Bug 800013

Summary: avc denial : comm="ldconfig" path="/usr/lib/python2.7/site-packages/beah/bin/srv.py"
Product: Red Hat Enterprise Linux 7 Reporter: Petr Sklenar <psklenar>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED CURRENTRELEASE QA Contact: Milos Malik <mmalik>
Severity: unspecified Docs Contact:
Priority: high    
Version: 7.0CC: mmalik
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-06-13 10:36:17 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Petr Sklenar 2012-03-05 15:45:05 UTC 
Description of problem:
There is avc denial : comm="ldconfig" path="/usr/lib/python2.7/site-packages/beah/bin/srv.py"

Version-Release number of selected component (if applicable):
RHEL-7.0-20120301.n.0-Server-x86_64

How reproducible:
always on rhel7

Steps to Reproduce:
1.
2.
3.
  
Actual results:
----
time->Thu Mar  1 18:53:31 2012
type=SYSCALL msg=audit(1330646011.292:59): arch=c000003e syscall=59 success=yes exit=0 a0=1b0cd80 a1=1b0c160 a2=1b0bda0 a3=7fff076e8a70 items=0 ppid=1137 pid=1139 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ldconfig" exe="/sbin/ldconfig" subj=system_u:system_r:ldconfig_t:s0 key=(null)

----
time->Thu Mar  1 18:53:31 2012
type=SYSCALL msg=audit(1330646011.374:60): arch=c000003e syscall=59 success=yes exit=0 a0=1205d80 a1=1205160 a2=1204da0 a3=7fff0d6e3e40 items=0 ppid=1140 pid=1146 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ldconfig" exe="/sbin/ldconfig" subj=system_u:system_r:ldconfig_t:s0 key=(null)



Expected results:
no denial on ldconfig

Additional info:
this avc is mentioned at bug 796782 or bug 795668 - but its for subscription manager.
Comment 1 Milos Malik 2012-03-06 07:45:29 UTC 
Petr forgot to copy the "type=AVC" part of the audit records. Complete audit records are here:

----
time->Thu Mar  1 18:53:31 2012
type=SYSCALL msg=audit(1330646011.292:59): arch=c000003e syscall=59 success=yes exit=0 a0=1b0cd80 a1=1b0c160 a2=1b0bda0 a3=7fff076e8a70 items=0 ppid=1137 pid=1139 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ldconfig" exe="/sbin/ldconfig" subj=system_u:system_r:ldconfig_t:s0 key=(null)
type=AVC msg=audit(1330646011.292:59): avc:  denied  { read } for  pid=1139 comm="ldconfig" path="/usr/lib/python2.7/site-packages/beah/bin/srv.py" dev=dm-1 ino=792328 scontext=system_u:system_r:ldconfig_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file
----
time->Thu Mar  1 18:53:31 2012
type=SYSCALL msg=audit(1330646011.374:60): arch=c000003e syscall=59 success=yes exit=0 a0=1205d80 a1=1205160 a2=1204da0 a3=7fff0d6e3e40 items=0 ppid=1140 pid=1146 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ldconfig" exe="/sbin/ldconfig" subj=system_u:system_r:ldconfig_t:s0 key=(null)
type=AVC msg=audit(1330646011.374:60): avc:  denied  { read } for  pid=1146 comm="ldconfig" path="/usr/lib/python2.7/site-packages/beah/bin/srv.py" dev=dm-1 ino=792328 scontext=system_u:system_r:ldconfig_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file
----
Comment 2 Daniel Walsh 2012-03-06 21:58:50 UTC 
This is a leaked file descriptor in beah package most likely
Comment 3 Ales Zelinka 2012-03-08 14:42:21 UTC 
Is this a duplicate of https://bugzilla.redhat.com/show_bug.cgi?id=797177 ?
Comment 4 Milos Malik 2012-03-08 14:59:27 UTC 
It seems so.
Comment 6 Daniel Walsh 2012-04-09 13:28:13 UTC 
Fixed in current release.
Comment 9 Ludek Smid 2014-06-13 10:36:17 UTC 
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.