Bug 2088463

Description of problem:
SELinux is preventing /usr/libexec/platform-python3.6 from search access on the directory .local.


Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.14.3-95.el8.noarch
selinux-policy-3.14.3-95.el8.noarch
insights-client-3.1.7-5.el8.noarch
platform-python-3.6.8-45.el8.x86_64


How reproducible:
Occurs regularly as a part of insights-client running as a periodic process


Steps to Reproduce:
1. Run RHEL 8.6 with SELinux in Enforcing or Permissive mode, using SELINUXTYPE=targeted
2. Register system with insights
3. Observe periodic AVC denials


Actual results:
Unknown


Expected results:
Normal function


Additional info:

Stat output for the only two directories on this system I believe this alert may be related to:

[root@ginnungagap ~]# stat /root/.local /home/*/.local | egrep -e '(File|Context):\s'
  File: /root/.local
Context: unconfined_u:object_r:gconf_home_t:s0
  File: /home/bransfp/.local
Context: unconfined_u:object_r:gconf_home_t:s0

SETroubleshoot Details follows:

SELinux is preventing /usr/libexec/platform-python3.6 from search access on the directory .local.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that platform-python3.6 should be allowed search access on the .local directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'insights-client' --raw | audit2allow -M my-insightsclient
# semodule -X 300 -i my-insightsclient.pp

Additional Information:
Source Context                system_u:system_r:insights_client_t:s0
Target Context                unconfined_u:object_r:gconf_home_t:s0
Target Objects                .local [ dir ]
Source                        insights-client
Source Path                   /usr/libexec/platform-python3.6
Port                          <Unknown>
Host                          ginnungagap.redacted
Source RPM Packages           platform-python-3.6.8-45.el8.x86_64
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-3.14.3-95.el8.noarch
Local Policy RPM              selinux-policy-targeted-3.14.3-95.el8.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     ginnungagap.redacted
Platform                      Linux ginnungagap.redacted
                              4.18.0-372.9.1.el8.x86_64 #1 SMP Fri Apr 15
                              22:12:19 EDT 2022 x86_64 x86_64
Alert Count                   24
First Seen                    2022-05-18 02:16:33 EDT
Last Seen                     2022-05-19 01:00:59 EDT
Local ID                      6f551a65-041f-4124-8aa1-111e842ae409

Raw Audit Messages
type=AVC msg=audit(1652936459.88:1493): avc:  denied  { search } for  pid=271029 comm="platform-python" name=".local" dev="dm-0" ino=134526019 scontext=system_u:system_r:insights_client_t:s0 tcontext=unconfined_u:object_r:gconf_home_t:s0 tclass=dir permissive=0


type=SYSCALL msg=audit(1652936459.88:1493): arch=x86_64 syscall=stat success=no exit=EACCES a0=7f209155bb10 a1=7ffda4ad3ff0 a2=7ffda4ad3ff0 a3=1 items=0 ppid=270936 pid=271029 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=platform-python exe=/usr/libexec/platform-python3.6 subj=system_u:system_r:insights_client_t:s0 key=(null)

Hash: insights-client,insights_client_t,gconf_home_t,dir,search