Bug 2048592
| Summary: | SELinux is preventing /usr/bin/dccproc from map access on the file /etc/dcc/map | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Brian J. Murrell <brian> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED NOTABUG | QA Contact: | BaseOS QE Security Team <qe-baseos-security> |
| Severity: | urgent | Docs Contact: | |
| Priority: | medium | ||
| Version: | 8.5 | CC: | lvrabec, mmalik, ssekidde |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | 8.6 | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-02-04 16:13:47 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
I haven't managed to find dccproc in RHEL repositories. Please reach out to the package vendor to get support for your issue. If map is the only missing permission, the following module can be used to work around: # cat local_dcc_var_map.cil (allow dcc_client_t dcc_var_t (file (map))) # semodule -i local_dcc_var_map.cil So what is the policy (NPI) about SELinux policy rules that are required for software that is not in RHEL/EPEL? Does the selinux-policy package try to maintain policy for all known software no matter where it comes from (it seems not given the response on this ticket) or are third-party software distributions supposed to supply SELinux policy modules with their software package? If the latter, is any documentation available on how a software packager supplies their own policy modules in their packages? Packages provided by Red Hat are supported. Packages in EPEL are considered high-quality add-on packages that complement the Red Hat Enterprise Linux. The EPEL project is led by community-led volunteers, packages from this project are not provided by Red Hat though and therefore they are not supported. The selinux-policy package in RHEL is based off of the package from Fedora. It contains modules for software in RHEL as well as for software which is not a part of RHEL (i. e. 3rd party) for the users convenience. However, it does not mean the policy modules are supported by Red Hat. Some custom policy hints can be found e. g. here: https://fedoraproject.org/wiki/SELinux/IndependentPolicy https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/using_selinux/writing-a-custom-selinux-policy_using-selinux |
SELinux is preventing /usr/bin/dccproc from map access on the file /etc/dcc/map. ***** Plugin catchall_boolean (89.3 confidence) suggests ****************** If you want to allow any process to mmap any file on system with attribute file_type. Then you must tell SELinux about this by enabling the 'domain_can_mmap_files' boolean. Do setsebool -P domain_can_mmap_files 1 ***** Plugin catchall (11.6 confidence) suggests ************************** If you believe that dccproc should be allowed map access on the map file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'dccproc' --raw | audit2allow -M my-dccproc # semodule -X 300 -i my-dccproc.pp Additional Information: Source Context system_u:system_r:dcc_client_t:s0 Target Context system_u:object_r:dcc_client_map_t:s0 Target Objects /etc/dcc/map [ file ] Source dccproc Source Path /usr/bin/dccproc Port <Unknown> Host server.interlinx.bc.ca Source RPM Packages DCC-1.3.145-25.el7.x86_64 Target RPM Packages DCC-1.3.145-25.el7.x86_64 SELinux Policy RPM selinux-policy-targeted-3.14.3-80.el8_5.2.noarch Local Policy RPM selinux-policy-targeted-3.14.3-80.el8_5.2.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name server.interlinx.bc.ca Platform Linux server.interlinx.bc.ca 4.18.0-348.12.2.el8_5.x86_64 #1 SMP Wed Jan 19 14:35:04 EST 2022 x86_64 x86_64 Alert Count 589 First Seen 2022-01-23 22:09:12 EST Last Seen 2022-01-31 09:36:46 EST Local ID 0e3cf098-a95a-4264-9e97-4334ad887784 Raw Audit Messages type=AVC msg=audit(1643639806.283:1581): avc: denied { map } for pid=31008 comm="dccproc" path="/etc/dcc/map" dev="dm-4" ino=66731 scontext=system_u:system_r:dcc_client_t:s0 tcontext=system_u:object_r:dcc_client_map_t:s0 tclass=file permissive=0 type=SYSCALL msg=audit(1643639806.283:1581): arch=x86_64 syscall=mmap success=no exit=EACCES a0=0 a1=1e20 a2=3 a3=1 items=0 ppid=3923 pid=31008 auid=4294967295 uid=1001 gid=1001 euid=1001 suid=0 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=4294967295 comm=dccproc exe=/usr/bin/dccproc subj=system_u:system_r:dcc_client_t:s0 key=(null) Hash: dccproc,dcc_client_t,dcc_client_map_t,file,map This results in the following errors: Jan 31 09:36:46 server dccproc[31008]: mmap(/etc/dcc/map): Permission denied Jan 31 09:36:46 server dccproc[31008]: mmap(whiteclnt.dccx,42108): Permission denied Jan 31 09:36:46 server spamd[3923]: dcc: instead of X-DCC header, dccproc returned 'mmap(/etc/dcc/map): Permission denied' Per the above error messages, indeed, the following AVC is also exhibited: type=AVC msg=audit(1643639806.283:1582): avc: denied { map } for pid=31008 comm="dccproc" path="/etc/dcc/whiteclnt.dccx" dev="dm-4" ino=65043 scontext=system_u:system_r:dcc_client_t:s0 tcontext=system_u:object_r:dcc_var_t:s0 tclass=file permissive=0