Bug 858784
| Summary: | pulse fails to start IPVS sync daemon | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Ryan O'Hara <rohara> | ||||
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | 6.4 | CC: | dwalsh, mmalik, rohara | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | selinux-policy-3.7.19-168.el6 | Doc Type: | Bug Fix | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | |||||||
| : | 859338 (view as bug list) | Environment: | |||||
| Last Closed: | 2013-02-21 08:30:37 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | |||||||
| Bug Blocks: | 859338 | ||||||
| Attachments: |
|
||||||
Looks like pulse can start all initrc domains in F18. Yes and I added it also to RHEL6.4. Following AVCs appear in permissive mode:
----
type=PATH msg=audit(09/21/2012 09:25:11.167:47267) : item=1 name=(null) inode=21292 dev=08:03 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:ld_so_t:s0
type=PATH msg=audit(09/21/2012 09:25:11.167:47267) : item=0 name=/sbin/ipvsadm inode=176213 dev=08:03 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:iptables_exec_t:s0
type=CWD msg=audit(09/21/2012 09:25:11.167:47267) : cwd=/
type=EXECVE msg=audit(09/21/2012 09:25:11.167:47267) : argc=3 a0=/sbin/ipvsadm a1=--stop-daemon a2=backup
type=SYSCALL msg=audit(09/21/2012 09:25:11.167:47267) : arch=i386 syscall=execve success=yes exit=0 a0=8508008 a1=bf831308 a2=bf831c0c a3=40000003 items=2 ppid=8396 pid=8398 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=21 comm=ipvsadm exe=/sbin/ipvsadm subj=unconfined_u:system_r:piranha_pulse_t:s0 key=(null)
type=AVC msg=audit(09/21/2012 09:25:11.167:47267) : avc: denied { execute_no_trans } for pid=8398 comm=pulse path=/sbin/ipvsadm dev=sda3 ino=176213 scontext=unconfined_u:system_r:piranha_pulse_t:s0 tcontext=system_u:object_r:iptables_exec_t:s0 tclass=file
type=AVC msg=audit(09/21/2012 09:25:11.167:47267) : avc: denied { read open } for pid=8398 comm=pulse name=ipvsadm dev=sda3 ino=176213 scontext=unconfined_u:system_r:piranha_pulse_t:s0 tcontext=system_u:object_r:iptables_exec_t:s0 tclass=file
type=AVC msg=audit(09/21/2012 09:25:11.167:47267) : avc: denied { execute } for pid=8398 comm=pulse name=ipvsadm dev=sda3 ino=176213 scontext=unconfined_u:system_r:piranha_pulse_t:s0 tcontext=system_u:object_r:iptables_exec_t:s0 tclass=file
----
type=SOCKETCALL msg=audit(09/21/2012 09:25:11.185:47268) : nargs=3 a0=10 a1=3 a2=10
type=SYSCALL msg=audit(09/21/2012 09:25:11.185:47268) : arch=i386 syscall=socketcall(socket) success=yes exit=3 a0=1 a1=bfededf0 a2=6f87314 a3=86f31e0 items=0 ppid=8396 pid=8398 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=21 comm=ipvsadm exe=/sbin/ipvsadm subj=unconfined_u:system_r:piranha_pulse_t:s0 key=(null)
type=AVC msg=audit(09/21/2012 09:25:11.185:47268) : avc: denied { create } for pid=8398 comm=ipvsadm scontext=unconfined_u:system_r:piranha_pulse_t:s0 tcontext=unconfined_u:system_r:piranha_pulse_t:s0 tclass=netlink_socket
----
type=SOCKETCALL msg=audit(09/21/2012 09:25:11.191:47269) : nargs=5 a0=3 a1=1 a2=7 a3=bfededf8 a4=4
type=SYSCALL msg=audit(09/21/2012 09:25:11.191:47269) : arch=i386 syscall=socketcall(setsockopt) success=yes exit=0 a0=e a1=bfededc0 a2=6f87314 a3=86f31e0 items=0 ppid=8396 pid=8398 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=21 comm=ipvsadm exe=/sbin/ipvsadm subj=unconfined_u:system_r:piranha_pulse_t:s0 key=(null)
