Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1145215

Summary: ocf:heartbeat:pqsql AVC denial messages
Product: Red Hat Enterprise Linux 7 Reporter: michal novacek <mnovacek>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED ERRATA QA Contact: Stanislav Zidek <szidek>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 7.0CC: mmalik, mnovacek, ssekidde, szidek
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: selinux-policy-3.13.1-26.el7 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 1233087 (view as bug list) Environment:
Last Closed: 2015-11-19 10:23:04 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1233087    

Description michal novacek 2014-09-22 14:51:48 UTC
Description of problem:
postgresql agent does not start with selinux enforcing policy but works
correctly in permissive.

Version-Release number of selected component (if applicable):
selinux-policy-3.12.1-155.el7.noarch
resource-agents-3.9.5-31.el7.x86_64

How reproducible: always

[root@host-050 ~]# ausearch -m AVC -m USER_AVC
----
time->Mon Sep 22 09:45:27 2014
type=USER_AVC msg=audit(1411397127.290:3795): pid=586 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.342 spid=581 tpid=24315 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:cluster_t:s0 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
----
time->Mon Sep 22 09:45:27 2014
type=SYSCALL msg=audit(1411397127.258:3789): arch=c000003e syscall=62 success=no exit=-13 a0=4ee1 a1=2 a2=7fb9714fefd8 a3=7fff86878c80 items=0 ppid=24301 pid=24302 auid=4294967295 uid=26 gid=26 euid=26 suid=26 fsuid=26 egid=26 sgid=26 fsgid=26 tty=(none) ses=4294967295 comm="pg_ctl" exe="/usr/bin/pg_ctl" subj=system_u:system_r:postgresql_t:s0 key=(null)
type=AVC msg=audit(1411397127.258:3789): avc:  denied  { signal } for  pid=24302 comm="pg_ctl" scontext=system_u:system_r:postgresql_t:s0 tcontext=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 tclass=process
----
time->Mon Sep 22 09:45:53 2014
type=USER_AVC msg=audit(1411397153.325:3812): pid=586 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.343 spid=581 tpid=24575 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:cluster_t:s0 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
----
time->Mon Sep 22 09:47:34 2014
type=USER_AVC msg=audit(1411397254.697:4098): pid=586 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.344 spid=581 tpid=26440 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:cluster_t:s0 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
----
time->Mon Sep 22 09:47:54 2014
type=USER_AVC msg=audit(1411397274.620:4197): pid=586 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.345 spid=581 tpid=26966 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:cluster_t:s0 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
----
time->Mon Sep 22 09:48:19 2014
type=USER_AVC msg=audit(1411397299.669:4279): pid=586 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.346 spid=581 tpid=27415 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:cluster_t:s0 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
----
time->Mon Sep 22 09:48:44 2014
type=USER_AVC msg=audit(1411397324.696:4286): pid=586 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.347 spid=581 tpid=27612 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:cluster_t:s0 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
----
time->Mon Sep 22 09:49:09 2014
type=USER_AVC msg=audit(1411397349.745:4294): pid=586 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.348 spid=581 tpid=27807 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:cluster_t:s0 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
----
time->Mon Sep 22 09:49:09 2014
type=SYSCALL msg=audit(1411397349.716:4288): arch=c000003e syscall=62 success=no exit=-13 a0=4ee1 a1=2 a2=7f61bd079fd8 a3=7fffce3ee4c0 items=0 ppid=27793 pid=27794 auid=4294967295 uid=26 gid=26 euid=26 suid=26 fsuid=26 egid=26 sgid=26 fsgid=26 tty=(none) ses=4294967295 comm="pg_ctl" exe="/usr/bin/pg_ctl" subj=system_u:system_r:postgresql_t:s0 key=(null)
type=AVC msg=audit(1411397349.716:4288): avc:  denied  { signal } for  pid=27794 comm="pg_ctl" scontext=system_u:system_r:postgresql_t:s0 tcontext=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 tclass=process
----
time->Mon Sep 22 09:49:35 2014
type=USER_AVC msg=audit(1411397375.780:4301): pid=586 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.349 spid=581 tpid=27990 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:cluster_t:s0 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'

Comment 1 michal novacek 2014-09-22 14:59:15 UTC
I also noted that postgresql processes do not have correct selinux labels:

unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 20193 ? S   0:00 /usr/bin/postgres -D /var/lib/pgsql/data -c config_file=/var/lib/pgsql/data/postgresql.conf
unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 20204 ? Ss   0:00  \_ postgres: logger process   
unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 20208 ? Ss   0:00  \_ postgres: checkpointer process   
unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 20209 ? Ss   0:00  \_ postgres: writer process   
unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 20210 ? Ss   0:00  \_ postgres: wal writer process   
unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 20211 ? Ss   0:00  \_ postgres: autovacuum launcher process   
unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 20212 ? Ss   0:00  \_ postgres: stats collector process

Comment 3 Miroslav Grepl 2014-10-13 13:39:55 UTC
(In reply to michal novacek from comment #1)
> I also noted that postgresql processes do not have correct selinux labels:
> 
> unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 20193 ? S   0:00
> /usr/bin/postgres -D /var/lib/pgsql/data -c
> config_file=/var/lib/pgsql/data/postgresql.conf
> unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 20204 ? Ss   0:00  \_
> postgres: logger process   
> unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 20208 ? Ss   0:00  \_
> postgres: checkpointer process   
> unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 20209 ? Ss   0:00  \_
> postgres: writer process   
> unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 20210 ? Ss   0:00  \_
> postgres: wal writer process   
> unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 20211 ? Ss   0:00  \_
> postgres: autovacuum launcher process   
> unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 20212 ? Ss   0:00  \_
> postgres: stats collector process

Did you start it by hand?

Comment 4 michal novacek 2014-12-23 10:42:19 UTC
Yes, it has been run by hand, that can be safely ignored.

Comment 5 Miroslav Grepl 2015-01-07 12:57:23 UTC
So there remains

type=USER_AVC msg=audit(1411397324.696:4286): pid=586 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.347 spid=581 tpid=27612 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:cluster_t:s0 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'


issue, right?

Comment 6 michal novacek 2015-02-26 15:20:29 UTC
yes, that's right.

I have tried it again and compiling the following avc messages with audit2allow solved the problem.

type=USER_AVC msg=audit(1424963000.394:4439): pid=591 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.384 spid=589 tpid=9750 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:cluster_t:s0 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
[root@virt-125 data]# ausearch -m user_avc | grep tclass=dbus | audit2allow -M mysemanage
******************** IMPORTANT ***********************
To make this policy package active, execute:

semodule -i mysemanage.pp

Comment 16 errata-xmlrpc 2015-11-19 10:23:04 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2300.html