Bug 1689921
| Summary: | avc-denials observed during ipa-password test execution | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Nikhil Dehadrai <ndehadra> |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
| Status: | CLOSED DUPLICATE | QA Contact: | BaseOS QE Security Team <qe-baseos-security> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 8.0 | CC: | lvrabec, mgrepl, mmalik, plautrba, ssekidde, zpytela |
| Target Milestone: | rc | ||
| Target Release: | 8.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-03-18 17:58:41 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
I believe this bug is a duplicate of BZ#1664983. *** This bug has been marked as a duplicate of bug 1664983 *** |
Description of problem: avc-denials observed during ipa-password test execution Version-Release number of selected component (if applicable): selinux-policy-3.14.1-51.el8.noarch Steps to Reproduce: 1. Execute tests for ipa-password against latest RHEL Actual results: SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: enforcing Mode from config file: enforcing Policy MLS status: enabled Policy deny_unknown status: allowed Memory protection checking: actual (secure) Max kernel policy version: 31 selinux-policy-3.14.1-51.el8.noarch ---- time->Mon Mar 18 08:26:10 2019 type=PROCTITLE msg=audit(1552911970.109:4518): proctitle=2F7573722F7362696E2F6B61646D696E64002D50002F7661722F72756E2F6B61646D696E642E706964 type=PATH msg=audit(1552911970.109:4518): item=0 name="/root/.config/pkcs11/pkcs11.conf" nametype=UNKNOWN cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0 type=CWD msg=audit(1552911970.109:4518): cwd="/" type=SYSCALL msg=audit(1552911970.109:4518): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=561e0b6250a0 a2=80000 a3=0 items=1 ppid=1 pid=22165 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="kadmind" exe="/usr/sbin/kadmind" subj=system_u:system_r:kadmind_t:s0 key=(null) type=AVC msg=audit(1552911970.109:4518): avc: denied { search } for pid=22165 comm="kadmind" name=".config" dev="vda3" ino=25172194 scontext=system_u:system_r:kadmind_t:s0 tcontext=unconfined_u:object_r:config_home_t:s0 tclass=dir permissive=0 ---- time->Mon Mar 18 08:26:10 2019 type=PROCTITLE msg=audit(1552911970.110:4519): proctitle=2F7573722F7362696E2F6B61646D696E64002D50002F7661722F72756E2F6B61646D696E642E706964 type=PATH msg=audit(1552911970.110:4519): item=0 name="/root/.config/pkcs11/modules" nametype=UNKNOWN cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0 type=CWD msg=audit(1552911970.110:4519): cwd="/" type=SYSCALL msg=audit(1552911970.110:4519): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=561e0b6250a0 a2=90800 a3=0 items=1 ppid=1 pid=22165 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="kadmind" exe="/usr/sbin/kadmind" subj=system_u:system_r:kadmind_t:s0 key=(null) type=AVC msg=audit(1552911970.110:4519): avc: denied { search } for pid=22165 comm="kadmind" name=".config" dev="vda3" ino=25172194 scontext=system_u:system_r:kadmind_t:s0 tcontext=unconfined_u:object_r:config_home_t:s0 tclass=dir permissive=0 ---- time->Mon Mar 18 08:26:10 2019 type=PROCTITLE msg=audit(1552911970.117:4520): proctitle=2F7573722F7362696E2F6B61646D696E64002D50002F7661722F72756E2F6B61646D696E642E706964 type=PATH msg=audit(1552911970.117:4520): item=0 name="/root/.config/softhsm2/softhsm2.conf" nametype=UNKNOWN cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0 type=CWD msg=audit(1552911970.117:4520): cwd="/" type=SYSCALL msg=audit(1552911970.117:4520): arch=c000003e syscall=21 success=no exit=-13 a0=7fffa81109e0 a1=4 a2=0 a3=0 items=1 ppid=1 pid=22165 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="kadmind" exe="/usr/sbin/kadmind" subj=system_u:system_r:kadmind_t:s0 key=(null) type=AVC msg=audit(1552911970.117:4520): avc: denied { search } for pid=22165 comm="kadmind" name=".config" dev="vda3" ino=25172194 scontext=system_u:system_r:kadmind_t:s0 tcontext=unconfined_u:object_r:config_home_t:s0 tclass=dir permissive=0 ---- time->Mon Mar 18 08:26:10 2019 type=PROCTITLE msg=audit(1552911970.117:4521): proctitle=2F7573722F7362696E2F6B61646D696E64002D50002F7661722F72756E2F6B61646D696E642E706964 type=PATH msg=audit(1552911970.117:4521): item=0 name="/var/lib/softhsm/tokens/" nametype=UNKNOWN cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0 type=CWD msg=audit(1552911970.117:4521): cwd="/" type=SYSCALL msg=audit(1552911970.117:4521): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=561e0b5ba8b0 a2=90800 a3=0 items=1 ppid=1 pid=22165 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="kadmind" exe="/usr/sbin/kadmind" subj=system_u:system_r:kadmind_t:s0 key=(null) type=AVC msg=audit(1552911970.117:4521): avc: denied { search } for pid=22165 comm="kadmind" name="softhsm" dev="vda3" ino=58763254 scontext=system_u:system_r:kadmind_t:s0 tcontext=system_u:object_r:named_cache_t:s0 tclass=dir permissive=0 Expected results: No AVC denials should be observed