Bug 2166802

Summary: [RHEL8.6/insights-compliance/SELinux/Bug] SELinux AVC denials while running insights-client compliance command
Product: Red Hat Enterprise Linux 8 Reporter: Nikhil Gupta <ngupta>
Component: selinux-policyAssignee: Zdenek Pytela <zpytela>
Status: CLOSED ERRATA QA Contact: Milos Malik <mmalik>
Severity: low Docs Contact:
Priority: medium    
Version: 8.6CC: lvrabec, mmalik, nknazeko, peter.vreman
Target Milestone: rcKeywords: Triaged
Target Release: 8.8Flags: pm-rhel: mirror+
Hardware: Unspecified   
OS: Linux   
Whiteboard:
Fixed In Version: selinux-policy-3.14.3-116.el8 Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2023-05-16 09:04:49 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Nikhil Gupta 2023-02-03 01:56:06 UTC
Description of problem:
SELinux AVC denials while running 'insights-client --compliance' command
~~~
[Azure] test.com ~
$ sudo ausearch -i -m avc,user_avc -se insights_client_t -ts today
----
type=PROCTITLE msg=audit(02/02/2023 06:17:58.638:56605) : proctitle=oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_ospp --results /var/tmp/insights-client/insights-archive-ei5gnpg
type=PATH msg=audit(02/02/2023 06:17:58.638:56605) : item=0 name=/run/blkid/blkid.tab inode=39276 dev=00:18 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:fsadm_var_run_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(02/02/2023 06:17:58.638:56605) : cwd=/root
type=SYSCALL msg=audit(02/02/2023 06:17:58.638:56605) : arch=x86_64 syscall=access success=yes exit=0 a0=0x7f136c007810 a1=W_OK a2=0x7f134bfe4710 a3=0x0 items=1 ppid=640141 pid=641171 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=probe_worker exe=/usr/bin/oscap subj=system_u:system_r:insights_client_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(02/02/2023 06:17:58.638:56605) : avc:  denied  { write } for  pid=641171 comm=probe_worker name=blkid.tab dev="tmpfs" ino=39276 scontext=system_u:system_r:insights_client_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fsadm_var_run_t:s0 tclass=file permissive=1
----
type=PROCTITLE msg=audit(02/02/2023 06:17:58.638:56606) : proctitle=oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_ospp --results /var/tmp/insights-client/insights-archive-ei5gnpg
type=PATH msg=audit(02/02/2023 06:17:58.638:56606) : item=1 name=/run/blkid/blkid.tab-1VSWOP inode=4414099 dev=00:18 mode=file,600 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:fsadm_var_run_t:s0 nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=PATH msg=audit(02/02/2023 06:17:58.638:56606) : item=0 name=/run/blkid/ inode=34590 dev=00:18 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:fsadm_var_run_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(02/02/2023 06:17:58.638:56606) : cwd=/root
type=SYSCALL msg=audit(02/02/2023 06:17:58.638:56606) : arch=x86_64 syscall=openat success=yes exit=26 a0=AT_FDCWD a1=0x7f136c00a460 a2=O_RDWR|O_CREAT|O_EXCL|O_CLOEXEC a3=0x180 items=2 ppid=640141 pid=641171 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=probe_worker exe=/usr/bin/oscap subj=system_u:system_r:insights_client_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(02/02/2023 06:17:58.638:56606) : avc:  denied  { create } for  pid=641171 comm=probe_worker name=blkid.tab-1VSWOP scontext=system_u:system_r:insights_client_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fsadm_var_run_t:s0 tclass=file permissive=1
type=AVC msg=audit(02/02/2023 06:17:58.638:56606) : avc:  denied  { add_name } for  pid=641171 comm=probe_worker name=blkid.tab-1VSWOP scontext=system_u:system_r:insights_client_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fsadm_var_run_t:s0 tclass=dir permissive=1
type=AVC msg=audit(02/02/2023 06:17:58.638:56606) : avc:  denied  { write } for  pid=641171 comm=probe_worker name=blkid dev="tmpfs" ino=34590 scontext=system_u:system_r:insights_client_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fsadm_var_run_t:s0 tclass=dir permissive=1
----
type=PROCTITLE msg=audit(02/02/2023 06:17:58.638:56607) : proctitle=oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_ospp --results /var/tmp/insights-client/insights-archive-ei5gnpg
type=PATH msg=audit(02/02/2023 06:17:58.638:56607) : item=0 name=(null) inode=4414099 dev=00:18 mode=file,600 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:fsadm_var_run_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(02/02/2023 06:17:58.638:56607) : cwd=/root
type=SYSCALL msg=audit(02/02/2023 06:17:58.638:56607) : arch=x86_64 syscall=fchmod success=yes exit=0 a0=0x1a a1=0644 a2=0x800c2 a3=0x180 items=1 ppid=640141 pid=641171 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=probe_worker exe=/usr/bin/oscap subj=system_u:system_r:insights_client_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(02/02/2023 06:17:58.638:56607) : avc:  denied  { setattr } for  pid=641171 comm=probe_worker name=blkid.tab-1VSWOP dev="tmpfs" ino=4414099 scontext=system_u:system_r:insights_client_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fsadm_var_run_t:s0 tclass=file permissive=1
----
type=PROCTITLE msg=audit(02/02/2023 06:17:58.638:56608) : proctitle=oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_ospp --results /var/tmp/insights-client/insights-archive-ei5gnpg
type=PATH msg=audit(02/02/2023 06:17:58.638:56608) : item=1 name=/run/blkid/blkid.tab.old inode=39268 dev=00:18 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:fsadm_var_run_t:s0 nametype=DELETE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=PATH msg=audit(02/02/2023 06:17:58.638:56608) : item=0 name=/run/blkid/ inode=34590 dev=00:18 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:fsadm_var_run_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(02/02/2023 06:17:58.638:56608) : cwd=/root
