Bug 1532017
| Summary: | SELinux prevents /usr/bin/bash (running as squid_t) from getattr+execute access on the file /usr/sbin/ldconfig | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | srakitnican <samuel.rakitnican> |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.4 | CC: | lvrabec, mgrepl, mmalik, plautrba, ssekidde |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-3.13.1-203.el7 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-10-30 10:02:20 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:3111 |
SELinux is preventing /usr/bin/bash from execute access on the file /usr/sbin/ldconfig. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that bash should be allowed execute access on the ldconfig file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'sh' --raw | audit2allow -M my-sh # semodule -i my-sh.pp Additional Information: Source Context system_u:system_r:squid_t:s0 Target Context system_u:object_r:ldconfig_exec_t:s0 Target Objects /usr/sbin/ldconfig [ file ] Source sh Source Path /usr/bin/bash Port <Unknown> Host <machine> Source RPM Packages bash-4.2.46-29.el7_4.x86_64 Target RPM Packages glibc-2.17-196.el7_4.2.x86_64 Policy RPM selinux-policy-3.13.1-166.el7_4.7.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name <machine> Platform Linux <machine> 4.14.12-1.el7.elrepo.x86_64 #1 SMP Fri Jan 5 13:28:56 EST 2018 x86_64 x86_64 Alert Count 10 First Seen 2018-01-07 12:16:04 CET Last Seen 2018-01-07 12:16:05 CET Local ID 4595a0ea-748d-48f2-939c-a61074a17a08 Raw Audit Messages type=AVC msg=audit(1515323765.843:254): avc: denied { execute } for pid=2605 comm="sh" name="ldconfig" dev="sda2" ino=1969233 scontext=system_u:system_r:squid_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file permissive=0 type=SYSCALL msg=audit(1515323765.843:254): arch=x86_64 syscall=execve success=no exit=EACCES a0=214c840 a1=214c940 a2=214b740 a3=7ffea3a2b320 items=0 ppid=2604 pid=2605 auid=4294967295 uid=23 gid=23 euid=23 suid=23 fsuid=23 egid=23 sgid=23 fsgid=23 tty=(none) ses=4294967295 comm=sh exe=/usr/bin/bash subj=system_u:system_r:squid_t:s0 key=(null) Hash: sh,squid_t,ldconfig_exec_t,file,execute ------------------ SELinux is preventing /usr/bin/bash from getattr access on the file /usr/sbin/ldconfig. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that bash should be allowed getattr access on the ldconfig file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'sh' --raw | audit2allow -M my-sh # semodule -i my-sh.pp Additional Information: Source Context system_u:system_r:squid_t:s0 Target Context system_u:object_r:ldconfig_exec_t:s0 Target Objects /usr/sbin/ldconfig [ file ] Source sh Source Path /usr/bin/bash Port <Unknown> Host <machine> Source RPM Packages bash-4.2.46-29.el7_4.x86_64 Target RPM Packages glibc-2.17-196.el7_4.2.x86_64 Policy RPM selinux-policy-3.13.1-166.el7_4.7.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name <machine> Platform Linux <machine> 4.14.12-1.el7.elrepo.x86_64 #1 SMP Fri Jan 5 13:28:56 EST 2018 x86_64 x86_64 Alert Count 13 First Seen 2018-01-07 12:16:04 CET Last Seen 2018-01-07 12:16:05 CET Local ID cc5a369f-6ef1-4e10-8a69-947935d62f17 Raw Audit Messages type=AVC msg=audit(1515323765.845:256): avc: denied { getattr } for pid=2605 comm="sh" path="/usr/sbin/ldconfig" dev="sda2" ino=1969233 scontext=system_u:system_r:squid_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file permissive=0 type=SYSCALL msg=audit(1515323765.845:256): arch=x86_64 syscall=stat success=no exit=EACCES a0=214c840 a1=7ffea3a2b7f0 a2=7ffea3a2b7f0 a3=7ffea3a2b320 items=0 ppid=2604 pid=2605 auid=4294967295 uid=23 gid=23 euid=23 suid=23 fsuid=23 egid=23 sgid=23 fsgid=23 tty=(none) ses=4294967295 comm=sh exe=/usr/bin/bash subj=system_u:system_r:squid_t:s0 key=(null) Hash: sh,squid_t,ldconfig_exec_t,file,getattr