Bug 2225418
| Summary: | the /run/dhclient.* files are mislabeled when dhclient is executed by the cloud-init-local service | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Petr Sklenar <psklenar> |
| Component: | selinux-policy | Assignee: | Nobody <nobody> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 9.3 | CC: | lvrabec, mmalik, mosvald, zpytela |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-38.1.20-1.el9 | Doc Type: | No Doc Update |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-11-07 08:52:40 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Deadline: | 2023-08-08 | ||
Seen on 1MT-RHEL-9.3.0-20230718.0 machine: # restorecon -Rv /run/ Relabeled /run/dhclient.lease from system_u:object_r:var_run_t:s0 to system_u:object_r:dhcpc_var_run_t:s0 Relabeled /run/dhclient.pid from system_u:object_r:var_run_t:s0 to system_u:object_r:dhcpc_var_run_t:s0 Relabeled /run/NetworkManager/no-stub-resolv.conf from system_u:object_r:NetworkManager_var_run_t:s0 to system_u:object_r:net_conf_t:s0 # The dhclient.pid file must have been created by something else, because the following sequence works correctly: # rm -f /run/dhclient.* # ls -Z /var/run/dhclient.* ls: cannot access '/var/run/dhclient.*': No such file or directory # dhclient # ls -Z /var/run/dhclient.* unconfined_u:object_r:dhcpc_var_run_t:s0 /var/run/dhclient.pid # Based on SELinux denials shown in comment#0, the /var/run/dhclient.pid file is mislabeled and that's the reason why SELinux denials appear. If it was labeled correctly, no SELinux denials would have appeared. Correct SELinux context defined by SELinux policy is: # matchpathcon /var/run/dhclient.pid /var/run/dhclient.pid system_u:object_r:dhcpc_var_run_t:s0 # Comment#1 shows that execution of the dhclient program is not the cause. In order to fix the issue, we need to find out what process created the mislabeled file: /var/run/dhclient.pid This is from the cloud-init.log: - subp.py[DEBUG]: Running command ['/usr/sbin/dhclient', '-1', '-v', '-lf', '/run/dhclient.lease', '-pf', '/run/dhclient.pid', 'eth0', '-sf', '/bin/true'] with allowed return codes [0] (shell=False, capture=True) After restorecon and rebooting 1mt machine, the /var/run/dhclient.* got wrong label var_run_t. So I added type transition rule for cloud_init when creating dhclient.pid/lease, and after reboot it has correct label dhcpd_var_run_t. Can you please retest it, and confirm the fix with selinux-policy version 38.22-1.fc39.101? # dnf copr enable nknazeko/selinux-policy Thank you Nikola Fixed in other copr build, version 38.22-1.fc39.201, can you please test it? Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2023:6617 |
Description of problem: dhclient has avc denial Version-Release number of selected component (if applicable): dhcp-client-4.4.2-19.b1.el9.x86_64 selinux-policy-38.1.17-1.el9.noarch How reproducible: always Steps to Reproduce: 1. just run dhclient and you will see denial 2. ls -laZ /var/run/dhclient.pid -rw-r--r--. 1 root root system_u:object_r:var_run_t:s0 4 Jul 25 05:25 /var/run/dhclient.pid 3. Actual results: $ tail -f /var/log/audit/audit.log | grep den & [1] 5267 $ dhclient type=AVC msg=audit(1690277578.888:432): avc: denied { read } for pid=5269 comm="dhclient" name="dhclient.pid" dev="tmpfs" ino=778 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0 type=AVC msg=audit(1690277578.889:433): avc: denied { write } for pid=5269 comm="dhclient" name="dhclient.pid" dev="tmpfs" ino=778 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0 Can't create /var/run/dhclient.pid: Permission denied type=AVC msg=audit(1690277580.959:434): avc: denied { write } for pid=5269 comm="dhclient" name="dhclient.pid" dev="tmpfs" ino=778 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0 Expected results: no denial Additional info: