Bug 677622

Summary: allow unconfined_t unlabeled_t:rawip_socket { read write };
Product: Red Hat Enterprise Linux 6 Reporter: Jaroslav Kortus <jkortus>
Component: kernelAssignee: Red Hat Kernel Manager <kernel-mgr>
Status: CLOSED DUPLICATE QA Contact: Red Hat Kernel QE team <kernel-qe>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 6.0CC: dwalsh, eparis, jmorris, nstraz, sds
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-02-16 16:59:46 EST Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Description Jaroslav Kortus 2011-02-15 06:44:04 EST
Description of problem:
During our cluster test one of the tool registers via rpc and distributes workload to member nodes. In RHEL6 this is denied by selinux.

Version-Release number of selected component (if applicable):

How reproducible:
via cluster dd_io test

Steps to Reproduce:
1. run dd_io test from rhel6 driver
Actual results:
time->Tue Feb 15 04:57:47 2011
type=SYSCALL msg=audit(1297767467.791:15310): arch=c000003e syscall=45 success=no exit=-13 a0=a a1=7fff4a0ce9d0 a2=1770 a3=0 items=0 ppid=14391 pid=14397 auid=14025 uid=14025 gid=14025 euid=14025 suid=14025 fsuid=14025 egid=14025 sgid=14025 fsgid=14025 tty=pts1 ses=2502 comm="d_iogen" exe="/tmp/sts-jk-6/bin/d_iogen" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1297767467.791:15310): avc:  denied  { read } for  pid=14397 comm="d_iogen" laddr= lport=34181 faddr= fport=44523 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s0 tclass=rawip_socket

Expected results:
no denial for unconfined_t

Additional info:
Comment 2 Nate Straz 2011-02-15 10:15:50 EST
Our test uses sctp sockets to distribute the load.
Comment 3 Daniel Walsh 2011-02-16 15:24:39 EST
This is a kernel issue, we should not be seeing unlabeled_t rawip_sockets.
Comment 4 Stephen Smalley 2011-02-16 15:44:18 EST
Lack of SELinux SCTP support is bug 517676.
Comment 5 Daniel Walsh 2011-02-16 16:59:46 EST

*** This bug has been marked as a duplicate of bug 517676 ***