Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1189189

Summary: SELinux AVC on CentOS 7.0 with osad (spacewalk 2.3/nightly)
Product: [Community] Spacewalk Reporter: Patrick Hurrelmann <redhat>
Component: ClientsAssignee: Stephen Herr <sherr>
Status: CLOSED DUPLICATE QA Contact: Red Hat Satellite QA List <satqe-list>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 2.2   
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: selinux-policy-3.13.1-13.el7 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-02-04 16:47:32 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1484117    

Description Patrick Hurrelmann 2015-02-04 16:24:14 UTC
Description of problem:

Using osad on CentOS 7 logs several AVC and prevents it from working. Most AVCs look similar to the ones introduced with CentOS 6.6 (See #1161288).
The following AVCs are logged on osad startup:

time->Wed Feb  4 17:16:12 2015
type=SYSCALL msg=audit(1423066572.058:8509): arch=c000003e syscall=2 success=yes exit=3 a0=7fa84d9ed3a7 a1=80000 a2=1b6 a3=0 items=0 ppid=9843 pid=9844 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="osad" exe="/usr/bin/python2.7" subj=system_u:system_r:osad_t:s0 key=(null)
type=AVC msg=audit(1423066572.058:8509): avc:  denied  { open } for  pid=9844 comm="osad" path="/etc/resolv.conf" dev="dm-0" ino=17018233 scontext=system_u:system_r:osad_t:s0 tcontext=system_u:object_r:net_conf_t:s0 tclass=file
type=AVC msg=audit(1423066572.058:8509): avc:  denied  { read } for  pid=9844 comm="osad" name="resolv.conf" dev="dm-0" ino=17018233 scontext=system_u:system_r:osad_t:s0 tcontext=system_u:object_r:net_conf_t:s0 tclass=file
----
time->Wed Feb  4 17:16:12 2015
type=SYSCALL msg=audit(1423066572.058:8510): arch=c000003e syscall=5 success=yes exit=0 a0=3 a1=7fff6641bba0 a2=7fff6641bba0 a3=0 items=0 ppid=9843 pid=9844 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="osad" exe="/usr/bin/python2.7" subj=system_u:system_r:osad_t:s0 key=(null)
type=AVC msg=audit(1423066572.058:8510): avc:  denied  { getattr } for  pid=9844 comm="osad" path="/etc/resolv.conf" dev="dm-0" ino=17018233 scontext=system_u:system_r:osad_t:s0 tcontext=system_u:object_r:net_conf_t:s0 tclass=file
----
time->Wed Feb  4 17:16:12 2015
type=SYSCALL msg=audit(1423066572.058:8511): arch=c000003e syscall=41 success=yes exit=3 a0=2 a1=1 a2=6 a3=0 items=0 ppid=9843 pid=9844 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="osad" exe="/usr/bin/python2.7" subj=system_u:system_r:osad_t:s0 key=(null)
type=AVC msg=audit(1423066572.058:8511): avc:  denied  { create } for  pid=9844 comm="osad" scontext=system_u:system_r:osad_t:s0 tcontext=system_u:system_r:osad_t:s0 tclass=tcp_socket
----
time->Wed Feb  4 17:16:12 2015
type=SYSCALL msg=audit(1423066572.058:8512): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=7fff6641ded0 a2=10 a3=0 items=0 ppid=9843 pid=9844 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="osad" exe="/usr/bin/python2.7" subj=system_u:system_r:osad_t:s0 key=(null)
type=AVC msg=audit(1423066572.058:8512): avc:  denied  { name_connect } for  pid=9844 comm="osad" dest=443 scontext=system_u:system_r:osad_t:s0 tcontext=system_u:object_r:http_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1423066572.058:8512): avc:  denied  { connect } for  pid=9844 comm="osad" scontext=system_u:system_r:osad_t:s0 tcontext=system_u:system_r:osad_t:s0 tclass=tcp_socket
----
time->Wed Feb  4 17:16:12 2015
type=SYSCALL msg=audit(1423066572.573:8513): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=7fff6641e530 a2=10 a3=3 items=0 ppid=9843 pid=9844 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="osad" exe="/usr/bin/python2.7" subj=system_u:system_r:osad_t:s0 key=(null)
type=AVC msg=audit(1423066572.573:8513): avc:  denied  { name_connect } for  pid=9844 comm="osad" dest=5222 scontext=system_u:system_r:osad_t:s0 tcontext=system_u:object_r:jabber_client_port_t:s0 tclass=tcp_socket
----
time->Wed Feb  4 17:16:12 2015
type=SYSCALL msg=audit(1423066572.625:8517): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=1 a2=9 a3=7fff6641ee5c items=0 ppid=1 pid=9845 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="osad" exe="/usr/bin/python2.7" subj=system_u:system_r:osad_t:s0 key=(null)
type=AVC msg=audit(1423066572.625:8517): avc:  denied  { setopt } for  pid=9845 comm="osad" laddr=1.2.3.212 lport=49717 faddr=1.2.3.212 fport=5222 scontext=system_u:system_r:osad_t:s0 tcontext=system_u:system_r:osad_t:s0 tclass=tcp_socket

Backporting some changes from rawhide selinux-policy makes osad work. Scheduling package updates work and osad ping works, too.

The following local policy fixes the issues:

policy_module(osad-selinux,1.0)

require {
        type jabber_client_port_t;
        type osad_t;
}

corenet_tcp_connect_http_port(osad_t)
corenet_tcp_connect_jabber_client_port(osad_t)

corecmd_exec_bin(osad_t)

dev_read_urand(osad_t)

auth_use_nsswitch(osad_t)
optional_policy(`
    rpm_domtrans(osad_t)
')

Maybe less permissions are needed, but due to unavailability of an selinux-policy package from RHEL 7.1, I was unable to check, whether the issues were already addressed in newer policy.

Version-Release number of selected component (if applicable):

On CentOS 7.0:
selinux-policy-3.12.1-153.el7_0.13
osad-5.11.52-1.el7

How reproducible:

Always

Steps to Reproduce:
1. Install osad
2. Start osad

Actual results:

osad fails to start and AVCs are logged

Expected results:

osad starts up and works

Additional info:

Comment 1 Stephen Herr 2015-02-04 16:47:32 UTC
Should be fixed in selinux-policy-3.13.1-13.el7 or higher. I'm going to close this bug as a duplicate of the RHEL bug that is tracking the issue, since Spacewalk does not own the selinux-policy package.

*** This bug has been marked as a duplicate of bug 1154242 ***

Comment 2 Eric Herget 2017-09-28 18:09:07 UTC
This BZ closed some time during 2.5, 2.6 or 2.7.  Adding to 2.7 tracking bug.