Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
its fresh installation of rhel7 from 20131115.
After few hours of running it just happened without any specific user action.
SELinux is preventing /usr/sbin/rsyslogd from 'open' accesses on the chr_file /dev/pts/0.
***** Plugin catchall_boolean (47.5 confidence) suggests ******************
If you want to allow logging to syslogd use tty
Then you must tell SELinux about this by enabling the 'logging_syslogd_use_tty' boolean.
You can read 'None' man page for more details.
Do
setsebool -P logging_syslogd_use_tty 1
***** Plugin catchall_boolean (47.5 confidence) suggests ******************
If you want to allow daemons to use tty
Then you must tell SELinux about this by enabling the 'daemons_use_tty' boolean.
You can read 'None' man page for more details.
Do
setsebool -P daemons_use_tty 1
***** Plugin catchall (6.38 confidence) suggests **************************
If you believe that rsyslogd should be allowed open access on the 0 chr_file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep 72733A6D61696E20513A526567 /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp
Additional Information:
Source Context system_u:system_r:syslogd_t:s0
Target Context unconfined_u:object_r:user_devpts_t:s0
Target Objects /dev/pts/0 [ chr_file ]
Source 72733A6D61696E20513A526567
Source Path /usr/sbin/rsyslogd
Port <Unknown>
Host (removed)
Source RPM Packages rsyslog-7.4.2-3.el7.x86_64
Target RPM Packages
Policy RPM selinux-policy-3.12.1-99.el7.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Permissive
Host Name (removed)
Platform Linux (removed) 3.10.0-50.el7.x86_64 #1 SMP Wed
Nov 13 13:00:07 EST 2013 x86_64 x86_64
Alert Count 1
First Seen 2013-11-15 17:57:26 GMT
Last Seen 2013-11-15 17:57:26 GMT
Local ID c8d7fd6c-b79d-49c0-a46b-e370599ce536
Raw Audit Messages
type=AVC msg=audit(1384538246.601:1529): avc: denied { open } for pid=927 comm=72733A6D61696E20513A526567 path="/dev/pts/0" dev="devpts" ino=3 scontext=system_u:system_r:syslogd_t:s0 tcontext=unconfined_u:object_r:user_devpts_t:s0 tclass=chr_file
type=SYSCALL msg=audit(1384538246.601:1529): arch=x86_64 syscall=open success=yes exit=ENOMEM a0=7fe84880a520 a1=901 a2=8 a3=1 items=0 ppid=1 pid=927 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=72733A6D61696E20513A526567 exe=/usr/sbin/rsyslogd subj=system_u:system_r:syslogd_t:s0 key=(null)
Hash: 72733A6D61696E20513A526567,syslogd_t,user_devpts_t,chr_file,open
Additional info:
reporter: libreport-2.1.7
hashmarkername: setroubleshoot
kernel: 3.10.0-50.el7.x86_64
type: libreport
If you want to allow logging to syslogd use tty
Then you must tell SELinux about this by enabling the 'logging_syslogd_use_tty' boolean.
You can read 'None' man page for more details.
Do
setsebool -P logging_syslogd_use_tty 1
Description of problem: its fresh installation of rhel7 from 20131115. After few hours of running it just happened without any specific user action. SELinux is preventing /usr/sbin/rsyslogd from 'open' accesses on the chr_file /dev/pts/0. ***** Plugin catchall_boolean (47.5 confidence) suggests ****************** If you want to allow logging to syslogd use tty Then you must tell SELinux about this by enabling the 'logging_syslogd_use_tty' boolean. You can read 'None' man page for more details. Do setsebool -P logging_syslogd_use_tty 1 ***** Plugin catchall_boolean (47.5 confidence) suggests ****************** If you want to allow daemons to use tty Then you must tell SELinux about this by enabling the 'daemons_use_tty' boolean. You can read 'None' man page for more details. Do setsebool -P daemons_use_tty 1 ***** Plugin catchall (6.38 confidence) suggests ************************** If you believe that rsyslogd should be allowed open access on the 0 chr_file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep 72733A6D61696E20513A526567 /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:syslogd_t:s0 Target Context unconfined_u:object_r:user_devpts_t:s0 Target Objects /dev/pts/0 [ chr_file ] Source 72733A6D61696E20513A526567 Source Path /usr/sbin/rsyslogd Port <Unknown> Host (removed) Source RPM Packages rsyslog-7.4.2-3.el7.x86_64 Target RPM Packages Policy RPM selinux-policy-3.12.1-99.el7.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 3.10.0-50.el7.x86_64 #1 SMP Wed Nov 13 13:00:07 EST 2013 x86_64 x86_64 Alert Count 1 First Seen 2013-11-15 17:57:26 GMT Last Seen 2013-11-15 17:57:26 GMT Local ID c8d7fd6c-b79d-49c0-a46b-e370599ce536 Raw Audit Messages type=AVC msg=audit(1384538246.601:1529): avc: denied { open } for pid=927 comm=72733A6D61696E20513A526567 path="/dev/pts/0" dev="devpts" ino=3 scontext=system_u:system_r:syslogd_t:s0 tcontext=unconfined_u:object_r:user_devpts_t:s0 tclass=chr_file type=SYSCALL msg=audit(1384538246.601:1529): arch=x86_64 syscall=open success=yes exit=ENOMEM a0=7fe84880a520 a1=901 a2=8 a3=1 items=0 ppid=1 pid=927 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=72733A6D61696E20513A526567 exe=/usr/sbin/rsyslogd subj=system_u:system_r:syslogd_t:s0 key=(null) Hash: 72733A6D61696E20513A526567,syslogd_t,user_devpts_t,chr_file,open Additional info: reporter: libreport-2.1.7 hashmarkername: setroubleshoot kernel: 3.10.0-50.el7.x86_64 type: libreport