Bug 2213254
| Summary: | selinux denial appears for keepalived when using MISC_CHECK | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Juraj Hrdlica <jhrdlica> |
| Component: | selinux-policy | Assignee: | Nikola Knazekova <nknazeko> |
| Status: | CLOSED MIGRATED | QA Contact: | Milos Malik <mmalik> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 9.2 | CC: | bperkins, lvrabec, mmalik, rohara, zpytela |
| Target Milestone: | rc | Keywords: | MigratedToJIRA, Triaged |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | No Doc Update | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-08-23 08:28:31 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
# cp `which id` /usr/libexec/keepalived/misc_checker
# ls -lZ /usr/libexec/keepalived/misc_checker
-rwxr-xr-x. 1 root root unconfined_u:object_r:keepalived_unconfined_script_exec_t:s0 40472 Jun 7 12:42 /usr/libexec/keepalived/misc_checker
#
Caught in enforcing mode:
----
type=PROCTITLE msg=audit(06/07/2023 12:39:43.749:323) : proctitle=/usr/sbin/keepalived --dont-fork -D
type=PATH msg=audit(06/07/2023 12:39:43.749:323) : item=0 name=/usr/libexec/keepalived/misc_checker inode=8388737 dev=fd:01 mode=file,755 ouid=root ogid=root rdev=00:00 obj=unconfined_u:object_r:keepalived_unconfined_script_exec_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(06/07/2023 12:39:43.749:323) : cwd=/
type=SYSCALL msg=audit(06/07/2023 12:39:43.749:323) : arch=x86_64 syscall=utimensat success=no exit=EACCES(Permission denied) a0=AT_FDCWD a1=0x5626ec7f7590 a2=0x7ffee2a57340 a3=0x0 items=1 ppid=4620 pid=4621 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=keepalived exe=/usr/sbin/keepalived subj=system_u:system_r:keepalived_t:s0 key=(null)
type=AVC msg=audit(06/07/2023 12:39:43.749:323) : avc: denied { setattr } for pid=4621 comm=keepalived name=misc_checker dev="vda1" ino=8388737 scontext=system_u:system_r:keepalived_t:s0 tcontext=unconfined_u:object_r:keepalived_unconfined_script_exec_t:s0 tclass=file permissive=0
----
Caught in permissive mode:
----
type=PROCTITLE msg=audit(06/07/2023 12:40:36.993:330) : proctitle=/usr/sbin/keepalived --dont-fork -D
type=PATH msg=audit(06/07/2023 12:40:36.993:330) : item=0 name=/usr/libexec/keepalived/misc_checker inode=8388737 dev=fd:01 mode=file,755 ouid=root ogid=root rdev=00:00 obj=unconfined_u:object_r:keepalived_unconfined_script_exec_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(06/07/2023 12:40:36.993:330) : cwd=/
type=SYSCALL msg=audit(06/07/2023 12:40:36.993:330) : arch=x86_64 syscall=utimensat success=yes exit=0 a0=AT_FDCWD a1=0x56010a323590 a2=0x7ffe6f0629c0 a3=0x0 items=1 ppid=4659 pid=4660 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=keepalived exe=/usr/sbin/keepalived subj=system_u:system_r:keepalived_t:s0 key=(null)
type=AVC msg=audit(06/07/2023 12:40:36.993:330) : avc: denied { setattr } for pid=4660 comm=keepalived name=misc_checker dev="vda1" ino=8388737 scontext=system_u:system_r:keepalived_t:s0 tcontext=unconfined_u:object_r:keepalived_unconfined_script_exec_t:s0 tclass=file permissive=1
----
This looks like a RHEL 9 clone of bz#1997148. Juraj, do you happen to know why would keepalived want to run utimensat() on executed files? I do not know and have not found direct mentions of it the source code either. And it indeed seems to be the same issue as the bug you linked. Maybe Ryan has found out more since? Issue migration from Bugzilla to Jira is in process at this time. This will be the last message in Jira copied from the Bugzilla bug. This BZ has been automatically migrated to the issues.redhat.com Red Hat Issue Tracker. All future work related to this report will be managed there. To find the migrated issue, look in the "Links" section for a direct link to the new issue location. The issue key will have an icon of 2 footprints next to it, and begin with "RHEL-" followed by an integer. You can also find this issue by visiting https://issues.redhat.com/issues/?jql= and searching the "Bugzilla Bug" field for this BZ's number, e.g. a search like: "Bugzilla Bug" = 1234567 In the event you have trouble locating or viewing this issue, you can file an issue by sending mail to rh-issues. The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days |
Description of problem: Misconfigured selinux policy for keepalived triggers AVC denial when using MISC_CHECK in keepalived.conf Version-Release number of selected component (if applicable): keepalived-2.2.4-6.el9.x86_64 selinux-policy-38.1.14-1.el9.noarch How reproducible: always Steps to Reproduce: 1.Find location for keepalived scripts: $ semanage fcontext -l | grep keepalived_unconfined_script /usr/libexec/keepalived(/.*)? all files system_u:object_r:keepalived_unconfined_script_exec_t:s0 2.Create a script in this location: $ cat /usr/libexec/keepalived/misc_checker #!/usr/bin/bash true 3.Create a keepalived.conf file with MISC_CHECK: $ cat /etc/keepalived/keepalived.conf vrrp_instance VRRP_INSTANCE { state MASTER priority 128 advert_int 1 virtual_router_id 1 interface ens3 virtual_ipaddress {10.37.165.105} } virtual_server 10.37.165.105 80 { real_server 10.37.167.2 80 { weight 1 MISC_CHECK { misc_path /usr/libexec/keepalived/misc_checker retry 1 } } } 4.Start keepalived Actual results: Keepalived works but a selinux denial appears $ ausearch -m AVC,USER_AVC ---- time->Wed Jun 7 16:56:46 2023 type=PROCTITLE msg=audit(1686149806.955:980): proctitle=2F7573722F7362696E2F6B656570616C69766564002D2D646F6E742D666F726B002D44002D2D636F6E6669672D6964006D61696E type=SYSCALL msg=audit(1686149806.955:980): arch=c000003e syscall=280 success=no exit=-13 a0=ffffff9c a1=55df7dcb4c30 a2=7ffff3502c80 a3=0 items=0 ppid=63215 pid=63216 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="keepalived" exe="/usr/sbin/keepalived" subj=system_u:system_r:keepalived_t:s0 key=(null) type=AVC msg=audit(1686149806.955:980): avc: denied { setattr } for pid=63216 comm="keepalived" name="misc_checker" dev="dm-0" ino=9451029 scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:object_r:keepalived_unconfined_script_exec_t:s0 tclass=file permissive=0 Expected results: No denial