Created attachment 891744 [details] ami-63923f7e.yaml
Validation failed for ami-63923f7e in sa-east-1 product: RHEL, version: 7.0, arch: x86_64 m3.xlarge test stage1:testcase_01_bash_history succeeded test stage1:testcase_02_selinux_context succeeded test stage1:testcase_03_running_services succeeded test stage1:testcase_06_inittab succeeded test stage1:testcase_07_libc6_xen_conf succeeded test stage1:testcase_08_memory succeeded test stage1:testcase_09_nameserver succeeded test stage1:testcase_10_networking succeeded test stage1:testcase_11_package_set succeeded test stage1:testcase_14_host_details succeeded test stage1:testcase_15_rhel_version succeeded test stage1:testcase_16_selinux succeeded test stage1:testcase_17_shells succeeded test stage1:testcase_18_sshd succeeded test stage1:testcase_19_rhn_system_id succeeded test stage1:testcase_20_auditd succeeded test stage1:testcase_21_disk_size_format succeeded test stage1:testcase_25_uname succeeded test stage1:testcase_26_verify_rpms succeeded test stage1:testcase_27_yum_repos failed ---> actual repos: {'rhui-REGION-client-config-server-7-beta': True, 'rhui-REGION-rhel-server-releases-beta': True, 'rhui-REGION-rhel-server-releases-debug-beta': False, 'rhui-REGION-rhel-server-releases-source-beta': False} expected repos: {'rhui-REGION-client-config-server-7': True, 'rhui-REGION-rhel-server-releases-debug': False, 'rhui-REGION-rhel-server-releases': True, 'rhui-REGION-rhel-server-releases-source': False} result: failed <--- test stage1:testcase_31_subscription_management succeeded test stage1:testcase_32_ephemeral succeeded test stage1:testcase_33_userdata succeeded test stage1:testcase_34_cpu succeeded test stage1:testcase_35_console succeeded test stage1:testcase_360_ebs succeeded test stage1:testcase_39_root_is_locked succeeded test stage1:testcase_41_rh_amazon_rhui_client failed ---> actual: 1 command: rpm -q rh-amazon-rhui-client result: failed <--- test stage1:testcase_50_yum_package_install succeeded test stage1:testcase_55_yum_group_install failed ---> actual: 1 command: yum -y groupinstall 'Development tools' result: failed <--- ---> actual: 1 command: rpm -q glibc-devel result: failed <--- test stage1:testcase_60_yum_update succeeded test stage1:testcase_61_yum_proxy skipped ---> comment: No proxy set result: skip <--- test stage1:testcase_62_cpuflags succeeded test stage1:testcase_80_no_avc_denials succeeded test stage1:testcase_99_reboot succeeded test stage2:testcase_08_memory succeeded test stage2:testcase_25_uname succeeded test stage2:testcase_37_sshd_bug923996 succeeded test stage2:testcase_62_cpuflags succeeded test stage2:testcase_80_no_avc_denials failed ---> actual: echo START; grep 'avc:[[:space:]]*denied' /var/log/messages /var/log/audit/audit.log | grep -v userdata; echo END START /var/log/messages:May 2 03:56:08 ip-10-252-228-92 kernel: type=1400 audit(1399017368.406:4): avc: denied { write } for pid=242 comm="systemd-sysctl" name="shmmax" dev="proc" ino=8445 scontext=system_u:system_r:systemd_sysctl_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file /var/log/messages:May 2 03:56:08 ip-10-252-228-92 kernel: type=1400 audit(1399017368.418:5): avc: denied { write } for pid=242 comm="systemd-sysctl" name="shmall" dev="proc" ino=8446 scontext=system_u:system_r:systemd_sysctl_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file /var/log/messages:May 2 03:56:08 ip-10-252-228-92 kernel: type=1400 audit(1399017368.430:6): avc: denied { write } for pid=242 comm="systemd-sysctl" name="sysrq" dev="proc" ino=8447 scontext=system_u:system_r:systemd_sysctl_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file /var/log/messages:May 2 03:56:08 ip-10-252-228-92 kernel: type=1400 audit(1399017368.443:7): avc: denied { write } for pid=242 comm="systemd-sysctl" name="core_uses_pid" dev="proc" ino=8448 scontext=system_u:system_r:systemd_sysctl_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file /var/log/messages:May 2 03:56:08 ip-10-252-228-92 kernel: type=1400 audit(1399017368.443:8): avc: denied { write } for pid=242 comm="systemd-sysctl" name="rp_filter" dev="proc" ino=8452 scontext=system_u:system_r:systemd_sysctl_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file /var/log/messages:May 2 03:56:08 ip-10-252-228-92 kernel: type=1400 audit(1399017368.443:9): avc: denied { write } for pid=242 comm="systemd-sysctl" name="accept_source_route" dev="proc" ino=8453 scontext=system_u:system_r:systemd_sysctl_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file /var/log/messages:May 2 03:56:08 ip-10-252-228-92 kernel: type=1400 audit(1399017368.443:10): avc: denied { write } for pid=242 comm="systemd-sysctl" name="protected_hardlinks" dev="proc" ino=8455 