Bug 2006294

Summary: AVC denial while installing ipa-server on aarch64 in FIPS mode
Product: Red Hat Enterprise Linux 8 Reporter: Mohammad Rizwan <myusuf>
Component: ipaAssignee: Thomas Woerner <twoerner>
Status: CLOSED NOTABUG QA Contact: ipa-qe <ipa-qe>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 8.5CC: abokovoy, rcritten, tscherf
Target Milestone: rcFlags: pm-rhel: mirror+
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-09-21 13:27:02 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Mohammad Rizwan 2021-09-21 12:37:41 UTC
Description of problem:
AVC denial observed while installing ipa-server on aarch64 

Version-Release number of selected component (if applicable):
ipa-server-4.9.6-6.module+el8.5.0+12660+88e16a2c.aarch64

How reproducible:
always

Steps to Reproduce:
1. enable fips mode
2. ipa-server-install --setup-dns --forwarder xx.xx.xx.xx --domain testrelm.test --realm TESTRELM.TEST --admin-password Secret123 --ds-password Secret123 -U --reverse-zone xx.xx.xx.in-addr.arpa. --allow-zone-overlap --domain-level=1
3. ausearch -m avc

Actual results:
[root@master ~]# ausearch -m avc
----
time->Tue Sep 21 07:38:18 2021
type=PROCTITLE msg=audit(1632224298.051:388): proctitle=2F7573722F7362696E2F73737364002D69002D2D6C6F676765723D66696C6573
type=SYSCALL msg=audit(1632224298.051:388): arch=c00000b7 syscall=27 success=no exit=-13 a0=0 a1=aaab1bea2c30 a2=8d88 a3=a items=0 ppid=1 pid=1103 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sssd" exe="/usr/sbin/sssd" subj=system_u:system_r:sssd_t:s0 key=(null)
type=AVC msg=audit(1632224298.051:388): avc:  denied  { read } for  pid=1103 comm="sssd" name="resolv.conf" dev="dm-0" ino=799878 scontext=system_u:system_r:sssd_t:s0 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file permissive=0


Expected results:
no avc denial

Additional info:

Comment 1 Alexander Bokovoy 2021-09-21 13:27:02 UTC
This looks like a bug in test environment rather than an AVC in the product. Someone modified /etc/resolv.conf as root and copied it over from /root because it now has admin_home_t context. This is wrong context for /etc/resolv.conf and the AVC is correct.

I think it is not a bug.