Bug 1787661

Created attachment 1649538 [details]
File: journalctl-rngd-denials-1.txt

The trace of the rngd segmentation fault indicated errors in frames #17-25 while loading /usr/lib64/opensc-pkcs11.so which is provided by opensc-0.20.0-1.fc32.x86_64. I reported the rngd segmentation fault at https://bugzilla.redhat.com/show_bug.cgi?id=1787686 opensc-0.20.0-1.fc32.x86_64 was included in the update during the boot before the rngd denials and segmentation faults started. I downgraded to opensc-0.19.0-8.fc32.x86_64 from koji. No rngd denials or segmentation fault happened on the next boot with opensc-0.19.0-8.fc32.x86_64. A change in opensc-0.20.0-1.fc32.x86_64 might be related to the rngd denials and segmentation faults. The rngd denials and segmentation faults happened on 7/7 boots with opensc-0.20.0-1.fc32.x86_64. I reported the rngd read denial of /etc/passwd at https://bugzilla.redhat.com/show_bug.cgi?id=1787663

The first denials as output by sudo ausearch -m AVC,USER_AVC,SELINUX_ERR -ts today were

time->Sat Jan  4 16:11:15 2020
type=AVC msg=audit(1578172275.681:199): avc:  denied  { search } for  pid=907 comm="rngd" name="sss" dev="dm-0" ino=394736 scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:object_r:sssd_var_lib_t:s0 tclass=dir permissive=0
----
time->Sat Jan  4 16:11:15 2020
type=AVC msg=audit(1578172275.681:200): avc:  denied  { search } for  pid=907 comm="rngd" name="sss" dev="dm-0" ino=394736 scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:object_r:sssd_var_lib_t:s0 tclass=dir permissive=0
----
time->Sat Jan  4 16:11:15 2020
type=AVC msg=audit(1578172275.681:201): avc:  denied  { search } for  pid=907 comm="rngd" name="sss" dev="dm-0" ino=394736 scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:object_r:sssd_var_lib_t:s0 tclass=dir permissive=0
----
time->Sat Jan  4 16:11:15 2020
type=AVC msg=audit(1578172275.682:202): avc:  denied  { read } for  pid=907 comm="rngd" name="passwd" dev="dm-0" ino=526474 scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file permissive=0

I allowed those as suggested by the setroubleshoot GUI with
sudo ausearch -c 'rngd' --raw | audit2allow -M my-rngd
sudo semodule -X 300 -i my-rngd.pp

When I ran sudo systemctl start rngd, the following additional rng denials occurred and rngd segmentation faulted.

time->Sat Jan  4 16:28:50 2020
type=AVC msg=audit(1578173330.107:335): avc:  denied  { search } for  pid=2336 comm="rngd" name="mc" dev="dm-0" ino=395777 scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:object_r:sssd_public_t:s0 tclass=dir permissive=0
----
time->Sat Jan  4 16:28:50 2020
type=AVC msg=audit(1578173330.107:336): avc:  denied  { search } for  pid=2336 comm="rngd" name="mc" dev="dm-0" ino=395777 scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:object_r:sssd_public_t:s0 tclass=dir permissive=0
----
time->Sat Jan  4 16:28:50 2020
type=AVC msg=audit(1578173330.107:337): avc:  denied  { write } for  pid=2336 comm="rngd" name="nss" dev="dm-0" ino=394384 scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:object_r:sssd_var_lib_t:s0 tclass=sock_file permissive=0
----
time->Sat Jan  4 16:28:50 2020
type=AVC msg=audit(1578173330.113:338): avc:  denied  { open } for  pid=2336 comm="rngd" path="/etc/passwd" dev="dm-0" ino=526474 scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file permissive=0

I ran the three commands above again, and the following denials happened. rngd didn't crash.

time->Sat Jan  4 16:33:01 2020
type=AVC msg=audit(1578173581.840:370): avc:  denied  { read } for  pid=2446 comm="rngd" name="passwd" dev="dm-0" ino=395166 scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:object_r:sssd_public_t:s0 tclass=file permissive=0
----
time->Sat Jan  4 16:33:01 2020
type=AVC msg=audit(1578173581.840:371): avc:  denied  { read } for  pid=2446 comm="rngd" name="passwd" dev="dm-0" ino=395166 scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:object_r:sssd_public_t:s0 tclass=file permissive=0
----
time->Sat Jan  4 16:33:01 2020
type=AVC msg=audit(1578173581.840:372): avc:  denied  { connectto } for  pid=2446 comm="rngd" path="/var/lib/sss/pipes/nss" scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:system_r:sssd_t:s0 tclass=unix_stream_socket permissive=0
----
time->Sat Jan  4 16:33:01 2020
type=AVC msg=audit(1578173581.841:373): avc:  denied  { getattr } for  pid=2446 comm="rngd" path="/etc/passwd" dev="dm-0" ino=526474 scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file permissive=0
----
time->Sat Jan  4 16:33:01 2020
type=AVC msg=audit(1578173581.841:374): avc:  denied  { search } for  pid=2446 comm="rngd" name=".cache" dev="dm-0" ino=293264 scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:object_r:cache_home_t:s0 tclass=dir permissive=0
----
time->Sat Jan  4 16:33:01 2020
type=AVC msg=audit(1578173581.841:375): avc:  denied  { search } for  pid=2446 comm="rngd" name="dbus" dev="dm-0" ino=137776 scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:object_r:system_dbusd_var_lib_t:s0 tclass=dir permissive=0

I ran the commands above again. During the next boot, I saw the following rngd denials while repeating the steps above twice except for restarting rngd with sudo systemctl restart rngd 

time->Sat Jan  4 18:01:43 2020
type=AVC msg=audit(1578178903.180:192): avc:  denied  { open } for  pid=915 comm="rngd" path="/var/lib/sss/mc/passwd" dev="dm-0" ino=395166 scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:object_r:sssd_public_t:s0 tclass=file permissive=0
----
time->Sat Jan  4 18:01:43 2020
type=AVC msg=audit(1578178903.180:193): avc:  denied  { open } for  pid=915 comm="rngd" path="/var/lib/sss/mc/passwd" dev="dm-0" ino=395166 scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:object_r:sssd_public_t:s0 tclass=file permissive=0
----
time->Sat Jan  4 18:01:43 2020
type=AVC msg=audit(1578178903.253:194): avc:  denied  { read } for  pid=915 comm="rngd" name="machine-id" dev="dm-0" ino=137787 scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:object_r:system_dbusd_var_lib_t:s0 tclass=lnk_file permissive=0
----
time->Sat Jan  4 18:06:27 2020
type=AVC msg=audit(1578179187.788:196): avc:  denied  { open } for  pid=905 comm="rngd" path="/var/lib/sss/mc/passwd" dev="dm-0" ino=395166 scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:object_r:sssd_public_t:s0 tclass=file permissive=0
----
time->Sat Jan  4 18:06:27 2020
type=AVC msg=audit(1578179187.789:197): avc:  denied  { open } for  pid=905 comm="rngd" path="/var/lib/sss/mc/passwd" dev="dm-0" ino=395166 scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:object_r:sssd_public_t:s0 tclass=file permissive=0
----
time->Sat Jan  4 18:06:27 2020
type=AVC msg=audit(1578179187.834:198): avc:  denied  { read } for  pid=905 comm="rngd" name="machine-id" dev="dm-0" ino=137787 scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:object_r:system_dbusd_var_lib_t:s0 tclass=lnk_file permissive=0


time->Sat Jan  4 18:17:10 2020
type=AVC msg=audit(1578179830.742:335): avc:  denied  { getattr } for  pid=2105 comm="rngd" path="/var/lib/sss/mc/passwd" dev="dm-0" ino=395077 scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:object_r:sssd_public_t:s0 tclass=file permissive=0
----
time->Sat Jan  4 18:17:10 2020
type=AVC msg=audit(1578179830.742:336): avc:  denied  { getattr } for  pid=2105 comm="rngd" path="/var/lib/sss/mc/passwd" dev="dm-0" ino=395077 scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:object_r:sssd_public_t:s0 tclass=file permissive=0


time->Sat Jan  4 18:19:02 2020
type=AVC msg=audit(1578179942.343:363): avc:  denied  { map } for  pid=2166 comm="rngd" path="/var/lib/sss/mc/passwd" dev="dm-0" ino=395077 scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:object_r:sssd_public_t:s0 tclass=file permissive=0
----
time->Sat Jan  4 18:19:02 2020
type=AVC msg=audit(1578179942.343:364): avc:  denied  { map } for  pid=2166 comm="rngd" path="/var/lib/sss/mc/passwd" dev="dm-0" ino=395077 scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:object_r:sssd_public_t:s0 tclass=file permissive=0

I haven't seen more denials since then. The rules in my-rngd.te are the following.

allow rngd_t cache_home_t:dir search;
allow rngd_t passwd_file_t:file { getattr open read };
allow rngd_t sssd_public_t:dir search;
allow rngd_t sssd_public_t:file map;
allow rngd_t sssd_public_t:file { getattr open read };
allow rngd_t sssd_t:unix_stream_socket connectto;
allow rngd_t sssd_var_lib_t:dir search;
allow rngd_t sssd_var_lib_t:sock_file write;
allow rngd_t system_dbusd_var_lib_t:dir search;
allow rngd_t system_dbusd_var_lib_t:lnk_file read;

Similar problem has been detected:

Logging on after an update to Fedora32 

hashmarkername: setroubleshoot
kernel:         5.5.0-0.rc4.git2.1.fc32.x86_64
package:        selinux-policy-3.14.5-18.fc32.noarch
reason:         SELinux is preventing rngd from 'search' accesses on the directory sss.
type:           libreport

commit c8c0a3991634436928d25282eda22eac2efcd456 (HEAD -> rawhide)
Author: Lukas Vrabec <lvrabec>
Date:   Fri Jan 10 13:20:52 2020 +0100

    Allow rngd_t domain to use nsswitch BZ(1787661)

This package has changed maintainer in the Fedora.
Reassigning to the new maintainer of this component.

*** Bug 1787663 has been marked as a duplicate of this bug. ***

This bug appears to have been reported against 'rawhide' during the Fedora 32 development cycle.
Changing version to 32.

This message is a reminder that Fedora 32 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora 32 on 2021-05-25.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
Fedora 'version' of '32'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora 32 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

These denials were fixed in selinux-policy-3.14.5-28.fc32 according to the Fixed in Version field. The commit Allow rngd_t domain to use nsswitch in comment 5 was added in 3.14.5-20.fc32 according to the changelog at https://koji.fedoraproject.org/koji/buildinfo?buildID=1482968