Bug 2157894

Summary: TPM2-abrmd-selinux - Missing interface in distributed version of package
Product: Red Hat Enterprise Linux 9 Reporter: Patrik Koncity <pkoncity>
Component: tpm2-abrmd-selinuxAssignee: Štěpán Horáček <shoracek>
Status: CLOSED ERRATA QA Contact: Patrik Koncity <pkoncity>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 9.2CC: bhu, jsnitsel, qe-baseos-security
Target Milestone: rcKeywords: Triaged
Target Release: ---Flags: pkoncity: needinfo+
pm-rhel: mirror+
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: tpm2-abrmd-selinux-2.3.1-7.el9 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 2157896 (view as bug list) Environment:
Last Closed: 2023-05-09 07:48:52 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2157896, 2167406    
Deadline: 2023-01-23   

Description Patrik Koncity 2023-01-03 13:22:14 UTC 
Description of problem:
I already made for tpm2-abrmd-selinux upstream policy some improvements related of tpm2-abrmd usage with keylime. [1] Keylime should communicate with tpm2-tabrmd and need allowing rules for proper working.  I've added PR to tpm2-tabrmd for SELinux policy, which should allow proper run of keylime with tpm2-abrmd. This PR is already merged in upstream policy, but it should be good to add it into official distributed policy. In keylime we have now workaround solution, but for more secure policy where will be granted only needed permission should be used interfaces which were already add in tpm2-abrmd upstream. [2] [3] 
Also could be good to add it also to RHEL-9.1, where is also keylime released.

Version-Release number of selected component (if applicable):
tpm2-abrmd-selinux-2.3.1-6.el9.noarch


Actual results:
In tpm2-tabrmd selinux policy now missing upstream change which allow tpm2-abrmd work with keylime.


Expected results:
Missing rules will be added to distributed tpm2-abrmd-selinux package.


[1] https://github.com/tpm2-software/tpm2-abrmd/commit/2075b8519d2e6f57807ce4df8177b31520de8f90

[2] https://github.com/RedHat-SP-Security/keylime-selinux/blob/3c23ccc63959cf60384e6b4c33b43e3335d0f4dd/keylime.te#L100

[3] https://github.com/RedHat-SP-Security/keylime-selinux/blob/3c23ccc63959cf60384e6b4c33b43e3335d0f4dd/keylime.te#L127
Comment 7 errata-xmlrpc 2023-05-09 07:48:52 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (tpm2-abrmd-selinux bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:2362