Bug 2058914

I ran the following to allow the rngd setgid capability
sudo ausearch -c 'rngd' --raw | audit2allow -M my-rngd 
sudo semodule -X 300 -i my-rngd.pp

I restarted rngd.service with sudo systemctl restart rngd. rngd was denied using the setuid capability which made rngd.service fail to start.

Feb 26 16:59:34 systemd[1]: Started rngd.service - Hardware RNG Entropy Gatherer Daemon.
Feb 26 16:59:34 audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=rngd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Feb 26 16:59:34 sudo[4356]: pam_unix(sudo:session): session closed for user root
Feb 26 16:59:34 audit[4356]: USER_END pid=4356 uid=1000 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_keyinit,pam_limits,pam_keyinit,pam_limits,pam_systemd,pam_unix acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Feb 26 16:59:34 audit[4356]: CRED_DISP pid=4356 uid=1000 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_fprintd acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Feb 26 16:59:34 rngd[4359]: Disabling 7: PKCS11 Entropy generator (pkcs11)
Feb 26 16:59:34 rngd[4359]: Disabling 5: NIST Network Entropy Beacon (nist)
Feb 26 16:59:34 rngd[4359]: Initializing available sources
Feb 26 16:59:34 rngd[4359]: [hwrng ]: Initialization Failed
Feb 26 16:59:34 rngd[4359]: [rdrand]: Initialization Failed
Feb 26 16:59:34 rngd[4359]: [jitter]: Initializing AES buffer
Feb 26 16:59:37 rngd[4359]: [jitter]: Enabling JITTER rng support
Feb 26 16:59:37 rngd[4359]: [jitter]: Initialized
Feb 26 16:59:37 rngd[4359]: [rtlsdr]: Initialization Failed
Feb 26 16:59:37 audit[4359]: AVC avc:  denied  { setuid } for  pid=4359 comm="rngd" capability=7  scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:system_r:rngd_t:s0 tclass=capability permissive=0
Feb 26 16:59:37 audit[4359]: AVC avc:  denied  { setuid } for  pid=4359 comm="rngd" capability=7  scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:system_r:rngd_t:s0 tclass=capability permissive=0
Feb 26 16:59:37 audit[4359]: AVC avc:  denied  { setuid } for  pid=4359 comm="rngd" capability=7  scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:system_r:rngd_t:s0 tclass=capability permissive=0
Feb 26 16:59:37 audit[4359]: AVC avc:  denied  { setuid } for  pid=4359 comm="rngd" capability=7  scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:system_r:rngd_t:s0 tclass=capability permissive=0
Feb 26 16:59:37 audit[4359]: AVC avc:  denied  { setuid } for  pid=4359 comm="rngd" capability=7  scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:system_r:rngd_t:s0 tclass=capability permissive=0
Feb 26 16:59:37 rngd[4359]: setresuid() failed: Operation not permitted
Feb 26 16:59:37 systemd[1]: rngd.service: Main process exited, code=exited, status=1/FAILURE
Feb 26 16:59:37 systemd[1]: rngd.service: Failed with result 'exit-code'.
Feb 26 16:59:38 audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=rngd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
Feb 26 16:59:38 systemd[1]: rngd.service: Consumed 15.588s CPU time.

I ran the following to allow the rngd setuid capability
sudo ausearch -c 'rngd' --raw | audit2allow -M my-rngd 
sudo semodule -X 300 -i my-rngd.pp

I restarted rngd.service with sudo systemctl restart rngd. rngd was denied using setcap to set the CAP_SYS_ADMIN capability which made rngd.service fail to start.

