Bug 1779070

Summary:	the boinc-client service triggers SELinux denials
Product:	Red Hat Enterprise Linux 8	Reporter:	Milos Malik <mmalik>
Component:	selinux-policy	Assignee:	Zdenek Pytela <zpytela>
Status:	CLOSED ERRATA	QA Contact:	Milos Malik <mmalik>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	8.2	CC:	lvrabec, mmalik, plautrba, ssekidde, zpytela
Target Milestone:	rc	Keywords:	Patch, Triaged
Target Release:	8.3
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:	1711682	Environment:
Last Closed:	2020-11-04 01:56:01 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Milos Malik 2019-12-03 08:31:34 UTC

+++ This bug was initially created as a clone of Bug #1711682 +++

boinc-client-7.16.1-5.el8.x86_64
selinux-policy-3.14.3-29.el8.noarch
selinux-policy-devel-3.14.3-29.el8.noarch
selinux-policy-targeted-3.14.3-29.el8.noarch

Steps to Reproduce:
1) get a RHEL-8.2 machine (targeted policy is active)
2) start the boinc-client service
3) search for SELinux denials

Actual results:
----
type=PROCTITLE msg=audit(12/03/2019 03:14:34.999:513) : proctitle=(boinccmd) 
type=PATH msg=audit(12/03/2019 03:14:34.999:513) : item=0 name=/run/systemd/unit-root/var/lib/boinc inode=4742188 dev=fd:01 mode=dir,755 ouid=boinc ogid=boinc rdev=00:00 obj=system_u:object_r:boinc_var_lib_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 
type=CWD msg=audit(12/03/2019 03:14:34.999:513) : cwd=/ 
type=SYSCALL msg=audit(12/03/2019 03:14:34.999:513) : arch=x86_64 syscall=mount success=no exit=EACCES(Permission denied) a0=0x5609966909c0 a1=0x5609966909c0 a2=0x0 a3=MS_BIND|MS_REC items=1 ppid=1 pid=18781 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=(boinccmd) exe=/usr/lib/systemd/systemd subj=system_u:system_r:init_t:s0 key=(null) 
type=AVC msg=audit(12/03/2019 03:14:34.999:513) : avc:  denied  { mounton } for  pid=18781 comm=(boinccmd) path=/run/systemd/unit-root/var/lib/boinc dev="vda1" ino=4742188 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:boinc_var_lib_t:s0 tclass=dir permissive=0 
----
type=PROCTITLE msg=audit(12/03/2019 03:14:35.427:514) : proctitle=(rm) 
type=PATH msg=audit(12/03/2019 03:14:35.427:514) : item=0 name=/run/systemd/unit-root/var/lib/boinc inode=4742188 dev=fd:01 mode=dir,755 ouid=boinc ogid=boinc rdev=00:00 obj=system_u:object_r:boinc_var_lib_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 
type=CWD msg=audit(12/03/2019 03:14:35.427:514) : cwd=/ 
type=SYSCALL msg=audit(12/03/2019 03:14:35.427:514) : arch=x86_64 syscall=mount success=no exit=EACCES(Permission denied) a0=0x5609965e4550 a1=0x5609965e4550 a2=0x0 a3=MS_BIND|MS_REC items=1 ppid=1 pid=18782 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=(rm) exe=/usr/lib/systemd/systemd subj=system_u:system_r:init_t:s0 key=(null) 
type=AVC msg=audit(12/03/2019 03:14:35.427:514) : avc:  denied  { mounton } for  pid=18782 comm=(rm) path=/run/systemd/unit-root/var/lib/boinc dev="vda1" ino=4742188 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:boinc_var_lib_t:s0 tclass=dir permissive=0 
----
type=PROCTITLE msg=audit(12/03/2019 03:14:42.306:518) : proctitle=(boinc) 
type=PATH msg=audit(12/03/2019 03:14:42.306:518) : item=0 name=/run/systemd/unit-root/var/lib/boinc inode=4742188 dev=fd:01 mode=dir,755 ouid=boinc ogid=boinc rdev=00:00 obj=system_u:object_r:boinc_var_lib_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 
type=CWD msg=audit(12/03/2019 03:14:42.306:518) : cwd=/ 
type=SYSCALL msg=audit(12/03/2019 03:14:42.306:518) : arch=x86_64 syscall=mount success=no exit=EACCES(Permission denied) a0=0x560996779240 a1=0x560996779240 a2=0x0 a3=MS_BIND|MS_REC items=1 ppid=1 pid=19412 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=(boinc) exe=/usr/lib/systemd/systemd subj=system_u:system_r:init_t:s0 key=(null) 
type=AVC msg=audit(12/03/2019 03:14:42.306:518) : avc:  denied  { mounton } for  pid=19412 comm=(boinc) path=/run/systemd/unit-root/var/lib/boinc dev="vda1" ino=4742188 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:boinc_var_lib_t:s0 tclass=dir permissive=0 
----

Expected results:
 * no SELinux denials
 * the boinc-client service runs successfully

Additional information:
# grep /var/lib /usr/lib/systemd/system/boinc-client.service 
ReadWritePaths=-/var/lib/boinc
WorkingDirectory=/var/lib/boinc
#

Comment 11 errata-xmlrpc 2020-11-04 01:56:01 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:4528