Bug 1757043
| Summary: | SELinux prevents the pads service from starting | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Milos Malik <mmalik> |
| Component: | selinux-policy | Assignee: | Richard Fiľo <rfilo> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 31 | CC: | dwalsh, lvrabec, mgrepl, plautrba, zpytela |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-3.14.4-39.fc31 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-10-29 01:28:00 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Actual results (permissive mode):
----
type=PROCTITLE msg=audit(09/30/2019 08:53:54.366:331) : proctitle=/usr/bin/pads -D -c /etc/pads.conf
type=SYSCALL msg=audit(09/30/2019 08:53:54.366:331) : arch=x86_64 syscall=socket success=yes exit=3 a0=bluetooth a1=SOCK_RAW a2=icmp a3=0x7f5c7c0baac0 items=0 ppid=1 pid=1712 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=pads exe=/usr/bin/pads subj=system_u:system_r:pads_t:s0 key=(null)
type=AVC msg=audit(09/30/2019 08:53:54.366:331) : avc: denied { module_request } for pid=1712 comm=pads kmod="net-pf-31" scontext=system_u:system_r:pads_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system permissive=1
type=AVC msg=audit(09/30/2019 08:53:54.366:331) : avc: denied { create } for pid=1712 comm=pads scontext=system_u:system_r:pads_t:s0 tcontext=system_u:system_r:pads_t:s0 tclass=bluetooth_socket permissive=1
----
type=PROCTITLE msg=audit(09/30/2019 08:53:54.478:332) : proctitle=/usr/bin/pads -D -c /etc/pads.conf
type=SYSCALL msg=audit(09/30/2019 08:53:54.478:332) : arch=x86_64 syscall=ioctl success=yes exit=0 a0=0x3 a1=0x800448d2 a2=0x55ec11d5c960 a3=0x7f5c7c0baac0 items=0 ppid=1 pid=1712 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=pads exe=/usr/bin/pads subj=system_u:system_r:pads_t:s0 key=(null)
type=AVC msg=audit(09/30/2019 08:53:54.478:332) : avc: denied { ioctl } for pid=1712 comm=pads path=socket:[28621] dev="sockfs" ino=28621 ioctlcmd=0x48d2 scontext=system_u:system_r:pads_t:s0 tcontext=system_u:system_r:pads_t:s0 tclass=bluetooth_socket permissive=1
----
type=PROCTITLE msg=audit(09/30/2019 08:53:54.479:333) : proctitle=/usr/bin/pads -D -c /etc/pads.conf
type=SYSCALL msg=audit(09/30/2019 08:53:54.479:333) : arch=x86_64 syscall=socket success=yes exit=3 a0=netlink a1=SOCK_RAW a2=pup a3=0x7f5c7c0baac0 items=0 ppid=1 pid=1712 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=pads exe=/usr/bin/pads subj=system_u:system_r:pads_t:s0 key=(null)
type=AVC msg=audit(09/30/2019 08:53:54.479:333) : avc: denied { create } for pid=1712 comm=pads scontext=system_u:system_r:pads_t:s0 tcontext=system_u:system_r:pads_t:s0 tclass=netlink_netfilter_socket permissive=1
----
type=PROCTITLE msg=audit(09/30/2019 08:53:54.517:335) : proctitle=/usr/bin/pads -D -c /etc/pads.conf
type=MMAP msg=audit(09/30/2019 08:53:54.517:335) : fd=3 flags=MAP_SHARED
type=SYSCALL msg=audit(09/30/2019 08:53:54.517:335) : arch=x86_64 syscall=mmap success=yes exit=140035191222272 a0=0x0 a1=0x200000 a2=PROT_READ|PROT_WRITE a3=MAP_SHARED items=0 ppid=1 pid=1712 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=pads exe=/usr/bin/pads subj=system_u:system_r:pads_t:s0 key=(null)
type=AVC msg=audit(09/30/2019 08:53:54.517:335) : avc: denied { map } for pid=1712 comm=pads path=socket:[28654] dev="sockfs" ino=28654 scontext=system_u:system_r:pads_t:s0 tcontext=system_u:system_r:pads_t:s0 tclass=packet_socket permissive=1
----
The service runs successfully in permissive mode.
It will be fixed in SELinux policy package. PR: https://github.com/fedora-selinux/selinux-policy-contrib/commit/5953a31ccb667787b55800c89f0a658a086a5236 Pull request is here: https://github.com/fedora-selinux/selinux-policy-contrib/pull/150 commit fbe776b5f601131649e3f54049ec6abb82a87e40 (HEAD -> rawhide, origin/rawhide, origin/HEAD)
Author: Richard Filo <rfilo>
Date: Thu Oct 3 17:39:48 2019 +0200
Update allow rules set for pads_t domain
Allow pads_t domain map packet sockets labled pads_t
Allow pads_t domain create netlink netfilter sockets and bluetooth sockets labled pads_t
Fixes:https://bugzilla.redhat.com/show_bug.cgi?id=1757043
Signed-off-by: Richard Filo<rfilo>
FEDORA-2019-7ef1fde499 has been submitted as an update to Fedora 31. https://bodhi.fedoraproject.org/updates/FEDORA-2019-7ef1fde499 selinux-policy-3.14.4-38.fc31 has been pushed to the Fedora 31 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-7ef1fde499 FEDORA-2019-7d65c50fd6 has been submitted as an update to Fedora 31. https://bodhi.fedoraproject.org/updates/FEDORA-2019-7d65c50fd6 selinux-policy-3.14.4-39.fc31 has been pushed to the Fedora 31 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-7d65c50fd6 selinux-policy-3.14.4-39.fc31 has been pushed to the Fedora 31 stable repository. If problems still persist, please make note of it in this bug report. |
Description of problem: Version-Release number of selected component (if applicable): pads-1.2-27.fc31.x86_64 selinux-policy-3.14.4-31.fc31.noarch selinux-policy-targeted-3.14.4-31.fc31.noarch How reproducible: * always Steps to Reproduce: 1. get a Fedora 30 or 31 machine 2. start the pads service 3. search for SELinux denials Actual results (enforcing mode): ---- type=PROCTITLE msg=audit(09/30/2019 08:38:44.072:324) : proctitle=/usr/bin/pads -D -c /etc/pads.conf type=SYSCALL msg=audit(09/30/2019 08:38:44.072:324) : arch=x86_64 syscall=socket success=no exit=EACCES(Permission denied) a0=bluetooth a1=SOCK_RAW a2=icmp a3=0x7f6879115ac0 items=0 ppid=1 pid=1678 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=pads exe=/usr/bin/pads subj=system_u:system_r:pads_t:s0 key=(null) type=AVC msg=audit(09/30/2019 08:38:44.072:324) : avc: denied { create } for pid=1678 comm=pads scontext=system_u:system_r:pads_t:s0 tcontext=system_u:system_r:pads_t:s0 tclass=bluetooth_socket permissive=0 ---- Expected results: * no SELinux denials Additional info: