Bug 1847331

Summary:	/sys/kernel/tracing: current context conflicts with default context
Product:	Red Hat Enterprise Linux 8	Reporter:	Milos Malik <mmalik>
Component:	selinux-policy	Assignee:	Zdenek Pytela <zpytela>
Status:	CLOSED ERRATA	QA Contact:	Milos Malik <mmalik>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	8.3	CC:	lvrabec, mmalik, plautrba, ssekidde
Target Milestone:	rc	Keywords:	Triaged
Target Release:	8.3	Flags:	pm-rhel: mirror+
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:	1841287	Environment:
Last Closed:	2020-11-04 01:56:46 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Milos Malik 2020-06-16 08:55:30 UTC

+++ This bug was initially created as a clone of Bug #1841287 +++

Description of problem:
 * current context of /sys/kernel/tracing is tracefs_t
 * default context for /sys/kernel/tracing should be sysfs_t

Version-Release number of selected component (if applicable):
policycoreutils-2.9-9.el8.x86_64
python3-policycoreutils-2.9-9.el8.noarch
selinux-policy-3.14.3-44.el8.noarch
selinux-policy-targeted-3.14.3-44.el8.noarch

How reproducible:
 * always

Steps to Reproduce:
1. get a RHEL-8.3 machine (targeted policy is active)
2. # systemctl start selinux-autorelabel.service
3. wait until the machine boots up
4. search for SELinux denials

Actual results:
----
type=PROCTITLE msg=audit(06/16/2020 04:08:16.300:322) : proctitle=/sbin/setfiles -q /etc/selinux/targeted/contexts/files/file_contexts / /dev /dev/hugepages /dev/mqueue /dev/pts /dev/shm /run /r 
type=SYSCALL msg=audit(06/16/2020 04:08:16.300:322) : arch=x86_64 syscall=lsetxattr success=yes exit=0 a0=0x559d7925e720 a1=0x7f158ad3dffe a2=0x559d796e8b60 a3=0x1d items=0 ppid=5044 pid=5709 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=setfiles exe=/usr/sbin/setfiles subj=system_u:system_r:unconfined_service_t:s0 key=(null) 
type=AVC msg=audit(06/16/2020 04:08:16.300:322) : avc:  denied  { associate } for  pid=5709 comm=setfiles name=/ dev="tracefs" ino=1 scontext=system_u:object_r:sysfs_t:s0 tcontext=system_u:object_r:tracefs_t:s0 tclass=filesystem permissive=1 
----

Expected results:
 * no SELinux denials
 * current and default contexts are in sync

Additional information:
 * an avalanche of the same SELinux denials appears when following command is executed:
# restorecon -Rv /sys/kernel/tracing/

Comment 10 errata-xmlrpc 2020-11-04 01:56:46 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:4528