Bug 1852086
| Summary: | allow rhsmcertd_t var_log_t:dir add_name and :file create | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Alois Mahdal <amahdal> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 8.1 | CC: | hasuzuki, jhuo, john.sincock, lvrabec, mkluson, mmalik, plautrba, rmetrich, ssekidde |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | 8.7 | Flags: | pm-rhel:
mirror+
|
| Hardware: | Unspecified | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-3.14.3-100.el8 | Doc Type: | Bug Fix |
| Doc Text: |
Cause:
rhsmcertd-worker requires permissions to create generic log files.
Consequence:
A dnf refresh spawned by the service fails to work properly if the log file does not exist.
Fix:
Permissions were added to selinux-policy.
Result:
The rhsmcertd service runs without reporting errors.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-11-08 10:43:57 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Alois, Is an issue like this still in place? (In reply to Zdenek Pytela from comment #5) > Alois, > > Is an issue like this still in place? I can't tell (I've left the team.) Martin, can you please answer? (Note: to test this in MORF, one would need to run MORF with a branch where the particular AVC hack -- likely named `oamg3500` -- is disabled.) This still happens with RHEL 8.5, but I don't have the scenario to reproduce.
In a nutshell it's sufficient for rhsmcertd-worker to execute a DNF refresh while there was no /var/log/hawkey.log file yet.
However I don't know when such operation is triggered.
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
Mar 01 10:59:13 ...: type=AVC msg=audit(1646132353.167:307): avc: denied { add_name } for pid=1541 comm="rhsmcertd-worke" name="hawkey.log" scontext=system_u:system_r:rhsmcertd_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=dir permissive=1
Mar 01 10:59:13 ...: type=AVC msg=audit(1646132353.167:307): avc: denied { create } for pid=1541 comm="rhsmcertd-worke" name="hawkey.log" scontext=system_u:system_r:rhsmcertd_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file permissive=1
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
Commits to backport:
commit 39df22093da482340aa6350220726a9aa57767ef (HEAD -> rawhide, upstream/rawhide)
Author: Zdenek Pytela <zpytela>
Date: Thu May 19 10:20:33 2022 +0200
Allow rhsmcertd create generic log files
Resolves: rhbz#1852086
commit af68d41725f11011dcf14af5e1110a3dc6cd4a8c
Author: Zdenek Pytela <zpytela>
Date: Thu May 19 10:18:52 2022 +0200
Update logging_create_generic_logs() to use create_files_pattern()
HOW MANY OPEN BUGS DO YOU HAVE TO HAVE FOR AN ISSUE WHICH IS SUPPOSEDLY FIXED ALREADY IN ERRATA? Of course, as i've pointed out elsewhere the issue is NOT fixed. But you guys think it is. So why is this bug still open? What a hopeless mess. I am seeing this error on servers which have a number of dated hawkey.log files. So it does not just occur once before hawkey.log is created for the first time. It occurs every time logrotate rotates hawkey.log to a dated file... I look forward to the patch for this bug actually fixing the issue... thankyou. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:7691 |
Description of problem ====================== On first boot after upgrading from RHEL-7.9 to RHEL-8.2; we're seeing this SELinux denial: SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: permissive Mode from config file: permissive Policy MLS status: enabled Policy deny_unknown status: allowed Memory protection checking: actual (secure) Max kernel policy version: 31 selinux-policy-3.14.3-41.el8_2.4.noarch ---- time->Mon Jun 29 15:43:22 2020 type=AVC msg=audit(1593438202.498:47): avc: denied { create } for pid=5549 comm="rhsmcertd-worke" name="hawkey.log" scontext=system_u:system_r:rhsmcertd_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file permissive=1 type=AVC msg=audit(1593438202.498:47): avc: denied { add_name } for pid=5549 comm="rhsmcertd-worke" name="hawkey.log" scontext=system_u:system_r:rhsmcertd_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=dir permissive=1 audit2allow says: #============= rhsmcertd_t ============== allow rhsmcertd_t var_log_t:dir add_name; allow rhsmcertd_t var_log_t:file create; Version-Release number of selected component ============================================ selinux-policy-3.14.3-41.el8_2.4.noarch How reproducible ================ Seen once Steps to Reproduce ================== We got this during upgrade from RHEL-7.9 to RHEL-8.2. Actual results ============== Denial Expected results ================ No denial