Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1144158

Summary: SELinux: openssl cannot access /run/keystone
Product: Red Hat Enterprise Linux 7 Reporter: Richard Su <rwsu>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED NOTABUG QA Contact: Milos Malik <mmalik>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 7.0CC: mgrepl, mmalik, rwsu
Target Milestone: rcKeywords: Reopened
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-10-21 20:02:19 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
audit.log none

Description Richard Su 2014-09-18 19:47:38 UTC 
Created attachment 939026 [details]
audit.log

Description of problem:
openssl via keystone is unable to write to /run/keystone. /run/keystone is labeled as var_run_t. 

type=AVC msg=audit(1411007901.216:3108): avc:  denied  { setattr } for  pid=31407 comm="openssl" name=".rnd" dev="tmpfs" ino=76799 scontext=system_u:system_r:keystone_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=file
type=AVC msg=audit(1411008208.218:4024): avc:  denied  { getattr } for  pid=32069 comm="openssl" path="/run/keystone/.rnd" dev="tmpfs" ino=76799 scontext=system_u:system_r:keystone_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=file
type=AVC msg=audit(1411008208.219:4025): avc:  denied  { read } for  pid=32069 comm="openssl" name=".rnd" dev="tmpfs" ino=76799 scontext=system_u:system_r:keystone_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=file
type=AVC msg=audit(1411008208.219:4025): avc:  denied  { open } for  pid=32069 comm="openssl" path="/run/keystone/.rnd" dev="tmpfs" ino=76799 scontext=system_u:system_r:keystone_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=file
type=AVC msg=audit(1411008208.223:4026): avc:  denied  { write } for  pid=32069 comm="openssl" name=".rnd" dev="tmpfs" ino=76799 scontext=system_u:system_r:keystone_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=file
type=AVC msg=audit(1411008208.223:4027): avc:  denied  { setattr } for  pid=32069 comm="openssl" name=".rnd" dev="tmpfs" ino=76799 scontext=system_u:system_r:keystone_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=file

[root@localhost audit]# find / -inum 76799
/run/keystone/.rnd

[root@localhost audit]# ls -Z /run/keystone/.rnd
-rw-------. keystone keystone system_u:object_r:var_run_t:s0   /run/keystone/.rnd

Changing the label to keystone_var_lib_t appears to fix the problem.

[root@localhost audit]# ls -Z /run | grep keystone
drwxr-xr-x. keystone   keystone   unconfined_u:object_r:keystone_var_lib_t:s0 keystone

But I think we need a proper default label for /run/keystone similar to what was done in Fedora in BZ 1123013.


Version-Release number of selected component (if applicable):
openstack-selinux-0.5.15-1.el7ost.noarch
selinux-policy-3.12.1-153.el7_0.10.noarch
selinux-policy-targeted-3.12.1-153.el7_0.10.noarch

How reproducible:
always

Steps to Reproduce:
1. Install instack-undercloud via source.

Actual results:
openssl denials logged.

Expected results:
No denials are logged.

Additional info:
Comment 2 Richard Su 2014-09-30 22:52:05 UTC 
From the custom policy I generated, this may be related to BZ 1123013.
Comment 3 Miroslav Grepl 2014-10-02 11:10:26 UTC 
$ matchpathcon /run/keystone
/run/keystone	system_u:object_r:keystone_var_run_t:s0

If you execute

# restorecon -R -v /run/keystone

are you able to reproduce it?
Comment 4 Richard Su 2014-10-21 03:40:38 UTC 
[stack@localhost run]$ matchpathcon /run/keystone
/run/keystone	system_u:object_r:var_run_t:s0

How is it that you have keystone_var_run_t. I'm on 

selinux-policy-3.12.1-153.el7_0.11.noarch
selinux-policy-targeted-3.12.1-153.el7_0.11.noarch
openstack-selinux-0.5.15-1.el7ost.noarch

and I don't have it.

Running "restorecon -R -v /run/keystone" doesn't change anything.
Comment 5 Milos Malik 2014-10-21 07:09:50 UTC 
There is a rebased selinux-policy in RHEL-7.1:

# rpm -qa selinux-policy\*
selinux-policy-mls-3.13.1-6.el7.noarch
selinux-policy-doc-3.13.1-6.el7.noarch
selinux-policy-minimum-3.13.1-6.el7.noarch
selinux-policy-sandbox-3.13.1-6.el7.noarch
selinux-policy-devel-3.13.1-6.el7.noarch
selinux-policy-3.13.1-6.el7.noarch
selinux-policy-targeted-3.13.1-6.el7.noarch
# matchpathcon /run/keystone
/run/keystone	system_u:object_r:keystone_var_run_t:s0
# matchpathcon /var/run/keystone
/var/run/keystone	system_u:object_r:keystone_var_run_t:s0
#
Comment 6 Richard Su 2014-10-21 20:02:19 UTC 
Ok, not an issue with RHEL 7.1 so will close this bug.

I've open a separate bug to have a fix applied for RHOS. See BZ 1155287.