Bug 510053

Summary: AVC denial on sa2 run
Product: [Fedora] Fedora Reporter: Jerry James <loganjerry>
Component: sysstatAssignee: Ivana Varekova <varekova>
Status: CLOSED INSUFFICIENT_DATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: 11CC: varekova
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-07-29 06:39:55 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Jerry James 2009-07-07 15:09:20 UTC
Description of problem:
I installed sysstat yesterday because I had a use for iostat.  Last night at 11:53, the sysstat cron job ran /usr/lib64/sa/sa2.  At that point, I got 3 AVC denials, all identical:

node=localhost.localdomain type=AVC msg=audit(1246945981.863:36711): avc: denied { read } for pid=26488 comm="find" name="mls" dev=selinuxfs ino=12 scontext=system_u:system_r:sysstat_t:s0-s0:c0.c1023 tcontext=system_u:object_r:security_t:s0 tclass=file

node=localhost.localdomain type=SYSCALL msg=audit(1246945981.863:36711): arch=c000003e syscall=2 success=no exit=-13 a0=7fff931f6ca0 a1=0 a2=7fff931f6cac a3=fffffff8 items=0 ppid=26480 pid=26488 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=101 comm="find" exe="/bin/find" subj=system_u:system_r:sysstat_t:s0-s0:c0.c1023 key=(null)

So it appears that sa2 tried to descend into /selinux and was denied.

Version-Release number of selected component (if applicable):
sysstat-8.0.4-7.fc11.x86_64

How reproducible:
I don't know.  It has only run once.  But given the symptoms, I expect this to happen every time the cron job runs.

Steps to Reproduce:
1. Install sysstat on a system with SELinux in enforcing mode.
2. Wait for the sysstat cron job to run at 11:53 PM.
  
Actual results:
AVC denials on /selinux.

Expected results:
No AVC denials.

Additional info:

Comment 1 Ivana Varekova 2009-07-15 13:08:06 UTC
Hello, 
I don't know any reason why sysstat should read mls file. 
Please could you change the row:
53 23 * * * root /usr/lib/sa/sa2 -A
to 
53 23 * * * root strace /usr/lib/sa/sa2 -A 2>&1 | grep ^open
in 
/etc/cron.d/sysstat
and write the result here.
And try to use command /usr/lib/sa/sa2 -A from command line and write the results here too.

Comment 2 Jerry James 2009-07-28 20:23:57 UTC
Sorry, I've been on vacation.  Looking back at the system logs, I see that I got the AVC denials the nights of July 6, 7, 8, and 9.  The AVC denial has not happened since then.  According to yum.log, I did not update any packages after installing sysstat on July 6 until I returned from vacation yesterday, July 27.  I'm mystified why the AVC denials should stop on their own like that.  I see that the statistics gathering has continued, since the timestamps on /var/log/sa/* are up to date.

I don't know what to say.  It looks like I can no longer reproduce the problem.  Running /usr/lib64/sa/sa2 -A produces the expected files in /var/log/sa, but no AVC denial and no terminal output.  <*Shrug*>  If it happens again, I'll let you know.

Comment 3 Ivana Varekova 2009-07-29 06:39:55 UTC
Thanks, for now, I'm closing this bug, but if the problem appears again please reopen it and paste here the data from comment #1.