Bug 1405870

Summary: Denials for rhsmcertd on Xen Dom0
Product: Red Hat Enterprise Linux 7 Reporter: Steven Haigh <netwiz>
Component: selinux-policyAssignee: Lukas Vrabec <lvrabec>
Status: CLOSED ERRATA QA Contact: Milos Malik <mmalik>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 7.3CC: cheshi, linl, lvrabec, mgrepl, mmalik, plautrba, pvrabec, ssekidde, xiliang
Target Milestone: rc   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-10-30 09:59:46 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Steven Haigh 2016-12-19 01:01:03 UTC
SELinux is preventing /usr/bin/lscpu from getattr access on the file /proc/xen/capabilities.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that lscpu should be allowed getattr access on the capabilities file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'lscpu' --raw | audit2allow -M my-lscpu
# semodule -i my-lscpu.pp


Additional Information:
Source Context                system_u:system_r:rhsmcertd_t:s0
Target Context                system_u:object_r:xenfs_t:s0
Target Objects                /proc/xen/capabilities [ file ]
Source                        lscpu
Source Path                   /usr/bin/lscpu
Port                          <Unknown>
Host                          <Unknown>
Source RPM Packages           util-linux-2.23.2-33.el7.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-102.el7_3.7.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     xenhost.lan.crc.id.au
Platform                      Linux xenhost.lan.crc.id.au 4.4.38-1.el7xen.x86_64
                              #1 SMP Wed Dec 14 01:52:11 AEDT 2016 x86_64 x86_64
Alert Count                   6
First Seen                    2016-12-18 04:28:32 AEDT
Last Seen                     2016-12-19 00:28:32 AEDT
Local ID                      a5befd79-322f-4f8c-82ec-933eb2113522

Raw Audit Messages
type=AVC msg=audit(1482067712.861:26077): avc:  denied  { getattr } for  pid=13894 comm="lscpu" path="/proc/xen/capabilities" dev="xenfs" ino=3 scontext=system_u:system_r:rhsmcertd_t:s0 tcontext=system_u:object_r:xenfs_t:s0 tclass=file permissive=1


type=SYSCALL msg=audit(1482067712.861:26077): arch=x86_64 syscall=fstat success=yes exit=0 a0=5 a1=7fff49b7fc10 a2=7fff49b7fc10 a3=0 items=0 ppid=13893 pid=13894 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=lscpu exe=/usr/bin/lscpu subj=system_u:system_r:rhsmcertd_t:s0 key=(null)

Hash: lscpu,rhsmcertd_t,xenfs_t,file,getattr

--------------------------------------------------------------------------------

SELinux is preventing /usr/bin/lscpu from read access on the file capabilities.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that lscpu should be allowed read access on the capabilities file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'lscpu' --raw | audit2allow -M my-lscpu
# semodule -i my-lscpu.pp


Additional Information:
Source Context                system_u:system_r:rhsmcertd_t:s0
Target Context                system_u:object_r:xenfs_t:s0
Target Objects                capabilities [ file ]
Source                        lscpu
Source Path                   /usr/bin/lscpu
Port                          <Unknown>
Host                          <Unknown>
Source RPM Packages           util-linux-2.23.2-33.el7.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-102.el7_3.7.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     xenhost.lan.crc.id.au
Platform                      Linux xenhost.lan.crc.id.au 4.4.38-1.el7xen.x86_64
                              #1 SMP Wed Dec 14 01:52:11 AEDT 2016 x86_64 x86_64
Alert Count                   6
First Seen                    2016-12-18 04:28:32 AEDT
Last Seen                     2016-12-19 00:28:32 AEDT
Local ID                      cc3dd569-43a0-41e4-bb61-efd1c7944fa5

Raw Audit Messages
type=AVC msg=audit(1482067712.861:26076): avc:  denied  { read } for  pid=13894 comm="lscpu" name="capabilities" dev="xenfs" ino=3 scontext=system_u:system_r:rhsmcertd_t:s0 tcontext=system_u:object_r:xenfs_t:s0 tclass=file permissive=1


type=AVC msg=audit(1482067712.861:26076): avc:  denied  { open } for  pid=13894 comm="lscpu" path="/proc/xen/capabilities" dev="xenfs" ino=3 scontext=system_u:system_r:rhsmcertd_t:s0 tcontext=system_u:object_r:xenfs_t:s0 tclass=file permissive=1


type=SYSCALL msg=audit(1482067712.861:26076): arch=x86_64 syscall=open success=yes exit=EIO a0=60d3e0 a1=0 a2=1b6 a3=24 items=0 ppid=13893 pid=13894 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=lscpu exe=/usr/bin/lscpu subj=system_u:system_r:rhsmcertd_t:s0 key=(null)

Hash: lscpu,rhsmcertd_t,xenfs_t,file,read

--------------------------------------------------------------------------------

SELinux is preventing /usr/bin/grep from ioctl access on the file /proc/xen/capabilities.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that grep should be allowed ioctl access on the capabilities file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'grep' --raw | audit2allow -M my-grep
# semodule -i my-grep.pp


Additional Information:
Source Context                system_u:system_r:rhsmcertd_t:s0
Target Context                system_u:object_r:xenfs_t:s0
Target Objects                /proc/xen/capabilities [ file ]
Source                        grep
Source Path                   /usr/bin/grep
Port                          <Unknown>
Host                          <Unknown>
Source RPM Packages           grep-2.20-2.el7.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-102.el7_3.7.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     xenhost.lan.crc.id.au
Platform                      Linux xenhost.lan.crc.id.au 4.4.38-1.el7xen.x86_64
                              #1 SMP Wed Dec 14 01:52:11 AEDT 2016 x86_64 x86_64
Alert Count                   6
First Seen                    2016-12-18 04:28:32 AEDT
Last Seen                     2016-12-19 00:28:32 AEDT
Local ID                      96d64a63-7d8e-48e9-bcb3-be503033811a

Raw Audit Messages
type=AVC msg=audit(1482067712.991:26078): avc:  denied  { ioctl } for  pid=13928 comm="grep" path="/proc/xen/capabilities" dev="xenfs" ino=3 ioctlcmd=5401 scontext=system_u:system_r:rhsmcertd_t:s0 tcontext=system_u:object_r:xenfs_t:s0 tclass=file permissive=1


type=SYSCALL msg=audit(1482067712.991:26078): arch=x86_64 syscall=ioctl success=no exit=ENOTTY a0=5 a1=5401 a2=7fffc65acca0 a3=0 items=0 ppid=13897 pid=13928 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=grep exe=/usr/bin/grep subj=system_u:system_r:rhsmcertd_t:s0 key=(null)

Hash: grep,rhsmcertd_t,xenfs_t,file,ioctl

Comment 6 errata-xmlrpc 2018-10-30 09:59:46 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3111