Bug 1534924
| Summary: | selinux denies audisp-remote to write to its queue file | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Ondrej Moriš <omoris> |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
| Status: | CLOSED ERRATA | QA Contact: | Ondrej Moriš <omoris> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 7.5 | CC: | jjaburek, lmiksik, lvrabec, mgrepl, mmalik, plautrba, ssekidde |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-3.13.1-186.el7 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-04-10 12:49:36 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1256920 | ||
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0763 |
Description of problem: Selinux policy denies audisp-remote (audispd plugin for remote logging) to write to its queue file /var/spool/audit/remote.log: time->Tue Jan 16 10:10:10 2018 node=REMOTE_LOGGING_CLIENT type=PROCTITLE msg=audit(1516093810.889:5569629): proctitle="/sbin/audisp-remote" node=REMOTE_LOGGING_CLIENT type=SYSCALL msg=audit(1516093810.889:5569629): arch=c000003e syscall=2 success=no exit=-13 a0=5571a4578bd5 a1=42 a2=180 a3=49 items=0 ppid=22611 pid=22634 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="audisp-remote" exe="/usr/sbin/audisp-remote" subj=system_u:system_r:audisp_remote_t:s15:c0.c1023 key=(null) node=REMOTE_LOGGING_CLIENT type=AVC msg=audit(1516093810.889:5569629): avc: denied { write } for pid=22634 comm="audisp-remote" name="remote.log" dev="dm-4" ino=4230169 scontext=system_u:system_r:audisp_remote_t:s15:c0.c1023 tcontext=staff_u:object_r:audit_spool_t:s0 tclass=file Tool audit2allow suggest to add the following rule: allow audisp_remote_t audit_spool_t:file write; Loading a module containing aforementioned rule resolves the issue. Without it, remote logging with forwarding does not work. Version-Release number of selected component (if applicable): audit-2.8.1-3.el7 kernel-3.10.0-823.el7 selinux-policy-3.13.1-183.el7 selinux-policy-mls-3.13.1-183.el7 How reproducible: 100% Steps to Reproduce: 1. Setup audit-remote logging using client forwarding mode. 2. Start auditd. Actual results: From journalctl: audisp-remote[22659]: Error initializing audit record queue: Permission denied audisp-remote[22659]: Connected to A.B.C.D And AVC mentioned in description. Expected results: audisp-remote[25338]: Audisp-remote started with queue_size: 1 audisp-remote[25338]: Connected to A.B.C.D Additional info: This problem was discovered on MLS system but it should be reproducible on a system with targeted policy.