Bug 2186759

Is there a default location for the tracked file?

For example: the /var/lib/keepalived/keepalived_tracked_file location (when used in the keepalived configuration file) does not trigger any SELinux denials.

Keepalived doesn't create directories if they don't exist and as /var/lib/keepalived does not exist by default after the installation I would guess it didn't even attempt to create the file therefore there are no denials to be observed.
journalctl shows `Keepalived_vrrp[138272]: Unable to open '/var/lib/keepalived/keepalived_tracked_file' - errno 2 (No such file or directory)` at least in my case.

As for your question I do not believe there is a default location for the tracked file, `/etc/keepalived/` is the place that contains the conf file by default so it made sense for me to use that.

SELinux policy defines the following keepalived related types:

# seinfo -t | grep keepalived
   keepalived_exec_t
   keepalived_t
   keepalived_tmp_t
   keepalived_tmpfs_t
   keepalived_unconfined_script_exec_t
   keepalived_unconfined_script_t
   keepalived_unit_file_t
   keepalived_var_run_t
#

Least resistance approach: we can choose from already defined SELinux types and locations.

# semanage fcontext -l | grep keepalived_var_run_t
/var/run/keepalived.*                              all files          system_u:object_r:keepalived_var_run_t:s0 
#

Let's modify the keepalived configuration file accordingly:

# grep track /etc/keepalived/keepalived.conf 
track_file test_file {
    file /var/run/keepalived_tracked_file
    track_file { test_file weight -2 }
#

Let's see if that's enough:

# service keepalived status
Redirecting to /bin/systemctl status keepalived.service
○ keepalived.service - LVS and VRRP High Availability Monitor
     Loaded: loaded (/usr/lib/systemd/system/keepalived.service; disabled; preset: disabled)
     Active: inactive (dead)
# service keepalived start
Redirecting to /bin/systemctl start keepalived.service
# ls -Zl /var/run/keepalived*
-rw-r--r--. 1 root root system_u:object_r:keepalived_var_run_t:s0 5 Apr 25 12:32 /var/run/keepalived.pid
-rw-------. 1 root root system_u:object_r:keepalived_var_run_t:s0 2 Apr 25 12:32 /var/run/keepalived_tracked_file
#

The keepalived service starts and runs successfully in enforcing mode, but the following SELinux denial appears:

----
type=PROCTITLE msg=audit(04/25/2023 12:32:20.139:313) : proctitle=/usr/sbin/keepalived --dont-fork -D 
type=SYSCALL msg=audit(04/25/2023 12:32:20.139:313) : arch=x86_64 syscall=inotify_add_watch success=no exit=EACCES(Permission denied) a0=0xc a1=0x556008bf5660 a2=0x2c8 a3=0x20bf0 items=0 ppid=4751 pid=4753 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=keepalived exe=/usr/sbin/keepalived subj=system_u:system_r:keepalived_t:s0 key=(null) 
type=AVC msg=audit(04/25/2023 12:32:20.139:313) : avc:  denied  { watch } for  pid=4753 comm=keepalived path=/run dev="tmpfs" ino=1 scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=dir permissive=0 
----

SELinux QE conclusion:
Either we use an existing type+location or we define a new type+location. Both options require an allow rule with watch permission to be added into SELinux policy. For example:

# cat testpolicy.cil 
( allow keepalived_t var_run_t ( dir ( search )))

# semodule -i testpolicy.cil 
# semodule -lfull | grep testpolicy
400 testpolicy                     cil
#

I created PR to allow keeaplived watch /var/run dirs: https://github.com/fedora-selinux/selinux-policy/pull/1824

