Bug 2124388
| Summary: | confined users staff_u are creating AVC errors for dbus at GUI login | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Daniel Reynolds <dareynol> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | medium | Docs Contact: | Petr Hybl <phybl> |
| Priority: | medium | ||
| Version: | 8.6 | CC: | jafiala, lvrabec, mmalik, phybl, zpytela |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | 8.8 | Flags: | pm-rhel:
mirror+
|
| Hardware: | Unspecified | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-3.14.3-109.el8 | Doc Type: | Bug Fix |
| Doc Text: |
.Confined users now can log in without a reported denial
Previously, SELinux policy did not allow all permissions needed to log in a SELinux confined user using GUI.
Consequently, AVC denials were audited and some services like `dbus` or `pulseaudio` did not work properly.
With this update, the SELinux policy has been updated with new rules for confined users.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-05-16 09:04:16 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Should be resolved with using the rhsmcertd_dbus_chat() interface for login_userdomain. Caught in permissive mode:
----
type=USER_AVC msg=audit(10/03/2022 18:25:28.555:576) : pid=930 uid=dbus auid=unset ses=unset subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.DBus.Properties member=GetAll dest=:1.158 spid=10257 tpid=1376 scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:system_r:rhsmcertd_t:s0 tclass=dbus permissive=1 exe=/usr/bin/dbus-daemon sauid=dbus hostname=? addr=? terminal=?'
----
type=USER_AVC msg=audit(10/03/2022 18:25:28.718:577) : pid=930 uid=dbus auid=unset ses=unset subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.2630 spid=1376 tpid=10257 scontext=system_u:system_r:rhsmcertd_t:s0 tcontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tclass=dbus permissive=1 exe=/usr/bin/dbus-daemon sauid=dbus hostname=? addr=? terminal=?'
----
To backport:
commit 14a208a78ed843964f8f79903d130760aa7a9a4e
Author: Zdenek Pytela <zpytela>
Date: Wed Oct 5 19:53:23 2022 +0200
Allow login_userdomain dbus chat with rhsmcertd
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2023:2965 |
Description of problem: - Customer is migrating users to be SELinux confined users staff_u. - When logging into GUI, SELinux AVC errors are generated. Version-Release number of selected component (if applicable): - pulseaudio-14.0-3.el8_6.x86_64 - selinux-policy-3.14.3-95.el8_6.4.noarch - dbus-1.12.8-18.el8_6.1.x86_64 How reproducible: Always Steps to Reproduce: 1. Create test user sudo useradd --groups wheel --selinux-user staff_u test-staff sudo passwd test-staff XXXXX 2. Login to test-staff via GUI. 3. Show selinux AVC,AVC_USER errors sudo ausearch -m avc,user_avc Actual results: - Will see AVC errors for pulseaudio and dbus. - pulseaudio AVC errors do no reappear on second login, dbus errors do. pulseaudio AVC errors generated. Do not occur on second login. [snip] ---- time->Tue Sep 6 10:10:41 2022 type=PROCTITLE msg=audit(1662423041.867:247): proctitle=2F7573722F62696E2F70756C7365617564696F002D2D6461656D6F6E697A653D6E6F002D2D6C6F672D7461726765743D6A6F75726E616C type=SYSCALL msg=audit(1662423041.867:247): arch=c000003e syscall=83 success=no exit=-13 a0=55f276de08b0 a1=1c0 a2=ffffffff a3=0 items=0 ppid=3074 pid=3094 auid=1001 uid=1001 gid=1002 euid=1001 suid=1001 fsuid=1001 egid=1002 sgid=1002 fsgid=1002 tty=(none) ses=5 comm="pulseaudio" exe="/usr/bin/pulseaudio" subj=staff_u:staff_r:pulseaudio_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1662423041.867:247): avc: denied { create } for pid=3094 comm="pulseaudio" name=".config" scontext=staff_u:staff_r:pulseaudio_t:s0-s0:c0.c1023 tcontext=staff_u:object_r:config_home_t:s0 tclass=dir permissive=0 [snip] ---- dbus AVC errors immidiately after pulseaudio errors. These always reoccur. ---- time->Tue Sep 6 10:12:05 2022 type=USER_AVC msg=audit(1662423125.715:294): pid=896 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.DBus.Properties member=GetAll dest=:1.386 spid=4090 tpid=2540 scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:system_r:rhsmcertd_t:s0 tclass=dbus permissive=0 exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' ---- time->Tue Sep 6 10:12:05 2022 type=USER_AVC msg=audit(1662423125.745:295): pid=896 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.DBus.Properties member=GetAll dest=:1.386 spid=4090 tpid=2540 scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:system_r:rhsmcertd_t:s0 tclass=dbus permissive=0 exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' ---- time->Tue Sep 6 10:12:05 2022 type=USER_AVC msg=audit(1662423125.781:296): pid=896 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.DBus.Properties member=GetAll dest=:1.386 spid=4090 tpid=2540 scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:system_r:rhsmcertd_t:s0 tclass=dbus permissive=0 exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' ---- time->Tue Sep 6 10:12:05 2022 type=USER_AVC msg=audit(1662423125.805:297): pid=896 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.DBus.Properties member=GetAll dest=:1.386 spid=4090 tpid=2540 scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:system_r:rhsmcertd_t:s0 tclass=dbus permissive=0 exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' ---- time->Tue Sep 6 10:12:05 2022 type=USER_AVC msg=audit(1662423125.810:298): pid=896 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.DBus.Properties member=GetAll dest=:1.386 spid=4090 tpid=2540 scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:system_r:rhsmcertd_t:s0 tclass=dbus permissive=0 exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' ---- time->Tue Sep 6 10:12:05 2022 type=USER_AVC msg=audit(1662423125.825:299): pid=896 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.DBus.Properties member=GetAll dest=:1.386 spid=4090 tpid=2540 scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:system_r:rhsmcertd_t:s0 tclass=dbus permissive=0 exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' ---- time->Tue Sep 6 10:12:05 2022 type=USER_AVC msg=audit(1662423125.839:300): pid=896 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.DBus.Properties member=GetAll dest=:1.386 spid=4090 tpid=2540 scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:system_r:rhsmcertd_t:s0 tclass=dbus permissive=0 exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' ---- time->Tue Sep 6 10:12:05 2022 type=USER_AVC msg=audit(1662423125.839:301): pid=896 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=com.redhat.RHSM1.Config member=GetAll dest=:1.386 spid=4090 tpid=2540 scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:system_r:rhsmcertd_t:s0 tclass=dbus permissive=0 exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' ---- [snip] Expected results: No AVC errors generated. Additional info: Opened up two bugs. 1. one for pulseaudio -- 2124387 2. another for dbus -- this Feel free to close 2124387 if two bug reports are not required.