Bug 2156068

Summary: SELinux is preventing /usr/sbin/rsyslogd from 'search' accesses on the directory net
Product: Red Hat Enterprise Linux 9 Reporter: Lalit Dhiri <lalit_dhiri>
Component: selinux-policyAssignee: Nikola Knazekova <nknazeko>
Status: CLOSED ERRATA QA Contact: Milos Malik <mmalik>
Severity: low Docs Contact:
Priority: medium    
Version: CentOS StreamCC: alakatos, bstinson, jwboyer, lvrabec, mmalik, mpitt, zpytela
Target Milestone: rcKeywords: Regression, Triaged
Target Release: ---Flags: pm-rhel: mirror+
Hardware: x86_64   
OS: Linux   
Whiteboard: CockpitTest
Fixed In Version: selinux-policy-38.1.4-1.el9 Doc Type: No Doc Update
Doc Text:
If this bug requires documentation, please select an appropriate Doc Type value.
Story Points: ---
Clone Of: Environment:
Last Closed: 2023-05-09 08:17:04 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Lalit Dhiri 2022-12-23 16:56:14 UTC
Description of problem:

SELinux is preventing /usr/sbin/rsyslogd from 'search' accesses on the directory net.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that rsyslogd should be allowed search access on the net directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'rsyslogd' --raw | audit2allow -M my-rsyslogd
# semodule -X 300 -i my-rsyslogd.pp

Additional Information:
Source Context                system_u:system_r:syslogd_t:s0
Target Context                system_u:object_r:sysctl_net_t:s0
Target Objects                net [ dir ]
Source                        rsyslogd
Source Path                   /usr/sbin/rsyslogd
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           rsyslog-8.2102.0-106.el9.x86_64
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-38.1.3-1.el9.noarch
Local Policy RPM              selinux-policy-targeted-38.1.3-1.el9.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 5.14.0-214.el9.x86_64 #1 SMP
                              PREEMPT_DYNAMIC Thu Dec 15 01:34:46 UTC 2022
                              x86_64 x86_64
Alert Count                   12
First Seen                    2022-12-23 01:36:19 GMT
Last Seen                     2022-12-23 15:59:29 GMT
Local ID                      b6d879d1-b334-4683-9edd-cda0b3af0412

Raw Audit Messages
type=AVC msg=audit(1671811169.9:22): avc:  denied  { search } for  pid=805 comm="rsyslogd" name="net" dev="proc" ino=15721 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=dir permissive=0


type=SYSCALL msg=audit(1671811169.9:22): arch=x86_64 syscall=openat success=no exit=EACCES a0=ffffff9c a1=7fff7499b7b0 a2=80100 a3=0 items=0 ppid=1 pid=805 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=rsyslogd exe=/usr/sbin/rsyslogd subj=system_u:system_r:syslogd_t:s0 key=(null)

Hash: rsyslogd,syslogd_t,sysctl_net_t,dir,search



Version-Release number of selected component (if applicable):


How reproducible:

Starts occuring after login to CentOS Stream 9

Comment 1 Martin Pitt 2023-01-02 08:47:05 UTC
We see this in Cockpit's RHEL 9.2 image refresh [1] as well, and can reproduce this fairly reliably in one of our tests. Curiously nothing in our tests touches or even cares about rsyslogd, this is just a random catch. The image build log [2] has the full list of package updates, but the most plausible ones are

  rsyslog (8.2102.0-105.el9 -> 8.2102.0-107.el9)
  selinux-policy (38.1.2-1.el9 -> 38.1.3-1.el9)

So if rsyslog isn't supposed to do that, it may be prudent to reassign. CC'ing Attila, who uploaded that rsyslog version.

[1] https://github.com/cockpit-project/bots/pull/4226
[2] https://cockpit-logs.us-east-1.linodeobjects.com/image-refresh-logs/rhel-9-2-20230102-062525.log

Comment 2 Zdenek Pytela 2023-01-06 09:14:00 UTC
commit 1340f95a0cc300743f1565aa3290ecabf4d4ade3
Author: Zdenek Pytela <zpytela>
Date:   Wed Nov 23 09:20:51 2022 +0100

    Allow syslogd read network sysctls

    Addresses the following AVC denial:

    type=AVC msg=audit(1669156432.404:191): avc:  denied  { read } for  pid=700 comm="rsyslogd" name="disable_ipv6" dev="proc" ino=19523 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file permissive=0

    Resolves: rhbz#2145019

Comment 11 errata-xmlrpc 2023-05-09 08:17:04 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:2483