type=SYSCALL msg=audit(02/02/2023 06:17:58.638:56608) : arch=x86_64 syscall=unlink success=yes exit=0 a0=0x7f136c00af70 a1=0x7f13ab39c08f a2=0x0 a3=0x0 items=2 ppid=640141 pid=641171 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=probe_worker exe=/usr/bin/oscap subj=system_u:system_r:insights_client_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(02/02/2023 06:17:58.638:56608) : avc:  denied  { unlink } for  pid=641171 comm=probe_worker name=blkid.tab.old dev="tmpfs" ino=39268 scontext=system_u:system_r:insights_client_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fsadm_var_run_t:s0 tclass=file permissive=1
type=AVC msg=audit(02/02/2023 06:17:58.638:56608) : avc:  denied  { remove_name } for  pid=641171 comm=probe_worker name=blkid.tab.old dev="tmpfs" ino=39268 scontext=system_u:system_r:insights_client_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fsadm_var_run_t:s0 tclass=dir permissive=1
----
type=PROCTITLE msg=audit(02/02/2023 06:17:58.638:56609) : proctitle=oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_ospp --results /var/tmp/insights-client/insights-archive-ei5gnpg
type=PATH msg=audit(02/02/2023 06:17:58.638:56609) : item=2 name=/run/blkid/blkid.tab.old inode=39276 dev=00:18 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:fsadm_var_run_t:s0 nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=PATH msg=audit(02/02/2023 06:17:58.638:56609) : item=1 name=/run/blkid/ inode=34590 dev=00:18 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:fsadm_var_run_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=PATH msg=audit(02/02/2023 06:17:58.638:56609) : item=0 name=/run/blkid/blkid.tab inode=39276 dev=00:18 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:fsadm_var_run_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(02/02/2023 06:17:58.638:56609) : cwd=/root
type=SYSCALL msg=audit(02/02/2023 06:17:58.638:56609) : arch=x86_64 syscall=link success=yes exit=0 a0=0x7f136c007810 a1=0x7f136c00af70 a2=0x0 a3=0x0 items=3 ppid=640141 pid=641171 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=probe_worker exe=/usr/bin/oscap subj=system_u:system_r:insights_client_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(02/02/2023 06:17:58.638:56609) : avc:  denied  { link } for  pid=641171 comm=probe_worker name=blkid.tab dev="tmpfs" ino=39276 scontext=system_u:system_r:insights_client_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fsadm_var_run_t:s0 tclass=file permissive=1
----
type=PROCTITLE msg=audit(02/02/2023 06:17:58.638:56610) : proctitle=oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_ospp --results /var/tmp/insights-client/insights-archive-ei5gnpg
type=PATH msg=audit(02/02/2023 06:17:58.638:56610) : item=4 name=/run/blkid/blkid.tab inode=4414099 dev=00:18 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:fsadm_var_run_t:s0 nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=PATH msg=audit(02/02/2023 06:17:58.638:56610) : item=3 name=/run/blkid/blkid.tab inode=39276 dev=00:18 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:fsadm_var_run_t:s0 nametype=DELETE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=PATH msg=audit(02/02/2023 06:17:58.638:56610) : item=2 name=/run/blkid/blkid.tab-1VSWOP inode=4414099 dev=00:18 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:fsadm_var_run_t:s0 nametype=DELETE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=PATH msg=audit(02/02/2023 06:17:58.638:56610) : item=1 name=/run/blkid/ inode=34590 dev=00:18 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:fsadm_var_run_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=PATH msg=audit(02/02/2023 06:17:58.638:56610) : item=0 name=/run/blkid/ inode=34590 dev=00:18 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:fsadm_var_run_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(02/02/2023 06:17:58.638:56610) : cwd=/root
type=SYSCALL msg=audit(02/02/2023 06:17:58.638:56610) : arch=x86_64 syscall=rename success=yes exit=0 a0=0x7f136c00a460 a1=0x7f136c007810 a2=0x0 a3=0x0 items=5 ppid=640141 pid=641171 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=probe_worker exe=/usr/bin/oscap subj=system_u:system_r:insights_client_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(02/02/2023 06:17:58.638:56610) : avc:  denied  { rename } for  pid=641171 comm=probe_worker name=blkid.tab-1VSWOP dev="tmpfs" ino=4414099 scontext=system_u:system_r:insights_client_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fsadm_var_run_t:s0 tclass=file permissive=1

[Azure] test.com ~
$ sudo audit2allow -t insights_client_t -a


#============= insights_client_t ==============
allow insights_client_t fsadm_var_run_t:dir { add_name remove_name write };
allow insights_client_t fsadm_var_run_t:file { create link rename setattr unlink write };
~~~

Version-Release number of selected component (if applicable):
RHEL 8.6

How reproducible:
Always

Steps to Reproduce:
1. Register host with Insights 
2. In Compliance create a new policy and use the OSPP profile
3. on host run, 'insights-client --compliance' command

Actual results:
AVC denials are observed.

Expected results:
Compliance scan should finish without any AVC denials.

Comment 10 errata-xmlrpc 2023-05-16 09:04:49 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:2965