Bug 2077017

Summary:	pulpcore_t and pulpcore_server_t domains are prevented to access unconfined_service_t:key
Product:	Red Hat Satellite	Reporter:	Lukas Pramuk <lpramuk>
Component:	Pulp	Assignee:	satellite6-bugs <satellite6-bugs>
Status:	CLOSED INSUFFICIENT_DATA	QA Contact:	Lukas Pramuk <lpramuk>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	6.11.0	CC:	dalley, lzap, mdepaulo
Target Milestone:	Unspecified	Keywords:	Triaged
Target Release:	Unused
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-10-19 19:33:42 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Lukas Pramuk 2022-04-20 13:32:21 UTC

This bug was initially created as a copy of Bug #2051522

I am copying this bug because: 
There are some new pulpcore denials on RHEL8 only


Description of problem:
pulpcore_t and pulpcore_server_t domains are prevented to access unconfined_service_t:key
audit.log is being filled with these denials continuously.


Version-Release number of selected component (if applicable):
Satellite 6.11.0 Snap16 EL8
pulpcore-selinux-1.3.0-1.el8pc.x86_64

How reproducible:
deterministic

Steps to Reproduce:
1. Have a Satellite
2. Check for denials

# audit2allow -a

#============= pulpcore_server_t ==============
allow pulpcore_server_t unconfined_service_t:key { read view };

#============= pulpcore_t ==============
allow pulpcore_t unconfined_service_t:key { read view };


Actual results:
selinux denials present

Expected results:
no selinux denials

Comment 2 Lukas Pramuk 2022-04-20 13:39:50 UTC

type=AVC msg=audit(1650321566.857:1258): avc:  denied  { read } for  pid=21313 comm="gunicorn" scontext=system_u:system_r:pulpcore_server_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=key permissive=1
type=AVC msg=audit(1650321566.857:1259): avc:  denied  { view } for  pid=21313 comm="gunicorn" scontext=system_u:system_r:pulpcore_server_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=key permissive=1
type=AVC msg=audit(1650364777.880:2144): avc:  denied  { read } for  pid=21313 comm="gunicorn" scontext=system_u:system_r:pulpcore_server_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=key permissive=1
type=AVC msg=audit(1650364777.880:2145): avc:  denied  { view } for  pid=21313 comm="gunicorn" scontext=system_u:system_r:pulpcore_server_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=key permissive=1
type=AVC msg=audit(1650407988.843:2922): avc:  denied  { read } for  pid=21320 comm="gunicorn" scontext=system_u:system_r:pulpcore_server_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=key permissive=1
type=AVC msg=audit(1650407988.843:2923): avc:  denied  { view } for  pid=21320 comm="gunicorn" scontext=system_u:system_r:pulpcore_server_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=key permissive=1
type=AVC msg=audit(1650451201.570:3716): avc:  denied  { read } for  pid=21313 comm="gunicorn" scontext=system_u:system_r:pulpcore_server_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=key permissive=1
type=AVC msg=audit(1650451201.570:3717): avc:  denied  { view } for  pid=21313 comm="gunicorn" scontext=system_u:system_r:pulpcore_server_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=key permissive=1

Comment 3 Mike DePaulo 2022-04-20 16:00:24 UTC

Hi, I need the filepath in order to investigate this further. Or access to the system.

The filepath can probably be found with `ausearch -m avc`.

Comment 4 Brad Buckingham 2022-05-05 12:43:01 UTC

Adding a needinfo on the reporter based upon comment 3.

Comment 5 Lukas Pramuk 2022-05-17 11:04:14 UTC

I can't get a reproducer machine as I'm not able to reproduce on fresh 6.11 EL8.
I might reuse some other setup to check for selinux. LEAPPed ? Working on to set it up

Comment 8 Mike DePaulo 2022-09-06 18:30:45 UTC

Lukas,

Just reminding you that I can still work on this if you give me a reproducer.

Comment 9 Daniel Alley 2022-09-16 19:49:45 UTC

Are we able to correlate these warnings with a specific action being performed on the Satellite?

Comment 10 Daniel Alley 2022-10-19 19:33:42 UTC

Closing this as having insufficient data for now.  It may already be resolved if we can't reproduce it and aren't hearing about it :)

Comment 11 Red Hat Bugzilla 2023-09-18 04:35:52 UTC

The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days