Bug 2063181
| Summary: | AVC check fail for running chronyc | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Radek Duda <rduda> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED DUPLICATE | QA Contact: | Milos Malik <mmalik> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 8.2 | CC: | lvrabec, mmalik, ssekidde |
| Target Milestone: | rc | Flags: | pm-rhel:
mirror+
|
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-03-14 14:05:22 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
This issue was fixed in RHEL-8.3. Here is the relevant bug: * https://bugzilla.redhat.com/show_bug.cgi?id=1872304 This is a by-product of sos testing. (In reply to Radek Duda from comment #3) > This is a by-product of sos testing. Closing this bz then a dup of 1772852. If it needs to be backported to 8.2, start the accelerated process for the parent bz#1772852. *** This bug has been marked as a duplicate of bug 1772852 *** |
Description of problem: AVC check for chronyc fails: SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: enforcing Mode from config file: enforcing Policy MLS status: enabled Policy deny_unknown status: allowed Memory protection checking: actual (secure) Max kernel policy version: 31 selinux-policy-3.14.3-41.el8_2.9.noarch ---- time->Thu Aug 12 12:22:55 2021 type=PROCTITLE msg=audit(1628785375.500:314): proctitle=6368726F6E796300747261636B696E67 type=SYSCALL msg=audit(1628785375.500:314): arch=c000003e syscall=41 success=no exit=-13 a0=2 a1=80001 a2=0 a3=7ffd74b801b9 items=0 ppid=119734 pid=119735 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="chronyc" exe="/usr/bin/chronyc" subj=unconfined_u:unconfined_r:chronyc_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1628785375.500:314): avc: denied { create } for pid=119735 comm="chronyc" scontext=unconfined_u:unconfined_r:chronyc_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chronyc_t:s0-s0:c0.c1023 tclass=tcp_socket permissive=0 ---- time->Thu Aug 12 12:22:55 2021 type=PROCTITLE msg=audit(1628785375.661:315): proctitle=6368726F6E796300736F757263657374617473 type=SYSCALL msg=audit(1628785375.661:315): arch=c000003e syscall=41 success=no exit=-13 a0=2 a1=80001 a2=0 a3=7ffc0a41a8f9 items=0 ppid=119749 pid=119750 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="chronyc" exe="/usr/bin/chronyc" subj=unconfined_u:unconfined_r:chronyc_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1628785375.661:315): avc: denied { create } for pid=119750 comm="chronyc" scontext=unconfined_u:unconfined_r:chronyc_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chronyc_t:s0-s0:c0.c1023 tclass=tcp_socket permissive=0 ---- time->Thu Aug 12 12:22:55 2021 type=PROCTITLE msg=audit(1628785375.663:316): proctitle=6368726F6E796300736F757263657374617473 type=SYSCALL msg=audit(1628785375.663:316): arch=c000003e syscall=41 success=no exit=-13 a0=2 a1=80001 a2=0 a3=7ffc0a41a8f9 items=0 ppid=119749 pid=119750 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="chronyc" exe="/usr/bin/chronyc" subj=unconfined_u:unconfined_r:chronyc_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1628785375.663:316): avc: denied { create } for pid=119750 comm="chronyc" scontext=unconfined_u:unconfined_r:chronyc_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:chronyc_t:s0-s0:c0.c1023 tclass=tcp_socket permissive=0 Version-Release number of selected component (if applicable): selinux-policy-3.14.3-41.el8_2.9.noarch https://beaker.engineering.redhat.com/recipes/10484519/tasks/130391857/results/614656615/logs/avc.log