Bug 1145215
| Summary: | ocf:heartbeat:pqsql AVC denial messages | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | michal novacek <mnovacek> | |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> | |
| Status: | CLOSED ERRATA | QA Contact: | Stanislav Zidek <szidek> | |
| Severity: | unspecified | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 7.0 | CC: | mmalik, mnovacek, ssekidde, szidek | |
| Target Milestone: | rc | |||
| Target Release: | --- | |||
| Hardware: | All | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | selinux-policy-3.13.1-26.el7 | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1233087 (view as bug list) | Environment: | ||
| Last Closed: | 2015-11-19 10:23:04 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1233087 | |||
I also noted that postgresql processes do not have correct selinux labels: unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 20193 ? S 0:00 /usr/bin/postgres -D /var/lib/pgsql/data -c config_file=/var/lib/pgsql/data/postgresql.conf unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 20204 ? Ss 0:00 \_ postgres: logger process unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 20208 ? Ss 0:00 \_ postgres: checkpointer process unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 20209 ? Ss 0:00 \_ postgres: writer process unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 20210 ? Ss 0:00 \_ postgres: wal writer process unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 20211 ? Ss 0:00 \_ postgres: autovacuum launcher process unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 20212 ? Ss 0:00 \_ postgres: stats collector process (In reply to michal novacek from comment #1) > I also noted that postgresql processes do not have correct selinux labels: > > unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 20193 ? S 0:00 > /usr/bin/postgres -D /var/lib/pgsql/data -c > config_file=/var/lib/pgsql/data/postgresql.conf > unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 20204 ? Ss 0:00 \_ > postgres: logger process > unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 20208 ? Ss 0:00 \_ > postgres: checkpointer process > unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 20209 ? Ss 0:00 \_ > postgres: writer process > unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 20210 ? Ss 0:00 \_ > postgres: wal writer process > unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 20211 ? Ss 0:00 \_ > postgres: autovacuum launcher process > unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 20212 ? Ss 0:00 \_ > postgres: stats collector process Did you start it by hand? Yes, it has been run by hand, that can be safely ignored. So there remains
type=USER_AVC msg=audit(1411397324.696:4286): pid=586 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.347 spid=581 tpid=27612 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:cluster_t:s0 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
issue, right?
yes, that's right.
I have tried it again and compiling the following avc messages with audit2allow solved the problem.
type=USER_AVC msg=audit(1424963000.394:4439): pid=591 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.384 spid=589 tpid=9750 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:cluster_t:s0 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
[root@virt-125 data]# ausearch -m user_avc | grep tclass=dbus | audit2allow -M mysemanage
******************** IMPORTANT ***********************
To make this policy package active, execute:
semodule -i mysemanage.pp
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-2300.html |
Description of problem: postgresql agent does not start with selinux enforcing policy but works correctly in permissive. Version-Release number of selected component (if applicable): selinux-policy-3.12.1-155.el7.noarch resource-agents-3.9.5-31.el7.x86_64 How reproducible: always [root@host-050 ~]# ausearch -m AVC -m USER_AVC ---- time->Mon Sep 22 09:45:27 2014 type=USER_AVC msg=audit(1411397127.290:3795): pid=586 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.342 spid=581 tpid=24315 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:cluster_t:s0 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' ---- time->Mon Sep 22 09:45:27 2014 type=SYSCALL msg=audit(1411397127.258:3789): arch=c000003e syscall=62 success=no exit=-13 a0=4ee1 a1=2 a2=7fb9714fefd8 a3=7fff86878c80 items=0 ppid=24301 pid=24302 auid=4294967295 uid=26 gid=26 euid=26 suid=26 fsuid=26 egid=26 sgid=26 fsgid=26 tty=(none) ses=4294967295 comm="pg_ctl" exe="/usr/bin/pg_ctl" subj=system_u:system_r:postgresql_t:s0 key=(null) type=AVC msg=audit(1411397127.258:3789): avc: denied { signal } for pid=24302 comm="pg_ctl" scontext=system_u:system_r:postgresql_t:s0 tcontext=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 tclass=process ---- time->Mon Sep 22 09:45:53 2014 type=USER_AVC msg=audit(1411397153.325:3812): pid=586 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.343 spid=581 tpid=24575 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:cluster_t:s0 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' ---- time->Mon Sep 22 09:47:34 2014 type=USER_AVC msg=audit(1411397254.697:4098): pid=586 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.344 spid=581 tpid=26440 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:cluster_t:s0 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' ---- time->Mon Sep 22 09:47:54 2014 type=USER_AVC msg=audit(1411397274.620:4197): pid=586 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.345 spid=581 tpid=26966 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:cluster_t:s0 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' ---- time->Mon Sep 22 09:48:19 2014 type=USER_AVC msg=audit(1411397299.669:4279): pid=586 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.346 spid=581 tpid=27415 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:cluster_t:s0 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' ---- time->Mon Sep 22 09:48:44 2014 type=USER_AVC msg=audit(1411397324.696:4286): pid=586 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.347 spid=581 tpid=27612 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:cluster_t:s0 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' ---- time->Mon Sep 22 09:49:09 2014 type=USER_AVC msg=audit(1411397349.745:4294): pid=586 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.348 spid=581 tpid=27807 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:cluster_t:s0 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' ---- time->Mon Sep 22 09:49:09 2014 type=SYSCALL msg=audit(1411397349.716:4288): arch=c000003e syscall=62 success=no exit=-13 a0=4ee1 a1=2 a2=7f61bd079fd8 a3=7fffce3ee4c0 items=0 ppid=27793 pid=27794 auid=4294967295 uid=26 gid=26 euid=26 suid=26 fsuid=26 egid=26 sgid=26 fsgid=26 tty=(none) ses=4294967295 comm="pg_ctl" exe="/usr/bin/pg_ctl" subj=system_u:system_r:postgresql_t:s0 key=(null) type=AVC msg=audit(1411397349.716:4288): avc: denied { signal } for pid=27794 comm="pg_ctl" scontext=system_u:system_r:postgresql_t:s0 tcontext=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 tclass=process ---- time->Mon Sep 22 09:49:35 2014 type=USER_AVC msg=audit(1411397375.780:4301): pid=586 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.349 spid=581 tpid=27990 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:cluster_t:s0 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'