Bug 2236876

Summary:	Observing an SELinux denial when starting kdump.service on F40/Rawhide machine
Product:	[Fedora] Fedora	Reporter:	Aashish Radhakrishnan <aaradhak>
Component:	selinux-policy	Assignee:	Zdenek Pytela <zpytela>
Status:	CLOSED RAWHIDE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	rawhide	CC:	dwalsh, lvrabec, mmalik, nknazeko, omosnacek, pkoncity, vmojzis, zpytela
Target Milestone:	---	Keywords:	Triaged
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-09-25 07:23:02 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Aashish Radhakrishnan 2023-09-01 20:39:28 UTC

Description:

In Fedora CoreOS CI we noticed that our kdump.service seem to fail in the `ext.config.kdump.crash` test that is defined here: https://github.com/coreos/fedora-coreos-config/tree/testing-devel/tests/kola/kdump/crash

This issue is tracked in the Fedora CoreOS issue tracker at https://github.com/coreos/fedora-coreos-tracker/issues/1560


From the journal log, we can see that the kdump.service fails because of an avc denial:

```
 Aug 31 12:56:34.925329 kernel: audit: type=1400 audit(1693486594.923:5): avc:  denied  { write } for  pid=5538 comm="kexec" path=2F6D656D66643A6B65726E656C202864656C6574656429 dev="tmpfs" ino=8 scontext=system_u:system_r:kdump_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file permissive=0
Aug 31 12:56:34.928341 kdump.service[1360]: kdump: kexec: failed to load kdump kernel
Aug 31 12:56:34.928341 kdump.service[1360]: kdump: Starting kdump: [FAILED]
Aug 31 12:56:34.930701 init.scope[1]: kdump.service: Main process exited, code=exited, status=1/FAILURE
Aug 31 12:56:34.931202 init.scope[1]: kdump.service: Failed with result 'exit-code'.
Aug 31 12:56:34.934342 init.scope[1]: Failed to start kdump.service - Crash recovery kernel arming.
Aug 31 12:56:34.938215 init.scope[1]: Startup finished in 1.124s (kernel) + 4.497s (initrd) + 28.538s (userspace) = 34.160s.
Aug 31 12:56:34.938342 init.scope[1]: kdump.service: Consumed 19.389s CPU time.
Aug 31 12:56:35.462584 kola-runext.service[4943]: + for _x in {0..60}
```


If we set selinux to permissive mode with `enforcing=0` then we see two denials:

```
Sep  1 15:54:32.042762 kdump.service[1719]: *** Squashing the files inside the initramfs done ***
Sep  1 15:54:32.047391 kdump.service[1719]: *** Creating image file '/var/lib/kdump/initramfs-6.6.0-0.rc0.20230830git6c1b980a7e79.1.fc40.x86_64kdump.img' ***
Sep  1 15:54:32.350746 kdump.service[1719]: *** Creating initramfs image file '/var/lib/kdump/initramfs-6.6.0-0.rc0.20230830git6c1b980a7e79.1.fc40.x86_64kdump.img' done ***
Sep  1 15:54:32.474674 kernel: kexec[5348]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set
Sep  1 15:54:32.474876 kernel: audit: type=1400 audit(1693583672.473:4): avc:  denied  { write } for  pid=5348 comm="kexec" path=2F6D656D66643A6B65726E656C202864656C6574656429 dev="tmpfs" ino=8 scontext=system_u:system_r:kdump_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file permissive=1
Sep  1 15:54:32.480666 kernel: audit: type=1400 audit(1693583672.479:5): avc:  denied  { read } for  pid=5348 comm="kexec" path=2F6D656D66643A6B65726E656C202864656C6574656429 dev="tmpfs" ino=8 scontext=system_u:system_r:kdump_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file permissive=1
Sep  1 15:54:32.484689 kernel: PKCS7: Message signed outside of X.509 validity window
Sep  1 15:54:32.508762 init.scope[1]: systemd-hostnamed.service: Deactivated successfully.
Sep  1 15:54:32.546676 kdump.service[1353]: kdump: kexec: loaded kdump kernel
Sep  1 15:54:32.547187 kdump.service[1353]: kdump: Starting kdump: [OK]
```

I have attached the full journal logs from a run on a system with `enforcing=0` set to illustrate all denials.


