Bug 812854

Summary:	package-cleanup fails to remove kernels when called from cron
Product:	Red Hat Enterprise Linux 6	Reporter:	Rik Theys <rik.theys>
Component:	selinux-policy	Assignee:	Miroslav Grepl <mgrepl>
Status:	CLOSED ERRATA	QA Contact:	Michal Trunecka <mtruneck>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	6.2	CC:	dwalsh, ebenes, mmalik, mtruneck
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	selinux-policy-3.7.19-146.el6	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-06-20 12:33:32 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Rik Theys 2012-04-16 12:48:36 UTC

Description of problem:

When called from a cron job, package-cleanup fails to remove kernels packages with the following error:

Error in PREUN scriptlet in rpm package kernel
kernel-2.6.32-220.4.2.el6.x86_64 was supposed to be removed but is not!

I believe this bug is the same as 750892 which was filed against Fedora 16?

Changing the selinux context of /usr/bin/package-cleanup to system_u:object_r:rpm_exec_t:s0 seems to fix this issue.

Would it be possible to include this policy update in a next update of the selinux-policy package?

Version-Release number of selected component (if applicable):


How reproducible:

always


Steps to Reproduce:
1. create a cron job that calls package-cleanup --oldkernels --count=1 -y
2. wait for the job to run
3.
  
Actual results:

package-cleanup fails to remove older kernels with the preun scriptlet error mentioned above.

Expected results:

Older kernels removed without errors.

Additional info:

When the package-cleanup command is called from a shell (unconfined), there is not error message and the packages are removed as expected.

Regards,

Rik

Comment 2 Milos Malik 2012-04-16 21:24:00 UTC

Following your instructions I believe I reproduced the problem:
----
time->Mon Apr 16 23:18:17 2012
type=SYSCALL msg=audit(1334611097.009:40968): arch=40000003 syscall=11 success=no exit=-13 a0=d489360 a1=d430180 a2=bfd06ccc a3=0 items=0 ppid=13147 pid=13150 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=13 comm="package-cleanup" exe="/usr/bin/python" subj=system_u:system_r:system_cronjob_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1334611097.009:40968): avc:  denied  { transition } for  pid=13150 comm="package-cleanup" path="/bin/bash" dev=sda3 ino=219786 scontext=system_u:system_r:system_cronjob_t:s0-s0:c0.c1023 tcontext=system_u:system_r:rpm_script_t:s0-s0:c0.c1023 tclass=process
----

# ls -Z /etc/cron.d/package-cleanup 
-rw-r--r--. root root system_u:object_r:system_cron_spool_t:s0 /etc/cron.d/package-cleanup
# cat /etc/cron.d/package-cleanup 
SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root
HOME=/
18 * * * * root package-cleanup --oldkernels --count=1 -y
#

Comment 4 Daniel Walsh 2012-04-17 13:49:13 UTC

And if you label /usr/bin/package-cleanup as rpm_exec_t, does it work?

Comment 5 Rik Theys 2012-04-17 13:54:39 UTC

Hi Daniel,

Yes, changing the label makes it work.

Regards,

Rik

Comment 6 Milos Malik 2012-04-17 14:05:20 UTC

If /usr/bin/package-cleanup is labelled rpm_exec_t then the scenario works without AVCs.

Comment 9 errata-xmlrpc 2012-06-20 12:33:32 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0780.html