Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
DescriptionBrian J. Murrell
2022-01-31 15:07:11 UTC
SELinux is preventing /usr/bin/dccproc from map access on the file /etc/dcc/map.
***** Plugin catchall_boolean (89.3 confidence) suggests ******************
If you want to allow any process to mmap any file on system with attribute file_type.
Then you must tell SELinux about this by enabling the 'domain_can_mmap_files' boolean.
Do
setsebool -P domain_can_mmap_files 1
***** Plugin catchall (11.6 confidence) suggests **************************
If you believe that dccproc should be allowed map access on the map file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'dccproc' --raw | audit2allow -M my-dccproc
# semodule -X 300 -i my-dccproc.pp
Additional Information:
Source Context system_u:system_r:dcc_client_t:s0
Target Context system_u:object_r:dcc_client_map_t:s0
Target Objects /etc/dcc/map [ file ]
Source dccproc
Source Path /usr/bin/dccproc
Port <Unknown>
Host server.interlinx.bc.ca
Source RPM Packages DCC-1.3.145-25.el7.x86_64
Target RPM Packages DCC-1.3.145-25.el7.x86_64
SELinux Policy RPM selinux-policy-targeted-3.14.3-80.el8_5.2.noarch
Local Policy RPM selinux-policy-targeted-3.14.3-80.el8_5.2.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name server.interlinx.bc.ca
Platform Linux server.interlinx.bc.ca
4.18.0-348.12.2.el8_5.x86_64 #1 SMP Wed Jan 19
14:35:04 EST 2022 x86_64 x86_64
Alert Count 589
First Seen 2022-01-23 22:09:12 EST
Last Seen 2022-01-31 09:36:46 EST
Local ID 0e3cf098-a95a-4264-9e97-4334ad887784
Raw Audit Messages
type=AVC msg=audit(1643639806.283:1581): avc: denied { map } for pid=31008 comm="dccproc" path="/etc/dcc/map" dev="dm-4" ino=66731 scontext=system_u:system_r:dcc_client_t:s0 tcontext=system_u:object_r:dcc_client_map_t:s0 tclass=file permissive=0
type=SYSCALL msg=audit(1643639806.283:1581): arch=x86_64 syscall=mmap success=no exit=EACCES a0=0 a1=1e20 a2=3 a3=1 items=0 ppid=3923 pid=31008 auid=4294967295 uid=1001 gid=1001 euid=1001 suid=0 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=4294967295 comm=dccproc exe=/usr/bin/dccproc subj=system_u:system_r:dcc_client_t:s0 key=(null)
Hash: dccproc,dcc_client_t,dcc_client_map_t,file,map
This results in the following errors:
Jan 31 09:36:46 server dccproc[31008]: mmap(/etc/dcc/map): Permission denied
Jan 31 09:36:46 server dccproc[31008]: mmap(whiteclnt.dccx,42108): Permission denied
Jan 31 09:36:46 server spamd[3923]: dcc: instead of X-DCC header, dccproc returned 'mmap(/etc/dcc/map): Permission denied'
Per the above error messages, indeed, the following AVC is also exhibited:
type=AVC msg=audit(1643639806.283:1582): avc: denied { map } for pid=31008 comm="dccproc" path="/etc/dcc/whiteclnt.dccx" dev="dm-4" ino=65043 scontext=system_u:system_r:dcc_client_t:s0 tcontext=system_u:object_r:dcc_var_t:s0 tclass=file permissive=0
I haven't managed to find dccproc in RHEL repositories. Please reach out to the package vendor to get support for your issue.
If map is the only missing permission, the following module can be used to work around:
# cat local_dcc_var_map.cil
(allow dcc_client_t dcc_var_t (file (map)))
# semodule -i local_dcc_var_map.cil
So what is the policy (NPI) about SELinux policy rules that are required for software that is not in RHEL/EPEL?
Does the selinux-policy package try to maintain policy for all known software no matter where it comes from (it seems not given the response on this ticket) or are third-party software distributions supposed to supply SELinux policy modules with their software package?
