Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 2164841

Summary:	starting insights-client-results.service causes avc: denied { signull } for comm="gpg"
Product:	Red Hat Enterprise Linux 8	Reporter:	Martin Pitt <mpitt>
Component:	selinux-policy	Assignee:	Zdenek Pytela <zpytela>
Status:	CLOSED INSUFFICIENT_DATA	QA Contact:	Milos Malik <mmalik>
Severity:	low	Docs Contact:
Priority:	low
Version:	8.8	CC:	lvrabec, mmalik, mvollmer, nknazeko
Target Milestone:	rc	Keywords:	Triaged
Target Release:	8.9	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Linux
Whiteboard:	CockpitTest
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-08-01 16:53:32 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Martin Pitt 2023-01-26 16:01:47 UTC

Description of problem: Our cockpit tests [1] showed a failure related to insights and SELinux. Starting `insights-client --status` eventually starts insights-client-results.service, which then sometimes causes this:

    kernel: audit: type=1400 audit(1674736402.753:4): avc:  denied  { signull } for  pid=6067 comm="gpg" scontext=system_u:system_r:gpg_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process permissive=0


Version-Release number of selected component (if applicable):

insights-client-3.1.7-11.el8.noarch
selinux-policy-3.14.3-114.el8.noarch
kernel-core-4.18.0-449.el8.x86_64
gnupg2-2.2.20-3.el8_6.x86_64

How reproducible: Really hard. I've ran this 20 times, and it did not reproduce.

Full journal is at [2], but the interesting part is here:

Jan 26 07:33:20 rhel-8-8-127-0-0-2-2201 systemd[1]: Starting Check for insights from Red Hat Cloud Services...
Jan 26 07:33:22 rhel-8-8-127-0-0-2-2201 kernel: audit: type=1400 audit(1674736402.753:4): avc:  denied  { signull } for  pid=6067 comm="gpg" scontext=system_u:system_r:gpg_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process permissive=0
Jan 26 07:33:26 rhel-8-8-127-0-0-2-2201 systemd[1]: insights-client-results.service: Succeeded.
Jan 26 07:33:26 rhel-8-8-127-0-0-2-2201 systemd[1]: Started Check for insights from Red Hat Cloud Services.

I have no idea what "signull" means. If that rings a bell to the SELinux or insights developers, then maybe this is useful. If it doesn't, feel free to ignore this bug, as it's so hard to reproduce.


[1] https://cockpit-logs.us-east-1.linodeobjects.com/pull-18251-20230126-114527-88aa850e-rhel-8-8/log.html#246
[2] https://cockpit-logs.us-east-1.linodeobjects.com/pull-18251-20230126-114527-88aa850e-rhel-8-8/TestSystemInfo-testInsightsStatus-rhel-8-8-127.0.0.2-2601-FAIL.log.gz

Comment 1 Martin Pitt 2023-01-26 16:03:31 UTC

I am setting up an automatic tracker in https://github.com/cockpit-project/bots/issues/4318 , so that we can see how often this actually happens.

Comment 2 Zdenek Pytela 2023-01-26 18:01:15 UTC

Hi Martin,

signull means test for the existence of another process without sending a signal, in full auditing the denial reads

    type=PROCTITLE msg=audit(11/18/21 13:22:44.231:774) : proctitle=sudo -u staff cmd
    type=SYSCALL msg=audit(11/18/21 13:22:44.231:774) : arch=x86_64 syscall=kill success=no exit=EACCES(Permission denied) a0=0x1a2c a1=SIG0 a2=0x4 a3=0x7ffd93c089cf items=0 ppid=6747 pid=6748 auid=staff uid=root gid=staff euid=root suid=root fsuid=root egid=staff sgid=staff fsgid=staff tty=(none) ses=16 comm=sudo exe=/usr/bin/sudo subj=staff_u:staff_r:staff_sudo_t:s0-s0:c0.c1023 key=(null)
    type=AVC msg=audit(11/18/21 13:22:44.231:774) : avc:  denied  { signull } for  pid=6748 comm=sudo scontext=staff_u:staff_r:staff_sudo_t:s0-s0:c0.c1023 tcontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tclass=process permissive=0

I've never seen this before so it would be good to know when exactly it happens.

Is any problem with commands execution logged to journal or insights logs?

Comment 3 Martin Pitt 2023-01-26 18:19:51 UTC

> Is any problem with commands execution logged to journal or insights logs?

None that are visible in the journal (see [2] above). If insights logs to someplace else than the journal, then (1) why oh why?, and (2) we don't capture this. As I cannot reproduce this, I can't grab other log files, sorry.

Comment 4 Marius Vollmer 2023-02-20 12:14:12 UTC

This hasn't happened anymore in our CI for the last 23 days.  I think it only happened once, no?

Comment 6 Zdenek Pytela 2023-08-01 16:53:32 UTC

As no new information appeared during the past weeks, we are going to close this bug. If you need to pursue this matter further, feel free to reopen this bug and attach the information needed for further troubleshooting.