scontext=system_u:system_r:systemd_sysctl_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file /var/log/audit/audit.log:type=AVC msg=audit(1399017371.335:33): avc: denied { write } for pid=576 comm="systemd-sysctl" name="shmmax" dev="proc" ino=8445 scontext=system_u:system_r:systemd_sysctl_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file /var/log/audit/audit.log:type=AVC msg=audit(1399017371.335:34): avc: denied { write } for pid=576 comm="systemd-sysctl" name="shmall" dev="proc" ino=8446 scontext=system_u:system_r:systemd_sysctl_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file /var/log/audit/audit.log:type=AVC msg=audit(1399017371.335:35): avc: denied { write } for pid=576 comm="systemd-sysctl" name="sysrq" dev="proc" ino=8447 scontext=system_u:system_r:systemd_sysctl_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file /var/log/audit/audit.log:type=AVC msg=audit(1399017371.335:36): avc: denied { write } for pid=576 comm="systemd-sysctl" name="core_uses_pid" dev="proc" ino=8448 scontext=system_u:system_r:systemd_sysctl_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file /var/log/audit/audit.log:type=AVC msg=audit(1399017371.335:37): avc: denied { write } for pid=576 comm="systemd-sysctl" name="rp_filter" dev="proc" ino=8452 scontext=system_u:system_r:systemd_sysctl_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file /var/log/audit/audit.log:type=AVC msg=audit(1399017371.335:38): avc: denied { write } for pid=576 comm="systemd-sysctl" name="accept_source_route" dev="proc" ino=8453 scontext=system_u:system_r:systemd_sysctl_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file /var/log/audit/audit.log:type=AVC msg=audit(1399017371.335:39): avc: denied { write } for pid=576 comm="systemd-sysctl" name="protected_hardlinks" dev="proc" ino=8455 scontext=system_u:system_r:systemd_sysctl_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file /var/log/audit/audit.log:type=AVC msg=audit(1399017371.335:40): avc: denied { write } for pid=576 comm="systemd-sysctl" name="protected_symlinks" dev="proc" ino=8456 scontext=system_u:system_r:systemd_sysctl_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file /var/log/audit/audit.log:type=AVC msg=audit(1399017371.772:43): avc: denied { write } for pid=727 comm="systemd-sysctl" name="shmmax" dev="proc" ino=8445 scontext=system_u:system_r:systemd_sysctl_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file /var/log/audit/audit.log:type=AVC msg=audit(1399017371.772:44): avc: denied { write } for pid=727 comm="systemd-sysctl" name="shmall" dev="proc" ino=8446 scontext=system_u:system_r:systemd_sysctl_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file /var/log/audit/audit.log:type=AVC msg=audit(1399017371.773:45): avc: denied { write } for pid=727 comm="systemd-sysctl" name="sysrq" dev="proc" ino=8447 scontext=system_u:system_r:systemd_sysctl_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file /var/log/audit/audit.log:type=AVC msg=audit(1399017371.773:46): avc: denied { write } for pid=727 comm="systemd-sysctl" name="core_uses_pid" dev="proc" ino=8448 scontext=system_u:system_r:systemd_sysctl_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file /var/log/audit/audit.log:type=AVC msg=audit(1399017371.773:47): avc: denied { write } for pid=727 comm="systemd-sysctl" name="rp_filter" dev="proc" ino=8452 scontext=system_u:system_r:systemd_sysctl_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file /var/log/audit/audit.log:type=AVC msg=audit(1399017371.773:48): avc: denied { write } for pid=727 comm="systemd-sysctl" name="accept_source_route" dev="proc" ino=8453 scontext=system_u:system_r:systemd_sysctl_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file /var/log/audit/audit.log:type=AVC msg=audit(1399017371.773:49): avc: denied { write } for pid=727 comm="systemd-sysctl" name="protected_hardlinks" dev="proc" ino=8455 scontext=system_u:system_r:systemd_sysctl_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file /var/log/audit/audit.log:type=AVC msg=audit(1399017371.773:50): avc: denied { write } for pid=727 comm="systemd-sysctl" name="protected_symlinks" dev="proc" ino=8456 scontext=system_u:system_r:systemd_sysctl_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file END [root@ip-10-252-228-92 ~]# command: echo START; grep 'avc:[[:space:]]*denied' /var/log/messages /var/log/audit/audit.log | grep -v userdata; echo END expectation: START END result: failed <---
Verified: rh-amazon-rhui-client-beta included, content was not released to production rhui, avc issues are not fixed in 3.10.0-54.0.1.el7 (https://bugzilla.redhat.com/show_bug.cgi?id=1071858)
housekeeping