Bug 2063181

Summary: AVC check fail for running chronyc
Product: Red Hat Enterprise Linux 8 Reporter: Radek Duda <rduda>
Component: selinux-policyAssignee: Zdenek Pytela <zpytela>
Status: CLOSED DUPLICATE QA Contact: Milos Malik <mmalik>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 8.2CC: lvrabec, mmalik, ssekidde
Target Milestone: rcFlags: pm-rhel: mirror+
Target Release: ---   
Hardware: Unspecified   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2022-03-14 14:05:22 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Radek Duda 2022-03-11 13:05:22 UTC
Description of problem:

AVC check for chronyc fails:

SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      31
selinux-policy-3.14.3-41.el8_2.9.noarch
----
time->Thu Aug 12 12:22:55 2021
type=PROCTITLE msg=audit(1628785375.500:314): proctitle=6368726F6E796300747261636B696E67
type=SYSCALL msg=audit(1628785375.500:314): arch=c000003e syscall=41 success=no exit=-13 a0=2 a1=80001 a2=0 a3=7ffd74b801b9 items=0 ppid=119734 pid=119735 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="chronyc" exe="/usr/bin/chronyc" subj=unconfined_u:unconfined_r:chronyc_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1628785375.500:314): avc:  denied  { create } for  pid=119735 comm="chronyc" scontext=unconfined_u:unconfined_r:chronyc_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chronyc_t:s0-s0:c0.c1023 tclass=tcp_socket permissive=0
----
time->Thu Aug 12 12:22:55 2021
type=PROCTITLE msg=audit(1628785375.661:315): proctitle=6368726F6E796300736F757263657374617473
type=SYSCALL msg=audit(1628785375.661:315): arch=c000003e syscall=41 success=no exit=-13 a0=2 a1=80001 a2=0 a3=7ffc0a41a8f9 items=0 ppid=119749 pid=119750 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="chronyc" exe="/usr/bin/chronyc" subj=unconfined_u:unconfined_r:chronyc_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1628785375.661:315): avc:  denied  { create } for  pid=119750 comm="chronyc" scontext=unconfined_u:unconfined_r:chronyc_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chronyc_t:s0-s0:c0.c1023 tclass=tcp_socket permissive=0
----
time->Thu Aug 12 12:22:55 2021
type=PROCTITLE msg=audit(1628785375.663:316): proctitle=6368726F6E796300736F757263657374617473
type=SYSCALL msg=audit(1628785375.663:316): arch=c000003e syscall=41 success=no exit=-13 a0=2 a1=80001 a2=0 a3=7ffc0a41a8f9 items=0 ppid=119749 pid=119750 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="chronyc" exe="/usr/bin/chronyc" subj=unconfined_u:unconfined_r:chronyc_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1628785375.663:316): avc:  denied  { create } for  pid=119750 comm="chronyc" scontext=unconfined_u:unconfined_r:chronyc_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chronyc_t:s0-s0:c0.c1023 tclass=tcp_socket permissive=0

Version-Release number of selected component (if applicable):
selinux-policy-3.14.3-41.el8_2.9.noarch


https://beaker.engineering.redhat.com/recipes/10484519/tasks/130391857/results/614656615/logs/avc.log

Comment 2 Milos Malik 2022-03-11 15:10:46 UTC
This issue was fixed in RHEL-8.3. Here is the relevant bug:
 * https://bugzilla.redhat.com/show_bug.cgi?id=1872304

Comment 3 Radek Duda 2022-03-11 16:43:15 UTC
This is a by-product of sos testing.

Comment 4 Zdenek Pytela 2022-03-14 14:05:22 UTC
(In reply to Radek Duda from comment #3)
> This is a by-product of sos testing.

Closing this bz then a dup of 1772852. If it needs to be backported to 8.2, start the accelerated process for the parent bz#1772852.

*** This bug has been marked as a duplicate of bug 1772852 ***