Bug 2166802
| Summary: | [RHEL8.6/insights-compliance/SELinux/Bug] SELinux AVC denials while running insights-client compliance command | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Nikhil Gupta <ngupta> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | low | Docs Contact: | |
| Priority: | medium | ||
| Version: | 8.6 | CC: | lvrabec, mmalik, nknazeko, peter.vreman |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | 8.8 | Flags: | pm-rhel:
mirror+
|
| Hardware: | Unspecified | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-3.14.3-116.el8 | Doc Type: | No Doc Update |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-05-16 09:04:49 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2023:2965 |
Description of problem: SELinux AVC denials while running 'insights-client --compliance' command ~~~ [Azure] test.com ~ $ sudo ausearch -i -m avc,user_avc -se insights_client_t -ts today ---- type=PROCTITLE msg=audit(02/02/2023 06:17:58.638:56605) : proctitle=oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_ospp --results /var/tmp/insights-client/insights-archive-ei5gnpg type=PATH msg=audit(02/02/2023 06:17:58.638:56605) : item=0 name=/run/blkid/blkid.tab inode=39276 dev=00:18 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:fsadm_var_run_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(02/02/2023 06:17:58.638:56605) : cwd=/root type=SYSCALL msg=audit(02/02/2023 06:17:58.638:56605) : arch=x86_64 syscall=access success=yes exit=0 a0=0x7f136c007810 a1=W_OK a2=0x7f134bfe4710 a3=0x0 items=1 ppid=640141 pid=641171 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=probe_worker exe=/usr/bin/oscap subj=system_u:system_r:insights_client_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(02/02/2023 06:17:58.638:56605) : avc: denied { write } for pid=641171 comm=probe_worker name=blkid.tab dev="tmpfs" ino=39276 scontext=system_u:system_r:insights_client_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fsadm_var_run_t:s0 tclass=file permissive=1 ---- type=PROCTITLE msg=audit(02/02/2023 06:17:58.638:56606) : proctitle=oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_ospp --results /var/tmp/insights-client/insights-archive-ei5gnpg type=PATH msg=audit(02/02/2023 06:17:58.638:56606) : item=1 name=/run/blkid/blkid.tab-1VSWOP inode=4414099 dev=00:18 mode=file,600 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:fsadm_var_run_t:s0 nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(02/02/2023 06:17:58.638:56606) : item=0 name=/run/blkid/ inode=34590 dev=00:18 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:fsadm_var_run_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(02/02/2023 06:17:58.638:56606) : cwd=/root type=SYSCALL msg=audit(02/02/2023 06:17:58.638:56606) : arch=x86_64 syscall=openat success=yes exit=26 a0=AT_FDCWD a1=0x7f136c00a460 a2=O_RDWR|O_CREAT|O_EXCL|O_CLOEXEC a3=0x180 items=2 ppid=640141 pid=641171 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=probe_worker exe=/usr/bin/oscap subj=system_u:system_r:insights_client_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(02/02/2023 06:17:58.638:56606) : avc: denied { create } for pid=641171 comm=probe_worker name=blkid.tab-1VSWOP scontext=system_u:system_r:insights_client_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fsadm_var_run_t:s0 tclass=file permissive=1 type=AVC msg=audit(02/02/2023 06:17:58.638:56606) : avc: denied { add_name } for pid=641171 comm=probe_worker name=blkid.tab-1VSWOP scontext=system_u:system_r:insights_client_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fsadm_var_run_t:s0 tclass=dir permissive=1 type=AVC msg=audit(02/02/2023 06:17:58.638:56606) : avc: denied { write } for pid=641171 comm=probe_worker name=blkid dev="tmpfs" ino=34590 scontext=system_u:system_r:insights_client_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fsadm_var_run_t:s0 tclass=dir permissive=1 ---- type=PROCTITLE msg=audit(02/02/2023 06:17:58.638:56607) : proctitle=oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_ospp --results /var/tmp/insights-client/insights-archive-ei5gnpg type=PATH msg=audit(02/02/2023 06:17:58.638:56607) : item=0 name=(null) inode=4414099 dev=00:18 mode=file,600 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:fsadm_var_run_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(02/02/2023 06:17:58.638:56607) : cwd=/root type=SYSCALL msg=audit(02/02/2023 06:17:58.638:56607) : arch=x86_64 syscall=fchmod success=yes exit=0 a0=0x1a a1=0644 a2=0x800c2 a3=0x180 items=1 ppid=640141 pid=641171 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=probe_worker exe=/usr/bin/oscap subj=system_u:system_r:insights_client_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(02/02/2023 06:17:58.638:56607) : avc: denied { setattr } for pid=641171 comm=probe_worker name=blkid.tab-1VSWOP dev="tmpfs" ino=4414099 scontext=system_u:system_r:insights_client_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fsadm_var_run_t:s0 tclass=file permissive=1 ---- type=PROCTITLE msg=audit(02/02/2023 06:17:58.638:56608) : proctitle=oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_ospp --results /var/tmp/insights-client/insights-archive-ei5gnpg type=PATH msg=audit(02/02/2023 06:17:58.638:56608) : item=1 name=/run/blkid/blkid.tab.old inode=39268 dev=00:18 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:fsadm_var_run_t:s0 