Feb 26 17:03:15 systemd[1]: Started rngd.service - Hardware RNG Entropy Gatherer Daemon.
Feb 26 17:03:15 audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=rngd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Feb 26 17:03:15 sudo[4494]: pam_unix(sudo:session): session closed for user root
Feb 26 17:03:15 audit[4494]: USER_END pid=4494 uid=1000 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_keyinit,pam_limits,pam_keyinit,pam_limits,pam_systemd,pam_unix acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Feb 26 17:03:15 audit[4494]: CRED_DISP pid=4494 uid=1000 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_fprintd acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Feb 26 17:03:15 rngd[4497]: Disabling 7: PKCS11 Entropy generator (pkcs11)
Feb 26 17:03:15 rngd[4497]: Disabling 5: NIST Network Entropy Beacon (nist)
Feb 26 17:03:15 rngd[4497]: Initializing available sources
Feb 26 17:03:15 rngd[4497]: [hwrng ]: Initialization Failed
Feb 26 17:03:15 rngd[4497]: [rdrand]: Initialization Failed
Feb 26 17:03:15 rngd[4497]: [jitter]: Initializing AES buffer
Feb 26 17:03:19 rngd[4497]: [jitter]: Enabling JITTER rng support
Feb 26 17:03:19 rngd[4497]: [jitter]: Initialized
Feb 26 17:03:19 rngd[4497]: [rtlsdr]: Initialization Failed
Feb 26 17:03:19 rngd[4497]: Cannot set CAP_SYS_ADMIN capability: Permission denied
Feb 26 17:03:19 audit[4497]: AVC avc:  denied  { setcap } for  pid=4497 comm="rngd" scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:system_r:rngd_t:s0 tclass=process permissive=0
Feb 26 17:03:19 systemd[1]: rngd.service: Main process exited, code=exited, status=1/FAILURE
Feb 26 17:03:19 systemd[1]: rngd.service: Failed with result 'exit-code'.
Feb 26 17:03:19 audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=rngd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
Feb 26 17:03:19 systemd[1]: rngd.service: Consumed 15.595s CPU time.

I ran the following to allow rngd to use setcap
sudo ausearch -c 'rngd' --raw | audit2allow -M my-rngd 
sudo semodule -X 300 -i my-rngd.pp

rngd.service started with the uid:gid daemon:daemon after that as changed in rngd.sysconfig at https://src.fedoraproject.org/rpms/rng-tools/c/51036602f71a3a117389aa5acb92adc1c29d1487?branch=f36

hi Matt,
thanks a ton for your report, it helps a lot. indeed, rngd was updated with a code that drops privileges so rngd process
runs as non-root user. uid/gid/cap-changing syscalls are used for that. the selinux part indeed has the above issues. this
will be fixed, for now i can thing of the following workarounds:

1) your workaround with audit2allow/semodule
2) remove "-D daemon:daemon" from /etc/sysconfig/rngd. this will make rngd to run as root as before.
3) downgrade to the previous v6.14 rng-tools. the update was unpushed so fedora repos should have the previous v6.14 version.

thanks again, your help and report are much appreciated!

*** Bug 2059166 has been marked as a duplicate of this bug. ***

Instead of adding the permission I updated the service unit the following:

# cat /etc/sysconfig/rngd
# Optional arguments passed to rngd. See rngd(8) and
# https://bugzilla.redhat.com/show_bug.cgi?id=1252175#c21
#RNGD_ARGS="-x pkcs11 -x nist -D daemon:daemon"
RNGD_ARGS="-x pkcs11 -x nist"

# systemctl cat rngd
# /etc/systemd/system/rngd.service
[Unit]
Description=Hardware RNG Entropy Gatherer Daemon
ConditionVirtualization=!container

# The "-f" option is required for the systemd service rngd to work with Type=simple
[Service]
Type=simple
EnvironmentFile=/etc/sysconfig/rngd
ExecStart=/usr/sbin/rngd -f $RNGD_ARGS
User=daemon
Group=daemon

[Install]
WantedBy=multi-user.target

# systemctl restart rngd; systemctl status rngd; ps -eo pid,ppid,euid,egid,command,context | grep -e COMMAND -e rngd
● rngd.service - Hardware RNG Entropy Gatherer Daemon
     Loaded: loaded (/etc/systemd/system/rngd.service; enabled; vendor preset: enabled)
     Active: active (running) since Tue 2022-03-01 06:34:45 EST; 79ms ago
   Main PID: 706 (rngd)
      Tasks: 2 (limit: 2297)
     Memory: 1.2M
        CPU: 33ms
     CGroup: /system.slice/rngd.service
             └─706 /usr/sbin/rngd -f -x pkcs11 -x nist

Mar 01 06:34:45 fedora systemd[1]: Started rngd.service - Hardware RNG Entropy Gatherer Daemon.
Mar 01 06:34:45 fedora rngd[706]: Disabling 7: PKCS11 Entropy generator (pkcs11)
Mar 01 06:34:45 fedora rngd[706]: Disabling 5: NIST Network Entropy Beacon (nist)
Mar 01 06:34:45 fedora rngd[706]: Initializing available sources
Mar 01 06:34:45 fedora rngd[706]: [hwrng ]: Initialization Failed
Mar 01 06:34:45 fedora rngd[706]: [rdrand]: Enabling RDSEED rng support
Mar 01 06:34:45 fedora rngd[706]: [rdrand]: Initialized
    PID    PPID  EUID  EGID COMMAND                     CONTEXT
    706       1     2     2 /usr/sbin/rngd -f -x pkcs11 system_u:system_r:rngd_t:s0

# ausearch -i -m avc,user_avc -ts boot
<no matches>


Does this solve your problem?