If the latter, is any documentation available on how a software packager supplies their own policy modules in their packages?
Packages provided by Red Hat are supported.
Packages in EPEL are considered high-quality add-on packages that complement the Red Hat Enterprise Linux. The EPEL project is led by community-led volunteers, packages from this project are not provided by Red Hat though and therefore they are not supported.
The selinux-policy package in RHEL is based off of the package from Fedora. It contains modules for software in RHEL as well as for software which is not a part of RHEL (i. e. 3rd party) for the users convenience. However, it does not mean the policy modules are supported by Red Hat.
Some custom policy hints can be found e. g. here:
https://fedoraproject.org/wiki/SELinux/IndependentPolicyhttps://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/using_selinux/writing-a-custom-selinux-policy_using-selinux
SELinux is preventing /usr/bin/dccproc from map access on the file /etc/dcc/map. ***** Plugin catchall_boolean (89.3 confidence) suggests ****************** If you want to allow any process to mmap any file on system with attribute file_type. Then you must tell SELinux about this by enabling the 'domain_can_mmap_files' boolean. Do setsebool -P domain_can_mmap_files 1 ***** Plugin catchall (11.6 confidence) suggests ************************** If you believe that dccproc should be allowed map access on the map file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'dccproc' --raw | audit2allow -M my-dccproc # semodule -X 300 -i my-dccproc.pp Additional Information: Source Context system_u:system_r:dcc_client_t:s0 Target Context system_u:object_r:dcc_client_map_t:s0 Target Objects /etc/dcc/map [ file ] Source dccproc Source Path /usr/bin/dccproc Port <Unknown> Host server.interlinx.bc.ca Source RPM Packages DCC-1.3.145-25.el7.x86_64 Target RPM Packages DCC-1.3.145-25.el7.x86_64 SELinux Policy RPM selinux-policy-targeted-3.14.3-80.el8_5.2.noarch Local Policy RPM selinux-policy-targeted-3.14.3-80.el8_5.2.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name server.interlinx.bc.ca Platform Linux server.interlinx.bc.ca 4.18.0-348.12.2.el8_5.x86_64 #1 SMP Wed Jan 19 14:35:04 EST 2022 x86_64 x86_64 Alert Count 589 First Seen 2022-01-23 22:09:12 EST Last Seen 2022-01-31 09:36:46 EST Local ID 0e3cf098-a95a-4264-9e97-4334ad887784 Raw Audit Messages type=AVC msg=audit(1643639806.283:1581): avc: denied { map } for pid=31008 comm="dccproc" path="/etc/dcc/map" dev="dm-4" ino=66731 scontext=system_u:system_r:dcc_client_t:s0 tcontext=system_u:object_r:dcc_client_map_t:s0 tclass=file permissive=0 type=SYSCALL msg=audit(1643639806.283:1581): arch=x86_64 syscall=mmap success=no exit=EACCES a0=0 a1=1e20 a2=3 a3=1 items=0 ppid=3923 pid=31008 auid=4294967295 uid=1001 gid=1001 euid=1001 suid=0 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=4294967295 comm=dccproc exe=/usr/bin/dccproc subj=system_u:system_r:dcc_client_t:s0 key=(null) Hash: dccproc,dcc_client_t,dcc_client_map_t,file,map This results in the following errors: Jan 31 09:36:46 server dccproc[31008]: mmap(/etc/dcc/map): Permission denied Jan 31 09:36:46 server dccproc[31008]: mmap(whiteclnt.dccx,42108): Permission denied Jan 31 09:36:46 server spamd[3923]: dcc: instead of X-DCC header, dccproc returned 'mmap(/etc/dcc/map): Permission denied' Per the above error messages, indeed, the following AVC is also exhibited: type=AVC msg=audit(1643639806.283:1582): avc: denied { map } for pid=31008 comm="dccproc" path="/etc/dcc/whiteclnt.dccx" dev="dm-4" ino=65043 scontext=system_u:system_r:dcc_client_t:s0 tcontext=system_u:object_r:dcc_var_t:s0 tclass=file permissive=0