nametype=DELETE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(02/02/2023 06:17:58.638:56608) : item=0 name=/run/blkid/ inode=34590 dev=00:18 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:fsadm_var_run_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(02/02/2023 06:17:58.638:56608) : cwd=/root type=SYSCALL msg=audit(02/02/2023 06:17:58.638:56608) : arch=x86_64 syscall=unlink success=yes exit=0 a0=0x7f136c00af70 a1=0x7f13ab39c08f a2=0x0 a3=0x0 items=2 ppid=640141 pid=641171 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=probe_worker exe=/usr/bin/oscap subj=system_u:system_r:insights_client_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(02/02/2023 06:17:58.638:56608) : avc: denied { unlink } for pid=641171 comm=probe_worker name=blkid.tab.old dev="tmpfs" ino=39268 scontext=system_u:system_r:insights_client_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fsadm_var_run_t:s0 tclass=file permissive=1 type=AVC msg=audit(02/02/2023 06:17:58.638:56608) : avc: denied { remove_name } for pid=641171 comm=probe_worker name=blkid.tab.old dev="tmpfs" ino=39268 scontext=system_u:system_r:insights_client_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fsadm_var_run_t:s0 tclass=dir permissive=1 ---- type=PROCTITLE msg=audit(02/02/2023 06:17:58.638:56609) : proctitle=oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_ospp --results /var/tmp/insights-client/insights-archive-ei5gnpg type=PATH msg=audit(02/02/2023 06:17:58.638:56609) : item=2 name=/run/blkid/blkid.tab.old inode=39276 dev=00:18 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:fsadm_var_run_t:s0 nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(02/02/2023 06:17:58.638:56609) : item=1 name=/run/blkid/ inode=34590 dev=00:18 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:fsadm_var_run_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(02/02/2023 06:17:58.638:56609) : item=0 name=/run/blkid/blkid.tab inode=39276 dev=00:18 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:fsadm_var_run_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(02/02/2023 06:17:58.638:56609) : cwd=/root type=SYSCALL msg=audit(02/02/2023 06:17:58.638:56609) : arch=x86_64 syscall=link success=yes exit=0 a0=0x7f136c007810 a1=0x7f136c00af70 a2=0x0 a3=0x0 items=3 ppid=640141 pid=641171 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=probe_worker exe=/usr/bin/oscap subj=system_u:system_r:insights_client_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(02/02/2023 06:17:58.638:56609) : avc: denied { link } for pid=641171 comm=probe_worker name=blkid.tab dev="tmpfs" ino=39276 scontext=system_u:system_r:insights_client_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fsadm_var_run_t:s0 tclass=file permissive=1 ---- type=PROCTITLE msg=audit(02/02/2023 06:17:58.638:56610) : proctitle=oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_ospp --results /var/tmp/insights-client/insights-archive-ei5gnpg type=PATH msg=audit(02/02/2023 06:17:58.638:56610) : item=4 name=/run/blkid/blkid.tab inode=4414099 dev=00:18 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:fsadm_var_run_t:s0 nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(02/02/2023 06:17:58.638:56610) : item=3 name=/run/blkid/blkid.tab inode=39276 dev=00:18 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:fsadm_var_run_t:s0 nametype=DELETE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(02/02/2023 06:17:58.638:56610) : item=2 name=/run/blkid/blkid.tab-1VSWOP inode=4414099 dev=00:18 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:fsadm_var_run_t:s0 nametype=DELETE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(02/02/2023 06:17:58.638:56610) : item=1 name=/run/blkid/ inode=34590 dev=00:18 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:fsadm_var_run_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(02/02/2023 06:17:58.638:56610) : item=0 name=/run/blkid/ inode=34590 dev=00:18 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:fsadm_var_run_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(02/02/2023 06:17:58.638:56610) : cwd=/root type=SYSCALL msg=audit(02/02/2023 06:17:58.638:56610) : arch=x86_64 syscall=rename success=yes exit=0 a0=0x7f136c00a460 a1=0x7f136c007810 a2=0x0 a3=0x0 items=5 ppid=640141 pid=641171 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=probe_worker exe=/usr/bin/oscap subj=system_u:system_r:insights_client_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(02/02/2023 06:17:58.638:56610) : avc: denied { rename } for pid=641171 comm=probe_worker name=blkid.tab-1VSWOP dev="tmpfs" ino=4414099 scontext=system_u:system_r:insights_client_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fsadm_var_run_t:s0 tclass=file permissive=1 [Azure] test.com ~ $ sudo audit2allow -t insights_client_t -a #============= insights_client_t ============== allow insights_client_t fsadm_var_run_t:dir { add_name remove_name write }; allow insights_client_t fsadm_var_run_t:file { create link rename setattr unlink write }; ~~~ Version-Release number of selected component (if applicable): RHEL 8.6 How reproducible: Always Steps to Reproduce: 1. Register host with Insights 2. In Compliance create a new policy and use the OSPP profile 3. on host run, 'insights-client --compliance' command Actual results: AVC denials are observed. Expected results: Compliance scan should finish without any AVC denials.