | 1281755 | ||||||||
| Attachments: |
|
||||||||
|
Description
Dominik 'Rathann' Mierzejewski
2016-10-27 07:20:27 UTC
Seen in permissive mode:
# ausearch -m avc -m user_avc -i -ts 04:29 | audit2allow
allow psad_t NetworkManager_t:dir { getattr search };
allow psad_t NetworkManager_t:file { open read };
allow psad_t auditd_t:dir { getattr search };
allow psad_t auditd_t:file { open read };
allow psad_t avahi_t:dir { getattr search };
allow psad_t avahi_t:file { open read };
allow psad_t crond_t:dir { getattr search };
allow psad_t crond_t:file { open read };
allow psad_t dhcpc_t:dir { getattr search };
allow psad_t dhcpc_t:file { open read };
allow psad_t getty_t:dir { getattr search };
allow psad_t getty_t:file { open read };
allow psad_t getty_t:lnk_file read;
allow psad_t gssproxy_t:dir { getattr search };
allow psad_t gssproxy_t:file { open read };
allow psad_t init_t:file { getattr open read };
allow psad_t journalctl_exec_t:file { execute execute_no_trans open read };
allow psad_t kernel_t:dir { getattr search };
allow psad_t kernel_t:file { open read };
allow psad_t lvm_t:dir { getattr search };
allow psad_t lvm_t:file { open read };
allow psad_t modemmanager_t:dir { getattr search };
allow psad_t modemmanager_t:file { open read };
allow psad_t nfsd_t:dir { getattr search };
allow psad_t nfsd_t:file { open read };
allow psad_t policykit_t:dir { getattr search };
allow psad_t policykit_t:file { open read };
allow psad_t psad_var_log_t:file { read rename unlink write };
allow psad_t rhnsd_t:dir { getattr search };
allow psad_t rhnsd_t:file { open read };
allow psad_t rhsmcertd_t:dir { getattr search };
allow psad_t rhsmcertd_t:file { open read };
allow psad_t rpcbind_t:dir { getattr search };
allow psad_t rpcbind_t:file { open read };
allow psad_t rpcd_t:dir { getattr search };
allow psad_t rpcd_t:file { open read };
allow psad_t self:capability sys_resource;
allow psad_t self:process setrlimit;
allow psad_t sendmail_t:dir { getattr search };
allow psad_t sendmail_t:file { open read };
allow psad_t sshd_t:dir { getattr search };
allow psad_t sshd_t:file { open read };
allow psad_t syslogd_t:dir { getattr search };
allow psad_t syslogd_t:file { open read };
allow psad_t syslogd_var_run_t:dir read;
allow psad_t syslogd_var_run_t:file { getattr open read };
allow psad_t system_cronjob_t:dir { getattr search };
allow psad_t system_cronjob_t:file { open read };
allow psad_t system_dbusd_t:dbus send_msg;
allow psad_t system_dbusd_t:dir { getattr search };
allow psad_t system_dbusd_t:file { open read };
allow psad_t system_dbusd_t:unix_stream_socket connectto;
allow psad_t system_mail_t:dir { getattr search };
allow psad_t system_mail_t:file { open read };
allow psad_t systemd_logind_t:dir { getattr search };
allow psad_t systemd_logind_t:file { open read };
allow psad_t tuned_t:dir { getattr search };
allow psad_t tuned_t:file { open read };
allow psad_t udev_t:dir { getattr search };
allow psad_t udev_t:file { open read };
allow psad_t unconfined_t:dir { getattr search };
allow psad_t unconfined_t:file { open read };
allow psad_t unconfined_t:lnk_file read;
Raw SELinux denials will be attached soon.
Created attachment 1214523 [details]
SELinux denials caught in enforcing mode
Created attachment 1214524 [details]
SELinux denials caught in permissive mode
Note, that while this has been reported against RHEL7.2, I've seen similar issues with Fedora 24, Also, the actual SELinux denials seem to come from searches of /proc, and so will depend on what processes are actually running. Fedora issue is fixed already. I believe the /proc denials are the result of psad trying to find out which process is listening on which port and do not actually prevent it from running. I wasn't sure if the issue was fixed in Fedora yet, as I run in permissive mode, however the denials in /proc are a major issue, as they cause setroubleshoot to run almost continuously, pretty much using an entire CPU. (In reply to Frank Crawford from comment #7) > I wasn't sure if the issue was fixed in Fedora yet, I meant that only the non-proc denials are fixed in Fedora. They're temporarily fixed in the psad package, selinux update is still pending. > as I run in permissive > mode, however the denials in /proc are a major issue, as they cause > setroubleshoot to run almost continuously, pretty much using an entire CPU. Ah. I don't run setroubleshoot, so I'm not seeing this. In your case it looks like a real issue, then. We're going to close this bug as WONTFIX because * of limited capacity of selinux-policy developers * the bug is related to EPEL component or 3rd party SW only * the bug appears in unsupported configuration We believe this bug can be fixed via a local policy module. For more information please see: * https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/sect-security-enhanced_linux-troubleshooting-fixing_problems#sect-Security-Enhanced_Linux-Fixing_Problems-Allowing_Access_audit2allow If you disagree, please re-open the bug. We're going to close this bug as WONTFIX because * of limited capacity of selinux-policy developers * the bug is related to EPEL component or 3rd party SW only * the bug appears in unsupported configuration We believe this bug can be fixed via a local policy module. For more information please see: * https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/sect-security-enhanced_linux-troubleshooting-fixing_problems#sect-Security-Enhanced_Linux-Fixing_Problems-Allowing_Access_audit2allow If you disagree, please re-open the bug. |