Bug 2151111

Summary: [RHEL8.7/Insights/SELinux/Bug] Insights-client SELinux AVCs in Satellite 6.12
Product: Red Hat Enterprise Linux 8 Reporter: Nikhil Gupta <ngupta>
Component: selinux-policyAssignee: Zdenek Pytela <zpytela>
Status: CLOSED ERRATA QA Contact: Milos Malik <mmalik>
Severity: medium Docs Contact: Mirek Jahoda <mjahoda>
Priority: high    
Version: 8.7CC: jafiala, lvrabec, mmalik, nknazeko, peter.vreman, sshashi
Target Milestone: rcKeywords: Triaged
Target Release: 8.8Flags: pm-rhel: mirror+
Hardware: Unspecified   
OS: Linux   
Whiteboard:
Fixed In Version: selinux-policy-3.14.3-114.el8 Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2023-05-16 09:04:19 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Nikhil Gupta 2022-12-06 07:25:28 UTC
Description of problem:
With RHEL8.7 the number of insights-client selinux AVCs is reduced drastically, but still a few missing rules in the selinux policy.

~~~
$ sudo audit2allow -t insights_client_t -a

#============= insights_client_t ==============
allow insights_client_t admin_home_t:file { append write };
allow insights_client_t cache_home_t:dir { add_name remove_name write };
allow insights_client_t cache_home_t:file { create unlink write };

#!!!! This avc can be allowed using the boolean 'daemons_enable_cluster_mode'
allow insights_client_t pcp_pmcd_t:unix_stream_socket connectto;

#!!!! This avc can be allowed using the boolean 'daemons_enable_cluster_mode'
allow insights_client_t postgresql_t:unix_stream_socket connectto;
allow insights_client_t postgresql_var_run_t:sock_file write;
allow insights_client_t self:capability { audit_write setgid setuid };
allow insights_client_t self:netlink_audit_socket { create nlmsg_relay };
allow insights_client_t self:process execmem;
allow insights_client_t shadow_t:file { open read };
allow insights_client_t system_cronjob_tmp_t:dir { add_name create remove_name rmdir write };
allow insights_client_t system_cronjob_tmp_t:file { create unlink };
allow insights_client_t systemd_logind_t:dbus send_msg;
allow insights_client_t websm_port_t:tcp_socket name_connect;

#============= systemd_logind_t ==============
allow systemd_logind_t insights_client_t:dbus send_msg;
~~~

Version-Release number of selected component (if applicable):
selinux-policy-3.14.3-108.el8.noarch
insights-client-3.1.7-8.el8.noarch

How reproducible:
Always

Steps to Reproduce:
1. Register satellite 6.12 server with insights

Actual results:
Getting AVC denials for insights-client

Expected results:
Insights-client should run without any selinux avc denials.

Additional info:

Comment 12 errata-xmlrpc 2023-05-16 09:04:19 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:2965