Bug 1917445
| Summary: | allow rhsmcertd_t tmpfs_t:file execute map | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Alois Mahdal <amahdal> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED DUPLICATE | QA Contact: | Milos Malik <mmalik> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 8.2 | CC: | jsefler, lvrabec, mmalik, plautrba, ssekidde |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | 8.0 | Flags: | pm-rhel:
mirror+
|
| Hardware: | Unspecified | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-01-21 13:10:17 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Decoding the strings: proctitle: /usr/libexec/platform-python/usr/libexec/rhsmd filename: /dev/shm/#108161 (deleted) Alois, Do you happen to know why rhsmd wants to execute a file from /dev/shm? No idea... maybe @ I mean: No idea... maybe @jsefler will know. (Bugzilla won't let me type properly... :( ) @jsefler according to the audit logs, it looks rhsmd wants to execute a file from /dev/shm: is this correct? Based on the SELinux denials, I believe this bug is a duplicate of BZ#2029873. (In reply to Milos Malik from comment #6) > Based on the SELinux denials, I believe this bug is a duplicate of > BZ#2029873. This bz is about /dev/shm/#108161 (deleted) while the other is memfd:libffi but from SELinux PoV it is the same problem and will have the same solution. For the purpose of reproducing it still would be good to know why it is needed and what triggers this usage. *** This bug has been marked as a duplicate of bug 2029873 *** The needinfo request[s] on this closed bug have been removed as they have been unresolved for 500 days |
Description of problem ====================== When unregistering from CDN after upgrading RHEL-7 to RHEL-8, we see these AVCs: SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: permissive Mode from config file: permissive Policy MLS status: enabled Policy deny_unknown status: allowed Memory protection checking: actual (secure) Max kernel policy version: 31 selinux-policy-3.14.3-41.el8_2.8.noarch ---- time->Thu Jan 14 11:38:43 2021 node=kvm-01-guest11.lab.eng.rdu2.redhat.com type=PROCTITLE msg=audit(1610642323.727:320): proctitle=2F7573722F6C6962657865632F706C6174666F726D2D707974686F6E002F7573722F6C6962657865632F7268736D64 node=kvm-01-guest11.lab.eng.rdu2.redhat.com type=MMAP msg=audit(1610642323.727:320): fd=8 flags=0x1 node=kvm-01-guest11.lab.eng.rdu2.redhat.com type=SYSCALL msg=audit(1610642323.727:320): arch=c000003e syscall=9 success=no exit=-1 a0=0 a1=1000 a2=5 a3=1 items=0 ppid=1 pid=20562 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="rhsmd" exe="/usr/libexec/platform-python3.6" subj=system_u:system_r:rhsmcertd_t:s0-s0:c0.c1023 key=(null) node=kvm-01-guest11.lab.eng.rdu2.redhat.com type=AVC msg=audit(1610642323.727:320): avc: denied { execute } for pid=20562 comm="rhsmd" path=2F6465762F73686D2F23313038313631202864656C6574656429 dev="tmpfs" ino=108161 scontext=system_u:system_r:rhsmcertd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file permissive=1 node=kvm-01-guest11.lab.eng.rdu2.redhat.com type=AVC msg=audit(1610642323.727:320): avc: denied { map } for pid=20562 comm="rhsmd" path=2F6465762F73686D2F23313038313631202864656C6574656429 dev="tmpfs" ino=108161 scontext=system_u:system_r:rhsmcertd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file permissive=1 audit2allow says (decoded on fedora 33): #============= rhsmcertd_t ============== allow rhsmcertd_t tmpfs_t:file execute; #!!!! This avc can be allowed using the boolean 'domain_can_mmap_files' allow rhsmcertd_t tmpfs_t:file map; Version-Release number of selected component ============================================ selinux-policy-3.14.3-41.el8_2.8.noarch subscription-manager-1.26.20-1.el8_2.x86_64 How reproducible ================ Seen once after hardening using OpenSCAP and OSPP profile. Steps to Reproduce ================== 1. Install RHEL-7 2. Use RHSM to register to CDN 3. Upgrade to RHEL-8 4. Harden system using OpenSCAP and OSPP profile 5. subscription-manager unregister 6. Check AVC's Alternatively, run extended MORF test @hardening-ospp under murpy-ci https://liver3.brq.redhat.com/jenkins/view/OAMG/job/oamg-dispatch-upgmeta/build?delay=0sec using specially crafted jats-morft branch with removed oamg4307 hack (talk to OAMG-QE for details) in the BSPEC field. Actual results ============== AVCs Expected results ================ no AVCs Additional info =============== This seems to be specific to this hardening test; so far we've ran it with PROFILE=ospp: http://pkgs.devel.redhat.com/cgit/tests/scap-security-guide/tree/Upgrade/basic This issue is also tracked as: https://issues.redhat.com/browse/OAMG-4307