Bug 1765063
| Summary: | AVCs seen on "fuser" when "tmpwatch --fuser ..." is used as a system cron job | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Renaud Métrich <rmetrich> | |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> | |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> | |
| Severity: | medium | Docs Contact: | ||
| Priority: | urgent | |||
| Version: | 7.7 | CC: | fadamo, fkrska, lvrabec, mmalik, plautrba, ssekidde, vmojzis, zpytela | |
| Target Milestone: | rc | Keywords: | AutoVerified, ZStream | |
| Target Release: | 7.8 | |||
| Hardware: | All | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | selinux-policy-3.13.1-266.el7 | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1766095 (view as bug list) | Environment: | ||
| Last Closed: | 2020-03-31 19:11:00 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1766095 | |||
Red Hat Enterprise Linux 7 is now in the Maintenance Support 1 phase of the product life cycle. Future minor releases will focus on retaining and improving stability and reliability, so that qualified Critical and Important Security errata advisories (RHSAs) and Urgent Priority Bug Fix errata advisories (RHBAs) may be released as they become available. Please describe the impact of this issue and provide justification so that the bug can be properly assesed. See the Red Hat Enterprise Linux Life Cycle document for more details: https://access.redhat.com/support/policy/updates/errata/#Maintenance_Support_1_Phase commit 7a70acb74f1c856f5dc1e54b407632c2beb2db28 (HEAD -> rhel7.8-contrib, origin/rhel7.8-contrib)
Author: Lukas Vrabec <lvrabec>
Date: Wed Oct 30 16:01:58 2019 +0100
Allow tmpwatch process labeled as tmpreaper_t domain to execute fuser command.
Resolves: rhbz#1765063
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:1007 |
Description of problem: With tmpwatch-2.11-6.el7 shipped with RHEL7.7, AVcs are seen when "tmpwatch" executes internally "fuser" while running as a system cron job (domain is then "tmpreaper_t"). These are due to "fuser" not being able to read /proc/<PID>, which is necessary to find processes having opened some file. After adding "domain_read_all_domains_state(tmpreaper_t)" rules, "fuser" then works but still some AVCs are seen: -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- allow tmpreaper_t fixed_disk_device_t:blk_file getattr; allow tmpreaper_t proc_net_t:file read; allow tmpreaper_t system_mail_t:unix_dgram_socket getattr; allow tmpreaper_t system_mail_t:unix_stream_socket getattr; -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- Note that there may be more, depending on what is read from /proc. Very probably, all the other AVCs happening while reading /proc can be dont-audit'ed because fuser's use case here is to find out unused files, not other types. Version-Release number of selected component (if applicable): selinux-policy-3.13.1-252.el7.1 tmpwatch-2.11-6.el7 How reproducible: Always Steps to Reproduce: 1. Install latest tmpwatch # yum -y install tmpwatch 2. Create a temporary file # mkdir /tmp/test # touch /tmp/test/file 3. Execute tmpwatch through crond with "-s" (i.e. "--fuser") option # echo "* * * * * root /usr/sbin/tmpwatch -vds -m 0 /tmp/test" >> /etc/crontab # sleep 60 # ausearch -m avc -ts recent | audit2allow Actual results: #============= tmpreaper_t ============== allow tmpreaper_t NetworkManager_t:dir { getattr search }; allow tmpreaper_t abrt_t:unix_dgram_socket getattr; allow tmpreaper_t abrt_t:unix_stream_socket getattr; allow tmpreaper_t auditd_t:dir { getattr search }; allow tmpreaper_t crond_t:dir { getattr search }; allow tmpreaper_t dhcpc_t:dir { getattr search }; allow tmpreaper_t fixed_disk_device_t:blk_file getattr; .. Expected results: No AVC Additional info: With tmpwatch-2.11-5.el7 shipped with RHEL7.6, this was not happening because "fuser" was not called, even if option was passed to "tmpwatch". A workaround is to run "tmpwatch" as a user cron instead of system cron, which will then make "tmpwatch" run as the user's context (e.g. "unconfined_t"). Custom policy module that "helps" (but doesn't fix everything): -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- policy_module(local_tmpwatch, 1.0) gen_require(` type tmpreaper_t; ') domain_read_all_domains_state(tmpreaper_t) -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------