Bug 1734399

Summary: avc: denied { search } for comm="isc-worker0000" name="krb5"
Product: Red Hat Enterprise Linux 8 Reporter: Steeve Goveas <sgoveas>
Component: selinux-policyAssignee: Lukas Vrabec <lvrabec>
Status: CLOSED DUPLICATE QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 8.1CC: lvrabec, mmalik, plautrba, ssekidde, zpytela
Target Milestone: rc   
Target Release: 8.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-07-30 13:04:33 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Steeve Goveas 2019-07-30 12:48:49 UTC
http://ci-vm-10-0-148-68.hosted.upshift.rdu2.redhat.com/sssd-nightly-tier2/master/1/ldap_krb5/restraint.01/

SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      31
selinux-policy-3.14.3-12.el8.noarch
----
time->Tue Jul 30 06:17:39 2019
type=PROCTITLE msg=audit(1564481859.464:1725): proctitle=2F7573722F6C6962657865632F737373642F737373645F6265002D2D646F6D61696E00737373643230313272322E636F6D002D2D7569640030002D2D6769640030002D2D6C6F676765723D66696C6573
type=SYSCALL msg=audit(1564481859.464:1725): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=5576e6a0cf80 a2=0 a3=0 items=0 ppid=25340 pid=25342 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sssd_be" exe="/usr/libexec/sssd/sssd_be" subj=system_u:system_r:sssd_t:s0 key=(null)
type=AVC msg=audit(1564481859.464:1725): avc:  denied  { search } for  pid=25342 comm="sssd_be" name="krb5" dev="vda1" ino=9186485 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:krb5_keytab_t:s0 tclass=dir permissive=0
----
time->Tue Jul 30 06:17:55 2019
type=PROCTITLE msg=audit(1564481875.594:1730): proctitle=2F7573722F62696E2F6E73757064617465002D67
type=SYSCALL msg=audit(1564481875.594:1730): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7f9a201feae0 a2=0 a3=0 items=0 ppid=25342 pid=25431 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="isc-worker0000" exe="/usr/bin/nsupdate" subj=system_u:system_r:sssd_t:s0 key=(null)
type=AVC msg=audit(1564481875.594:1730): avc:  denied  { search } for  pid=25431 comm="isc-worker0000" name="krb5" dev="vda1" ino=9186485 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:krb5_keytab_t:s0 tclass=dir permissive=0
----
time->Tue Jul 30 06:17:58 2019
type=PROCTITLE msg=audit(1564481878.213:1731): proctitle=2F7573722F62696E2F6E73757064617465002D67
type=SYSCALL msg=audit(1564481878.213:1731): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7f9a202003f0 a2=0 a3=0 items=0 ppid=25342 pid=25431 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="isc-worker0000" exe="/usr/bin/nsupdate" subj=system_u:system_r:sssd_t:s0 key=(null)
type=AVC msg=audit(1564481878.213:1731): avc:  denied  { search } for  pid=25431 comm="isc-worker0000" name="krb5" dev="vda1" ino=9186485 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:krb5_keytab_t:s0 tclass=dir permissive=0
----
time->Tue Jul 30 06:18:00 2019
type=PROCTITLE msg=audit(1564481880.555:1732): proctitle=2F7573722F62696E2F6E73757064617465002D67
type=SYSCALL msg=audit(1564481880.555:1732): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7f99b0201470 a2=0 a3=0 items=0 ppid=25342 pid=25480 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="isc-worker0000" exe="/usr/bin/nsupdate" subj=system_u:system_r:sssd_t:s0 key=(null)
type=AVC msg=audit(1564481880.555:1732): avc:  denied  { search } for  pid=25480 comm="isc-worker0000" name="krb5" dev="vda1" ino=9186485 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:krb5_keytab_t:s0 tclass=dir permissive=0
----
time->Tue Jul 30 06:18:03 2019
type=PROCTITLE msg=audit(1564481883.177:1733): proctitle=2F7573722F62696E2F6E73757064617465002D67
type=SYSCALL msg=audit(1564481883.177:1733): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7f99b0206810 a2=0 a3=0 items=0 ppid=25342 pid=25480 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="isc-worker0000" exe="/usr/bin/nsupdate" subj=system_u:system_r:sssd_t:s0 key=(null)
type=AVC msg=audit(1564481883.177:1733): avc:  denied  { search } for  pid=25480 comm="isc-worker0000" name="krb5" dev="vda1" ino=9186485 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:krb5_keytab_t:s0 tclass=dir permissive=0
----
time->Tue Jul 30 06:18:05 2019
type=PROCTITLE msg=audit(1564481885.842:1734): proctitle=2F7573722F62696E2F6E73757064617465002D67
type=SYSCALL msg=audit(1564481885.842:1734): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7fe114201470 a2=0 a3=0 items=0 ppid=25342 pid=25498 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="isc-worker0000" exe="/usr/bin/nsupdate" subj=system_u:system_r:sssd_t:s0 key=(null)
type=AVC msg=audit(1564481885.842:1734): avc:  denied  { search } for  pid=25498 comm="isc-worker0000" name="krb5" dev="vda1" ino=9186485 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:krb5_keytab_t:s0 tclass=dir permissive=0

Comment 1 Lukas Vrabec 2019-07-30 13:02:55 UTC
*** Bug 1734387 has been marked as a duplicate of this bug. ***

Comment 2 Lukas Vrabec 2019-07-30 13:03:24 UTC
*** Bug 1734403 has been marked as a duplicate of this bug. ***

Comment 3 Lukas Vrabec 2019-07-30 13:04:33 UTC

*** This bug has been marked as a duplicate of bug 1730144 ***