Bug 1633211
| Summary: | PCP SELinux AVCs | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Marko Myllynen <myllynen> |
| Component: | pcp | Assignee: | Lukas Berk <lberk> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 29 | CC: | fche, lberk, mgoodwin, nathans, scox |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | pcp-4.2.0-1.fc27 pcp-4.2.0-1.fc29 pcp-4.2.0-1.fc28 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-11-28 02:22:09 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
On Fedora 29 Workstation Beta also:
type=AVC msg=audit(1538054722.670:267): avc: denied { getattr associate } for pid=1205 comm="pmdalinux" key=0 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=shm permissive=1
Just pushed this commits upstream.
commit e7ca60ae8e4a22a69bea682ebaf992a3924a9633 (HEAD -> master, origin/master, origin/HEAD)
Author: Lukas Berk <lberk>
Date: Thu Sep 27 14:44:52 2018 -0400
selinux: rhbza1633211 continued
Further avc denials as reported by marko
commit 82b0d271a96f3dcb53beaf2639ef8ea1f73b2cf8
Author: Lukas Berk <lberk>
Date: Thu Sep 27 11:49:18 2018 -0400
selinux: rhbz1633211 bpf class & inheritence issues
Not only add bpf class checks/rules, but add --common flags (where
applicable) to catch the permissions where the class access type is
inherited.
This should (hopefully) solve the issue on newer selinux versions
where the user space tooling can report inheritence, and opts to omit
large potions of the class access types.
pcp-4.2.0-1.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2018-3b0d7f7858 pcp-4.2.0-1.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-ae612244a9 pcp-4.2.0-1.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2018-8da69c3c21 pcp-4.2.0-1.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-3b0d7f7858 pcp-4.2.0-1.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-8da69c3c21 pcp-4.2.0-1.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-ae612244a9 pcp-4.2.0-1.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report. pcp-4.2.0-1.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report. pcp-4.2.0-1.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report. |
Description of problem: With bcc-0.7.0 and pcp-4.1.3 on Fedora 29 Beta after enabling BCC PMDA and the modules it provides: type=AVC msg=audit(1537965513.240:236): avc: denied { map_create } for pid=15717 comm="python3" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=bpf permissive=1 type=AVC msg=audit(1537965513.240:237): avc: denied { map_read map_write } for pid=15717 comm="python3" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=bpf permissive=1 type=AVC msg=audit(1537965513.323:238): avc: denied { prog_load } for pid=15717 comm="python3" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=bpf permissive=1 type=AVC msg=audit(1537965513.324:239): avc: denied { prog_run } for pid=15717 comm="python3" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=bpf permissive=1 type=AVC msg=audit(1537965560.008:240): avc: denied { getattr } for pid=9973 comm="pmdaproc" path="/dev/gpmctl" dev="devtmpfs" ino=22065 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:gpmctl_t:s0 tclass=sock_file permissive=1 type=AVC msg=audit(1537965563.766:241): avc: denied { signull } for pid=15717 comm="python3" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 (Pasting everything seen there, at least the gpmctl_t related was known earlier already.) Thanks.