Reproducible: Always

Steps to Reproduce:
1. On Fedora rawhide machine with latest package set.
2. Set crashkernel=512M kernel argument and reboot
3. Enable kdump.service
4. Observe failure and SELinux denial.


Actual Results:  
kdump.service doesn’t start


Expected Results:  
kdump.service starts


Additional info:
rpm -q kernel kexec-tools selinux-policy-targeted
kernel-6.6.0-0.rc0.20230830git6c1b980a7e79.1.fc40.x86_64
kexec-tools-2.0.27-1.fc40.x86_64
selinux-policy-targeted-38.26-1.fc40.noarch

Comment 2 Zdenek Pytela 2023-09-04 06:54:29 UTC

We already have a PR resolving the issue

Comment 3 Milos Malik 2023-09-13 11:06:24 UTC

Before the fix was applied, the following SELinux denial appeared in enforcing mode:
----
type=PROCTITLE msg=audit(09/13/2023 07:02:41.422:200) : proctitle=/sbin/kexec -s -d -p --command-line=BOOT_IMAGE=(hd0,gpt2)/boot/vmlinuz-6.6.0-0.rc1.13.fc40.x86_64 ro net.ifnames=0 rhgb irqpoll  
type=SYSCALL msg=audit(09/13/2023 07:02:41.422:200) : arch=x86_64 syscall=write success=no exit=EACCES(Permission denied) a0=0x3 a1=0x7f9b3a60e010 a2=0xdf1b08 a3=0x22 items=0 ppid=4670 pid=5034 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=kexec exe=/usr/sbin/kexec subj=system_u:system_r:kdump_t:s0 key=(null) 
type=AVC msg=audit(09/13/2023 07:02:41.422:200) : avc:  denied  { write } for  pid=5034 comm=kexec path=/memfd:kernel (deleted) dev="tmpfs" ino=12 scontext=system_u:system_r:kdump_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file permissive=0 
----

Before the fix was applied, the following SELinux denials appeared in permissive mode:
----
type=PROCTITLE msg=audit(09/13/2023 07:04:23.219:204) : proctitle=/sbin/kexec -s -d -p --command-line=BOOT_IMAGE=(hd0,gpt2)/boot/vmlinuz-6.6.0-0.rc1.13.fc40.x86_64 ro net.ifnames=0 rhgb irqpoll  
type=SYSCALL msg=audit(09/13/2023 07:04:23.219:204) : arch=x86_64 syscall=write success=yes exit=14621448 a0=0x3 a1=0x7f412be0e010 a2=0xdf1b08 a3=0x22 items=0 ppid=5049 pid=5413 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=kexec exe=/usr/sbin/kexec subj=system_u:system_r:kdump_t:s0 key=(null) 
type=AVC msg=audit(09/13/2023 07:04:23.219:204) : avc:  denied  { write } for  pid=5413 comm=kexec path=/memfd:kernel (deleted) dev="tmpfs" ino=13 scontext=system_u:system_r:kdump_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file permissive=1 
----
type=PROCTITLE msg=audit(09/13/2023 07:04:23.224:205) : proctitle=/sbin/kexec -s -d -p --command-line=BOOT_IMAGE=(hd0,gpt2)/boot/vmlinuz-6.6.0-0.rc1.13.fc40.x86_64 ro net.ifnames=0 rhgb irqpoll  
type=SYSCALL msg=audit(09/13/2023 07:04:23.224:205) : arch=x86_64 syscall=kexec_file_load success=yes exit=0 a0=0x3 a1=0x4 a2=0x12f a3=0x556d3db9f9d0 items=0 ppid=5049 pid=5413 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=kexec exe=/usr/sbin/kexec subj=system_u:system_r:kdump_t:s0 key=(null) 
type=AVC msg=audit(09/13/2023 07:04:23.224:205) : avc:  denied  { read } for  pid=5413 comm=kexec path=/memfd:kernel (deleted) dev="tmpfs" ino=13 scontext=system_u:system_r:kdump_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file permissive=1 
----

# rpm -qa selinux\* kexec\* | sort
kexec-tools-2.0.27-1.fc40.x86_64
selinux-policy-38.27-1.fc40.noarch
selinux-policy-targeted-38.27-1.fc40.noarch
#