(In reply to Zdenek Pytela from comment #4)
> Does this solve your problem?

unfortunately, not:

Mar 01 06:34:45 fedora rngd[706]: [hwrng ]: Initialization Failed

rngd should start as root and then drop privileges via setuid/setgid/setcap.

Caught in enforcing mode:
----
type=PROCTITLE msg=audit(03/02/2022 15:45:22.382:572) : proctitle=/usr/sbin/rngd -f -x pkcs11 -x nist -D daemon:daemon 
type=SYSCALL msg=audit(03/02/2022 15:45:22.382:572) : arch=x86_64 syscall=setgroups success=no exit=EPERM(Operation not permitted) a0=0x1 a1=0x7ffd37ac9300 a2=0x7f5c649e8c91 a3=0x7ffd37ba7080 items=0 ppid=1 pid=1551 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=rngd exe=/usr/sbin/rngd subj=system_u:system_r:rngd_t:s0 key=(null) 
type=AVC msg=audit(03/02/2022 15:45:22.382:572) : avc:  denied  { setgid } for  pid=1551 comm=rngd capability=setgid  scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:system_r:rngd_t:s0 tclass=capability permissive=0 
----

# rpm -qa selinux\* rng\* | sort
rng-tools-6.15-1.fc37.x86_64
selinux-policy-36.4-1.fc37.noarch
selinux-policy-targeted-36.4-1.fc37.noarch
#

Caught in permissive mode:
----
type=PROCTITLE msg=audit(03/02/2022 15:48:29.403:578) : proctitle=/usr/sbin/rngd -f -x pkcs11 -x nist -D daemon:daemon 
type=SYSCALL msg=audit(03/02/2022 15:48:29.403:578) : arch=x86_64 syscall=setgroups success=yes exit=0 a0=0x1 a1=0x7ffe67d8ad70 a2=0x7f4b3aedac91 a3=0x7ffe67db2080 items=0 ppid=1 pid=1581 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=rngd exe=/usr/sbin/rngd subj=system_u:system_r:rngd_t:s0 key=(null) 
type=AVC msg=audit(03/02/2022 15:48:29.403:578) : avc:  denied  { setgid } for  pid=1581 comm=rngd capability=setgid  scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:system_r:rngd_t:s0 tclass=capability permissive=1 
----
type=PROCTITLE msg=audit(03/02/2022 15:48:29.404:579) : proctitle=/usr/sbin/rngd -f -x pkcs11 -x nist -D daemon:daemon 
type=SYSCALL msg=audit(03/02/2022 15:48:29.404:579) : arch=x86_64 syscall=setresuid success=yes exit=0 a0=daemon a1=daemon a2=daemon a3=0x7ffe67db2080 items=0 ppid=1 pid=1581 auid=unset uid=daemon gid=daemon euid=daemon suid=daemon fsuid=daemon egid=daemon sgid=daemon fsgid=daemon tty=(none) ses=unset comm=rngd exe=/usr/sbin/rngd subj=system_u:system_r:rngd_t:s0 key=(null) 
type=AVC msg=audit(03/02/2022 15:48:29.404:579) : avc:  denied  { setuid } for  pid=1581 comm=rngd capability=setuid  scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:system_r:rngd_t:s0 tclass=capability permissive=1 
----
type=PROCTITLE msg=audit(03/02/2022 15:48:29.404:580) : proctitle=/usr/sbin/rngd -f -x pkcs11 -x nist -D daemon:daemon 
type=CAPSET msg=audit(03/02/2022 15:48:29.404:580) : pid=1581 cap_pi=sys_admin cap_pp=sys_admin cap_pe=sys_admin cap_pa=none 
type=SYSCALL msg=audit(03/02/2022 15:48:29.404:580) : arch=x86_64 syscall=capset success=yes exit=0 a0=0x55da4a18cd04 a1=0x55da4a18cd0c a2=0x55da4a18cd0c a3=0x7ffe67d8ad94 items=0 ppid=1 pid=1581 auid=unset uid=daemon gid=daemon euid=daemon suid=daemon fsuid=daemon egid=daemon sgid=daemon fsgid=daemon tty=(none) ses=unset comm=rngd exe=/usr/sbin/rngd subj=system_u:system_r:rngd_t:s0 key=(null) 
type=AVC msg=audit(03/02/2022 15:48:29.404:580) : avc:  denied  { setcap } for  pid=1581 comm=rngd scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:system_r:rngd_t:s0 tclass=process permissive=1 
----

thanks, Milos,
indeed, selinux should allow rngd process to perform: setuid , setgid and setcap.
there is a work being done for that and selinux policy will be updated.
thank you for your report!

I've submitted a Fedora PR to address the issue:
https://github.com/fedora-selinux/selinux-policy/pull/1104

rpms for testing can be downloaded from the PR:
Checks -> Details -> Artifacts -> rpms

i can confirm rngd.service works now in fedora-rawhide with the test selinux packages:

WITHOUT:

Installed Packages
selinux-policy.noarch            36.4-1.fc37     @rawhide
selinux-policy-targeted.noarch   36.4-1.fc37     @rawhide

Mar 08 14:51:51 fe34.vsd.localdomain rngd[736]: Initializing available sources
Mar 08 14:51:51 fe34.vsd.localdomain rngd[736]: [hwrng ]: Initialized
Mar 08 14:51:51 fe34.vsd.localdomain rngd[736]: [rdrand]: Enabling RDRAND rng support
Mar 08 14:51:51 fe34.vsd.localdomain rngd[736]: [rdrand]: Initialized
Mar 08 14:51:51 fe34.vsd.localdomain rngd[736]: [rtlsdr]: Initialization Failed
Mar 08 14:51:51 fe34.vsd.localdomain rngd[736]: setgroups() failed: Operation not permitted
Mar 08 14:51:51 fe34.vsd.localdomain systemd[1]: rngd.service: Main process exited, code=exited, status=1/FAILURE
Mar 08 14:51:51 fe34.vsd.localdomain systemd[1]: rngd.service: Failed with result 'exit-code'.

type=SERVICE_START msg=audit(1646747554.685:254): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=rngd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset"
type=AVC msg=audit(1646747554.705:255): avc:  denied  { setgid } for  pid=749 comm="rngd" capability=6  scontext=system_u:system_r:rngd_t:s0 tcontext=system_u:system_r:rngd_t:s0 tclass=capability permissive=0

WITH:

Installed Packages
selinux-policy.noarch            36.4-1.20220303_160230.eb1cb79.fc36     @@commandline
selinux-policy-targeted.noarch   36.4-1.20220303_160230.eb1cb79.fc36     @@commandline

Mar 08 15:05:18 fe34.vsd.localdomain rngd[1810]: Initializing available sources
Mar 08 15:05:18 fe34.vsd.localdomain rngd[1810]: [hwrng ]: Initialized
Mar 08 15:05:18 fe34.vsd.localdomain rngd[1810]: [rdrand]: Enabling RDRAND rng support
Mar 08 15:05:18 fe34.vsd.localdomain rngd[1810]: [rdrand]: Initialized
Mar 08 15:05:18 fe34.vsd.localdomain rngd[1810]: [rtlsdr]: Initialization Failed
Mar 08 15:05:18 fe34.vsd.localdomain rngd[1810]: Process privileges have been dropped to 2:2

# ps -ef | grep rngd
daemon      1810       1  0 15:05 ?        00:00:00 /usr/sbin/rngd -f -x pkcs11 -x nist -x jitter -D daemon:daemon

Zdenek, any idea when this PR could be merged and gets to Rawhide and F36?

FEDORA-2022-b0805acc47 has been submitted as an update to Fedora 36. https://bodhi.fedoraproject.org/updates/FEDORA-2022-b0805acc47

selinux-policy-36.5-1 was published for F37 and F36:

https://bodhi.fedoraproject.org/updates/FEDORA-2022-7d08b012c3
https://bodhi.fedoraproject.org/updates/FEDORA-2022-b0805acc47

rng-tools package will be updated to require this release of selinux
rules after these updates get to a testing repo.

FEDORA-2022-b0805acc47 has been pushed to the Fedora 36 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2022-b0805acc47`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2022-b0805acc47

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

FEDORA-2022-b0805acc47 has been pushed to the Fedora 36 stable repository.
If problem still persists, please make note of it in this bug report.