Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1026654

Summary:	systemctl restart netlabel.service causes avc denial
Product:	Red Hat Enterprise Linux 7	Reporter:	Petr Sklenar <psklenar>
Component:	selinux-policy	Assignee:	Miroslav Grepl <mgrepl>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Milos Malik <mmalik>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.0	CC:	mmalik
Target Milestone:	rc	Keywords:	Regression
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	selinux-policy-3.12.1-98.el7	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-06-13 11:03:29 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Comment 5 Miroslav Grepl 2013-11-05 10:19:38 UTC

commit e31bedf5b4a61c83d3cd3323e2dac870d58244f5
Author: Miroslav Grepl <mgrepl>
Date:   Tue Nov 5 11:12:28 2013 +0100

    Allow netlabel-config to read meminfo

Comment 6 Milos Malik 2013-11-05 13:14:57 UTC

Actual results in permissive mode:
----
type=PATH msg=audit(11/05/2013 14:12:23.948:934) : item=0 name=/proc/meminfo inode=4026532027 dev=00:03 mode=file,444 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:proc_t:s0 objtype=NORMAL 
type=CWD msg=audit(11/05/2013 14:12:23.948:934) :  cwd=/ 
type=SYSCALL msg=audit(11/05/2013 14:12:23.948:934) : arch=x86_64 syscall=open success=yes exit=3 a0=0x38ca37c8cf a1=O_RDONLY|O_CLOEXEC a2=0x1b6 a3=0x0 items=1 ppid=1 pid=21489 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=netlabel-config exe=/usr/bin/bash subj=system_u:system_r:netlabel_mgmt_t:s0 key=(null) 
type=AVC msg=audit(11/05/2013 14:12:23.948:934) : avc:  denied  { open } for  pid=21489 comm=netlabel-config path=/proc/meminfo dev="proc" ino=4026532027 scontext=system_u:system_r:netlabel_mgmt_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file 
type=AVC msg=audit(11/05/2013 14:12:23.948:934) : avc:  denied  { read } for  pid=21489 comm=netlabel-config name=meminfo dev="proc" ino=4026532027 scontext=system_u:system_r:netlabel_mgmt_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file 
----
type=SYSCALL msg=audit(11/05/2013 14:12:23.953:935) : arch=x86_64 syscall=fstat success=yes exit=0 a0=0x3 a1=0x7fffc951af60 a2=0x7fffc951af60 a3=0x0 items=0 ppid=1 pid=21489 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=netlabel-config exe=/usr/bin/bash subj=system_u:system_r:netlabel_mgmt_t:s0 key=(null) 
type=AVC msg=audit(11/05/2013 14:12:23.953:935) : avc:  denied  { getattr } for  pid=21489 comm=netlabel-config path=/proc/meminfo dev="proc" ino=4026532027 scontext=system_u:system_r:netlabel_mgmt_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file 
----
type=PATH msg=audit(11/05/2013 14:12:23.954:936) : item=0 name=/etc/passwd inode=9960380 dev=fd:03 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:passwd_file_t:s0 objtype=NORMAL 
type=CWD msg=audit(11/05/2013 14:12:23.954:936) :  cwd=/ 
type=SYSCALL msg=audit(11/05/2013 14:12:23.954:936) : arch=x86_64 syscall=open success=yes exit=3 a0=0x7ff40bb3341a a1=O_RDONLY|O_CLOEXEC a2=0x1b6 a3=0x0 items=1 ppid=1 pid=21489 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=netlabel-config exe=/usr/bin/bash subj=system_u:system_r:netlabel_mgmt_t:s0 key=(null) 
type=AVC msg=audit(11/05/2013 14:12:23.954:936) : avc:  denied  { open } for  pid=21489 comm=netlabel-config path=/etc/passwd dev="vda3" ino=9960380 scontext=system_u:system_r:netlabel_mgmt_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file 
type=AVC msg=audit(11/05/2013 14:12:23.954:936) : avc:  denied  { read } for  pid=21489 comm=netlabel-config name=passwd dev="vda3" ino=9960380 scontext=system_u:system_r:netlabel_mgmt_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file 
----
type=SYSCALL msg=audit(11/05/2013 14:12:23.955:937) : arch=x86_64 syscall=fstat success=yes exit=0 a0=0x3 a1=0x7fffc951ce90 a2=0x7fffc951ce90 a3=0x0 items=0 ppid=1 pid=21489 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=netlabel-config exe=/usr/bin/bash subj=system_u:system_r:netlabel_mgmt_t:s0 key=(null) 
type=AVC msg=audit(11/05/2013 14:12:23.955:937) : avc:  denied  { getattr } for  pid=21489 comm=netlabel-config path=/etc/passwd dev="vda3" ino=9960380 scontext=system_u:system_r:netlabel_mgmt_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file 
----

Comment 10 Miroslav Grepl 2013-11-06 13:09:23 UTC

commit b2b42dd25e054a542bb566d66191efc4ca1f0cfc
Author: Miroslav Grepl <mgrepl>
Date:   Wed Nov 6 15:09:06 2013 +0100

    Allow netlabel-config to read passwd

Comment 12 Ludek Smid 2014-06-13 11:03:29 UTC

This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.