Bug 2223725
| Summary: | SELinux prevents named and rndc from io_uring actions | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Milos Malik <mmalik> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 38 | CC: | abokovoy, dwalsh, lvrabec, mmalik, nknazeko, omosnacek, pkoncity, quintela, vmojzis, zpytela |
| Target Milestone: | --- | Keywords: | Triaged |
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-38.22-1.fc38 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-08-01 02:49:23 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
The same SELinux denials appeared in permissive mode:
----
type=PROCTITLE msg=audit(07/18/2023 12:21:52.481:952) : proctitle=/usr/sbin/rndc stop
type=SYSCALL msg=audit(07/18/2023 12:21:52.481:952) : arch=x86_64 syscall=io_uring_setup success=yes exit=4 a0=0x40 a1=0x7ffdf703b930 a2=0x0 a3=0x1f0 items=0 ppid=36835 pid=36836 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=rndc exe=/usr/sbin/rndc subj=system_u:system_r:ndc_t:s0 key=(null)
type=AVC msg=audit(07/18/2023 12:21:52.481:952) : avc: denied { sqpoll } for pid=36836 comm=rndc scontext=system_u:system_r:ndc_t:s0 tcontext=system_u:system_r:ndc_t:s0 tclass=io_uring permissive=1
type=AVC msg=audit(07/18/2023 12:21:52.481:952) : avc: denied { ipc_lock } for pid=36836 comm=rndc capability=ipc_lock scontext=system_u:system_r:ndc_t:s0 tcontext=system_u:system_r:ndc_t:s0 tclass=capability permissive=1
----
type=PROCTITLE msg=audit(07/18/2023 12:21:52.541:956) : proctitle=/usr/sbin/named -u named -c /etc/named.conf
type=SYSCALL msg=audit(07/18/2023 12:21:52.541:956) : arch=x86_64 syscall=io_uring_setup success=yes exit=8 a0=0x40 a1=0x7ffde6aa82a0 a2=0x0 a3=0x555cd9be63f0 items=0 ppid=36845 pid=36846 auid=unset uid=named gid=named euid=named suid=named fsuid=named egid=named sgid=named fsgid=named tty=(none) ses=unset comm=named exe=/usr/sbin/named subj=system_u:system_r:named_t:s0 key=(null)
type=AVC msg=audit(07/18/2023 12:21:52.541:956) : avc: denied { sqpoll } for pid=36846 comm=named scontext=system_u:system_r:named_t:s0 tcontext=system_u:system_r:named_t:s0 tclass=io_uring permissive=1
----
One of the reproducers is:
# service named restart
# ldd /usr/sbin/rndc | grep libuv libuv.so.1 => /lib64/libuv.so.1 (0x00007f853a9bb000) # ldd /usr/sbin/named | grep libuv libuv.so.1 => /lib64/libuv.so.1 (0x00007f252b7a4000) # strings /lib64/libuv.so.1 | grep io_uring libuv: io_uring_enter(wakeup) libuv: io_uring_enter(getevents) uv__poll_io_uring # *** Bug 2224352 has been marked as a duplicate of this bug. *** FEDORA-2023-0b46b767d3 has been submitted as an update to Fedora 38. https://bodhi.fedoraproject.org/updates/FEDORA-2023-0b46b767d3 FEDORA-2023-0b46b767d3 has been pushed to the Fedora 38 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2023-0b46b767d3` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-0b46b767d3 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. *** Bug 2226703 has been marked as a duplicate of this bug. *** FEDORA-2023-0b46b767d3 has been pushed to the Fedora 38 stable repository. If problem still persists, please make note of it in this bug report. |
bind-9.18.16-1.fc39.x86_64 bind-chroot-9.18.16-1.fc39.x86_64 bind-dnssec-utils-9.18.16-1.fc39.x86_64 bind-libs-9.18.16-1.fc39.x86_64 bind-license-9.18.16-1.fc39.noarch bind-utils-9.18.16-1.fc39.x86_64 selinux-policy-38.20-1.fc39.noarch selinux-policy-devel-38.20-1.fc39.noarch selinux-policy-targeted-38.20-1.fc39.noarch Reproducible: Always Steps to Reproduce: 1. get a Fedora rawhide machine (targeted policy is active) 2. start the named service 3. search for SELinux denials Actual Results: ---- type=PROCTITLE msg=audit(07/18/2023 11:57:52.157:925) : proctitle=/usr/sbin/named -u named -c /etc/named.conf type=SYSCALL msg=audit(07/18/2023 11:57:52.157:925) : arch=x86_64 syscall=io_uring_setup success=no exit=EACCES(Permission denied) a0=0x40 a1=0x7fffbb6a9020 a2=0x0 a3=0x56537b7683f0 items=0 ppid=35360 pid=35361 auid=unset uid=named gid=named euid=named suid=named fsuid=named egid=named sgid=named fsgid=named tty=(none) ses=unset comm=named exe=/usr/sbin/named subj=system_u:system_r:named_t:s0 key=(null) type=AVC msg=audit(07/18/2023 11:57:52.157:925) : avc: denied { sqpoll } for pid=35361 comm=named scontext=system_u:system_r:named_t:s0 tcontext=system_u:system_r:named_t:s0 tclass=io_uring permissive=0 ---- type=PROCTITLE msg=audit(07/18/2023 11:57:57.489:927) : proctitle=rndc querylog type=SYSCALL msg=audit(07/18/2023 11:57:57.489:927) : arch=x86_64 syscall=io_uring_setup success=no exit=EACCES(Permission denied) a0=0x40 a1=0x7ffcb21285e0 a2=0x0 a3=0x1f0 items=0 ppid=24105 pid=35595 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts1 ses=4 comm=rndc exe=/usr/sbin/rndc subj=system_u:system_r:ndc_t:s0 key=(null) type=AVC msg=audit(07/18/2023 11:57:57.489:927) : avc: denied { sqpoll } for pid=35595 comm=rndc scontext=system_u:system_r:ndc_t:s0 tcontext=system_u:system_r:ndc_t:s0 tclass=io_uring permissive=0 type=AVC msg=audit(07/18/2023 11:57:57.489:927) : avc: denied { ipc_lock } for pid=35595 comm=rndc capability=ipc_lock scontext=system_u:system_r:ndc_t:s0 tcontext=system_u:system_r:ndc_t:s0 tclass=capability permissive=0 ---- Expected Results: no SELinux denials