Bug 2157902

Summary:	SELinux prevents the prosody service from creating the /run/prosody/prosody.sock socket
Product:	Red Hat Enterprise Linux 8	Reporter:	Milos Malik <mmalik>
Component:	selinux-policy	Assignee:	Zdenek Pytela <zpytela>
Status:	CLOSED ERRATA	QA Contact:	Milos Malik <mmalik>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	8.8	CC:	lvrabec, mmalik, nknazeko, zpytela
Target Milestone:	rc	Keywords:	AutoVerified, Triaged
Target Release:	8.8
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:	selinux-policy-3.14.3-114.el8	Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:	2157891	Environment:
Last Closed:	2023-05-16 09:04:19 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2157891
Bug Blocks:

Description Milos Malik 2023-01-03 13:59:59 UTC

+++ This bug was initially created as a clone of Bug #2157891 +++

Description of problem:
 * the prosody service starts and runs successfully, but the SELinux denial is triggered

Version-Release number of selected component (if applicable):
prosody-0.12.2-1.el8.x86_64
selinux-policy-3.14.3-113.el8.noarch
selinux-policy-targeted-3.14.3-113.el8.noarch

How reproducible:
 * always

Steps to Reproduce:
1. get a RHEL-8.8 machine (targeted policy is active)
2. install the prosody package (comes from the EPEL repository)
3. start the prosody service
4. search for SELinux denials

Actual results (enforcing mode):
----
type=PROCTITLE msg=audit(01/03/2023 08:57:18.294:337) : proctitle=/usr/bin/lua /usr/bin/prosody -F 
type=PATH msg=audit(01/03/2023 08:57:18.294:337) : item=1 name=/run/prosody/prosody.sock nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=PATH msg=audit(01/03/2023 08:57:18.294:337) : item=0 name=/run/prosody/ inode=38265 dev=00:18 mode=dir,755 ouid=prosody ogid=prosody rdev=00:00 obj=system_u:object_r:prosody_var_run_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(01/03/2023 08:57:18.294:337) : cwd=/var/lib/prosody 
type=SOCKADDR msg=audit(01/03/2023 08:57:18.294:337) : saddr={ saddr_fam=local path=/run/prosody/prosody.sock } 
type=SYSCALL msg=audit(01/03/2023 08:57:18.294:337) : arch=x86_64 syscall=bind success=no exit=EACCES(Permission denied) a0=0xb a1=0x7ffd9391a080 a2=0x1b a3=0xfffffffe items=2 ppid=1 pid=6151 auid=unset uid=prosody gid=prosody euid=prosody suid=prosody fsuid=prosody egid=prosody sgid=prosody fsgid=prosody tty=(none) ses=unset comm=prosody exe=/usr/bin/lua subj=system_u:system_r:prosody_t:s0 key=(null) 
type=AVC msg=audit(01/03/2023 08:57:18.294:337) : avc:  denied  { create } for  pid=6151 comm=prosody name=prosody.sock scontext=system_u:system_r:prosody_t:s0 tcontext=system_u:object_r:prosody_var_run_t:s0 tclass=sock_file permissive=0
----

Expected results:
 * no SELinux denials

Additional info:
the only SELinux denial that appears in permissive mode is
----
type=PROCTITLE msg=audit(01/03/2023 08:59:15.807:342) : proctitle=/usr/bin/lua /usr/bin/prosody -F 
type=PATH msg=audit(01/03/2023 08:59:15.807:342) : item=1 name=/run/prosody/prosody.sock inode=40160 dev=00:18 mode=socket,750 ouid=prosody ogid=prosody rdev=00:00 obj=system_u:object_r:prosody_var_run_t:s0 nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=PATH msg=audit(01/03/2023 08:59:15.807:342) : item=0 name=/run/prosody/ inode=38265 dev=00:18 mode=dir,755 ouid=prosody ogid=prosody rdev=00:00 obj=system_u:object_r:prosody_var_run_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(01/03/2023 08:59:15.807:342) : cwd=/var/lib/prosody 
type=SOCKADDR msg=audit(01/03/2023 08:59:15.807:342) : saddr={ saddr_fam=local path=/run/prosody/prosody.sock } 
type=SYSCALL msg=audit(01/03/2023 08:59:15.807:342) : arch=x86_64 syscall=bind success=yes exit=0 a0=0x7 a1=0x7ffe0a4530c0 a2=0x1b a3=0xfffffffe items=2 ppid=1 pid=6183 auid=unset uid=prosody gid=prosody euid=prosody suid=prosody fsuid=prosody egid=prosody sgid=prosody fsgid=prosody tty=(none) ses=unset comm=prosody exe=/usr/bin/lua subj=system_u:system_r:prosody_t:s0 key=(null) 
type=AVC msg=audit(01/03/2023 08:59:15.807:342) : avc:  denied  { create } for  pid=6183 comm=prosody name=prosody.sock scontext=system_u:system_r:prosody_t:s0 tcontext=system_u:object_r:prosody_var_run_t:s0 tclass=sock_file permissive=1 
----

Comment 3 Zdenek Pytela 2023-01-12 10:13:44 UTC

To backport:
commit e43a2fe2344a5b3c514bbe4fe1540f992e0c4ea1 (HEAD -> rawhide, upstream/rawhide)
Author: Zdenek Pytela <zpytela>
Date:   Wed Jan 4 08:43:26 2023 +0100

    Allow prosody manage its runtime socket files

Comment 13 errata-xmlrpc 2023-05-16 09:04:19 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:2965