type=AVC msg=audit(09/21/2012 09:25:11.191:47269) : avc: denied { setopt } for pid=8398 comm=ipvsadm scontext=unconfined_u:system_r:piranha_pulse_t:s0 tcontext=unconfined_u:system_r:piranha_pulse_t:s0 tclass=netlink_socket
----
type=SOCKADDR msg=audit(09/21/2012 09:25:11.192:47270) : saddr=netlink pid:8398
type=SOCKETCALL msg=audit(09/21/2012 09:25:11.192:47270) : nargs=3 a0=3 a1=86f31e0 a2=c
type=SYSCALL msg=audit(09/21/2012 09:25:11.192:47270) : arch=i386 syscall=socketcall(bind) success=yes exit=0 a0=2 a1=bfededf0 a2=6f87314 a3=86f31e0 items=0 ppid=8396 pid=8398 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=21 comm=ipvsadm exe=/sbin/ipvsadm subj=unconfined_u:system_r:piranha_pulse_t:s0 key=(null)
type=AVC msg=audit(09/21/2012 09:25:11.192:47270) : avc: denied { bind } for pid=8398 comm=ipvsadm scontext=unconfined_u:system_r:piranha_pulse_t:s0 tcontext=unconfined_u:system_r:piranha_pulse_t:s0 tclass=netlink_socket
----
type=SOCKADDR msg=audit(09/21/2012 09:25:11.192:47271) : saddr=netlink pid:8398
type=SOCKETCALL msg=audit(09/21/2012 09:25:11.192:47271) : nargs=3 a0=3 a1=86f31e0 a2=bfedee1c
type=SYSCALL msg=audit(09/21/2012 09:25:11.192:47271) : arch=i386 syscall=socketcall(getsockname) success=yes exit=0 a0=6 a1=bfededf0 a2=6f87314 a3=86f31e0 items=0 ppid=8396 pid=8398 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=21 comm=ipvsadm exe=/sbin/ipvsadm subj=unconfined_u:system_r:piranha_pulse_t:s0 key=(null)
type=AVC msg=audit(09/21/2012 09:25:11.192:47271) : avc: denied { getattr } for pid=8398 comm=ipvsadm scontext=unconfined_u:system_r:piranha_pulse_t:s0 tcontext=unconfined_u:system_r:piranha_pulse_t:s0 tclass=netlink_socket
----
Milos,
could you test this local policy
# cat mypol.te
policy_module(mypol, 1.0)
require{
attribute initrc_domain;
}
typeattribute piranha_pulse_t initrc_domain;
Did not help. I still see those AVCs. Exactly the same? I mean AVC related to iptables should go away. The list of AVCs caught in permissive mode is the same as before. Ah, I see it now. I need to add initrc_domain attribute also to init_system_domain. Could you test it with iptables_domtrans() in a local policy? When following policy module is enabled then no AVCs appear.
policy_module(mypol, 1.0)
require{
type piranha_pulse_t;
}
iptables_domtrans(piranha_pulse_t)
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2013-0314.html |
Created attachment 614473 [details] AVC denials from pulse when attempting to fork/exec ipvsadm. When selinux is enforcing, pulse fails to start the IPVS sync daemon at startup. If selinux is disabled to set to permissive mode, the sync daemon is started by pulse as expected. # rpm -q selinux-policy selinux-policy-3.7.19-154.el6.noarch 1. Chec that selinux is in enforcing mode: # getenforce Enforcing 2. Check that sync daemon is enabled: # grep sync /etc/sysconfig/ha/lvs.cf syncdaemon = 1 3. Start pulse: # service pulse start Starting pulse: [ OK ] 4. Check if sync daemon is running: # ipvsadm --list --daemon We expect to see this command print "master sync daemon (mcast=eth0, syncid=0)". If the sync daemon is enabled (syncdaemon = 1), pulse will fork and exec the ipvsadm command to start the sync daemon. Looking at the audit.log shows some AVC denials (see attachment). If set selinux to premissive mode and repeat the test, the sync daemon is started as expected. # setenforce 0 # getenforce Permissive # service pulse start Starting pulse: [ OK ] # ipvsadm --list --daemon master sync daemon (mcast=eth0, syncid=0)