Bug 1438937

Actual results (permissive mode):
----
type=SYSCALL msg=audit(04/04/2017 15:43:06.245:500) : arch=x86_64 syscall=openat success=yes exit=3 a0=0xffffffffffffff9c a1=0x7ffc35dc1ef3 a2=O_RDONLY a3=0x0 items=0 ppid=24126 pid=24134 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=grep exe=/usr/bin/grep subj=system_u:system_r:iptables_t:s0 key=(null) 
type=AVC msg=audit(04/04/2017 15:43:06.245:500) : avc:  denied  { open } for  pid=24134 comm=grep path=/etc/modprobe.d/i2c-dev.conf dev="dm-1" ino=4820 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:modules_conf_t:s0 tclass=file 
type=AVC msg=audit(04/04/2017 15:43:06.245:500) : avc:  denied  { read } for  pid=24134 comm=grep name=i2c-dev.conf dev="dm-1" ino=4820 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:modules_conf_t:s0 tclass=file 
----
type=SYSCALL msg=audit(04/04/2017 15:43:06.245:501) : arch=x86_64 syscall=fstat success=yes exit=0 a0=0x3 a1=0x7ffc35dc0110 a2=0x7ffc35dc0110 a3=0x0 items=0 ppid=24126 pid=24134 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=grep exe=/usr/bin/grep subj=system_u:system_r:iptables_t:s0 key=(null) 
type=AVC msg=audit(04/04/2017 15:43:06.245:501) : avc:  denied  { getattr } for  pid=24134 comm=grep path=/etc/modprobe.d/i2c-dev.conf dev="dm-1" ino=4820 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:modules_conf_t:s0 tclass=file 
----
type=SYSCALL msg=audit(04/04/2017 15:43:06.245:502) : arch=x86_64 syscall=ioctl success=no exit=ENOTTY(Inappropriate ioctl for device) a0=0x3 a1=TCGETS a2=0x7ffc35dc0050 a3=0x0 items=0 ppid=24126 pid=24134 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=grep exe=/usr/bin/grep subj=system_u:system_r:iptables_t:s0 key=(null) 
type=AVC msg=audit(04/04/2017 15:43:06.245:502) : avc:  denied  { ioctl } for  pid=24134 comm=grep path=/etc/modprobe.d/i2c-dev.conf dev="dm-1" ino=4820 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:modules_conf_t:s0 tclass=file 
----

*** This bug has been marked as a duplicate of bug 1436689 ***

*** Bug 1465031 has been marked as a duplicate of this bug. ***

A comment in Bug 1465031 (which is a duplicate to this one) mentioned the required policy change:

> I am also seeing this - on each reboot I get 6 selinux denials logged in my
> audit.log - one for each file in /etc/modprobe.d/*.conf. The code in
> question comes from line 212 in /usr/libexec/iptables/iptables.init where it
> is trying to determine if ipv6 has been disabled.
> 
> Files in /etc/modprobe.d/*.conf look correctly labeled to me and restorecon
> -RvF /etc/modprobe.d returns no output showing that it made no changes -
> thus answering the question about trying the relabel.
> 
> type=AVC msg=audit(1504094765.370:28): avc:  denied  { read } for  pid=661
> comm="grep" name="blacklist-iscsi.conf" dev="dm-0" ino=782889
> scontext=system_u:system_r:iptables_t:s0
> tcontext=system_u:object_r:modules_conf_t:s0 tclass=file
> 
> Problem only happens when iptables.service is started by systemd as part of
> the boot. If you run systemctl restart iptables then nothing is logged.
> Running the AVCs through audit2allow generates:
> 
> require {
>         type iptables_t;
>         type modules_conf_t;
>         class file read;
> }
> 
> #============= iptables_t ==============
> allow iptables_t modules_conf_t:file read;

*** Bug 1496453 has been marked as a duplicate of this bug. ***

Note that the effect here is opposite what one might think: the ip6tables rules are applied correctly, even if you trynot started - it is simply that you cannot disable them by aliasing something in /etc/modprobe.d.

Thus, it's an annoyance, but, it ultimately doesn't cause functional issues in the case where a user is utilizing ip6tables to start the firewall - only the negative case: disabling ipv6 in /etc/modprobe.d/* will fail since grep cannot read the files.

Whoa, typo:

Note that the effect here is opposite what one might think: the ip6tables rules are applied correctly - it is simply that you cannot disable them by aliasing something in /etc/modprobe.d.

*** Bug 1516052 has been marked as a duplicate of this bug. ***

*** Bug 1544921 has been marked as a duplicate of this bug. ***

*** Bug 1544923 has been marked as a duplicate of this bug. ***

*** Bug 1544922 has been marked as a duplicate of this bug. ***

*** Bug 1532656 has been marked as a duplicate of this bug. ***

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:0763