Please use the /var/run location for keepalived_tracked_file as described in #c4

When the track_file is located in /var/run directory, the following SELinux denials appear in enforcing mode:
----
type=PROCTITLE msg=audit(08/10/2023 09:04:46.997:352) : proctitle=/usr/sbin/keepalived --dont-fork -D 
type=PATH msg=audit(08/10/2023 09:04:46.997:352) : item=0 name=/run/ inode=1 dev=00:18 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:var_run_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(08/10/2023 09:04:46.997:352) : cwd=/ 
type=SYSCALL msg=audit(08/10/2023 09:04:46.997:352) : arch=x86_64 syscall=inotify_add_watch success=no exit=EACCES(Permission denied) a0=0xb a1=0x555c2a39eba0 a2=0x2c8 a3=0x20950 items=1 ppid=4781 pid=4783 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=keepalived exe=/usr/sbin/keepalived subj=system_u:system_r:keepalived_t:s0 key=(null) 
type=AVC msg=audit(08/10/2023 09:04:46.997:352) : avc:  denied  { watch } for  pid=4783 comm=keepalived path=/run dev="tmpfs" ino=1 scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=dir permissive=0 
----
type=PROCTITLE msg=audit(08/10/2023 09:04:46.997:353) : proctitle=/usr/sbin/keepalived --dont-fork -D 
type=PATH msg=audit(08/10/2023 09:04:46.997:353) : item=0 name=/run inode=1 dev=00:18 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:var_run_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(08/10/2023 09:04:46.997:353) : cwd=/etc/keepalived 
type=SYSCALL msg=audit(08/10/2023 09:04:46.997:353) : arch=x86_64 syscall=statfs success=no exit=EACCES(Permission denied) a0=0x555c2a3a4170 a1=0x7fffd7f84a20 a2=0x55597ff8e234 a3=0x0 items=1 ppid=4781 pid=4782 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=keepalived exe=/usr/sbin/keepalived subj=system_u:system_r:keepalived_t:s0 key=(null) 
type=AVC msg=audit(08/10/2023 09:04:46.997:353) : avc:  denied  { getattr } for  pid=4782 comm=keepalived name=/ dev="tmpfs" ino=1 scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=filesystem permissive=0 
----

# rpm -qa selinux\* keepalived\* | sort
keepalived-2.2.8-3.el9.x86_64
selinux-policy-38.1.18-1.el9.noarch
selinux-policy-targeted-38.1.18-1.el9.noarch
# mount | grep run
tmpfs on /run type tmpfs (rw,nosuid,nodev,seclabel,size=360844k,nr_inodes=819200,mode=755,inode64)
none on /run/credentials/systemd-sysctl.service type ramfs (ro,nosuid,nodev,noexec,relatime,seclabel,mode=700)
none on /run/credentials/systemd-tmpfiles-setup-dev.service type ramfs (ro,nosuid,nodev,noexec,relatime,seclabel,mode=700)
none on /run/credentials/systemd-tmpfiles-setup.service type ramfs (ro,nosuid,nodev,noexec,relatime,seclabel,mode=700)
tmpfs on /run/user/0 type tmpfs (rw,nosuid,nodev,relatime,seclabel,size=180420k,nr_inodes=45105,mode=700,inode64)
#

My apologies, I didn't notice the second AVC sooner.

The same SELinux denials appear in permissive mode:
----
type=PROCTITLE msg=audit(08/10/2023 09:13:46.699:360) : proctitle=/usr/sbin/keepalived --dont-fork -D 
type=PATH msg=audit(08/10/2023 09:13:46.699:360) : item=0 name=/run inode=1 dev=00:18 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:var_run_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(08/10/2023 09:13:46.699:360) : cwd=/etc/keepalived 
type=SYSCALL msg=audit(08/10/2023 09:13:46.699:360) : arch=x86_64 syscall=statfs success=yes exit=0 a0=0x55fe85983de0 a1=0x7ffc36d0e660 a2=0x55fbda706783 a3=0x0 items=1 ppid=4826 pid=4828 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=keepalived exe=/usr/sbin/keepalived subj=system_u:system_r:keepalived_t:s0 key=(null) 
type=AVC msg=audit(08/10/2023 09:13:46.699:360) : avc:  denied  { getattr } for  pid=4828 comm=keepalived name=/ dev="tmpfs" ino=1 scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=filesystem permissive=1 
----
type=PROCTITLE msg=audit(08/10/2023 09:13:46.700:361) : proctitle=/usr/sbin/keepalived --dont-fork -D 
type=PATH msg=audit(08/10/2023 09:13:46.700:361) : item=0 name=/run/ inode=1 dev=00:18 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:var_run_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(08/10/2023 09:13:46.700:361) : cwd=/ 
type=SYSCALL msg=audit(08/10/2023 09:13:46.700:361) : arch=x86_64 syscall=inotify_add_watch success=yes exit=1 a0=0xb a1=0x55fe85978ba0 a2=0x2c8 a3=0x20950 items=1 ppid=4826 pid=4828 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=keepalived exe=/usr/sbin/keepalived subj=system_u:system_r:keepalived_t:s0 key=(null) 
type=AVC msg=audit(08/10/2023 09:13:46.700:361) : avc:  denied  { watch } for  pid=4828 comm=keepalived path=/run dev="tmpfs" ino=1 scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=dir permissive=1 
----

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:6617