1257830 – Error message "'list' object has no attribute 'split'" appears while setroubleshoot is processing AVC

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1257830 - Error message "'list' object has no attribute 'split'" appears while setroubleshoot is processing AVC

Summary: Error message "'list' object has no attribute 'split'" appears while setroubl...

Keywords:
Status:	CLOSED ERRATA
Alias:	None
Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	setroubleshoot-plugins
Sub Component:
Version:	7.2
Hardware:	All
OS:	Linux
Priority:	medium
Severity:	medium
Target Milestone:	rc
Target Release:	---
Assignee:	Petr Lautrbach
QA Contact:	Milos Malik
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:	1203710 1296594 1313485
TreeView+	depends on / blocked

Reported:	2015-08-28 07:58 UTC by Jakub Filak
Modified:	2019-12-16 04:54 UTC (History)
CC List:	9 users (show)
Fixed In Version:	setroubleshoot-plugins-3.0.62-1.el7
Doc Type:	Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed:	2016-11-04 06:32:12 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHBA-2016:2441	0	normal	SHIPPED_LIVE	setroubleshoot-plugins bug fix update	2016-11-03 14:02:25 UTC

Description Jakub Filak 2015-08-28 07:58:02 UTC

Description of problem:
After a new AVC is detected the following error appears in journal:
'list' object has no attribute 'split'

Version-Release number of selected component (if applicable):
setroubleshoot-3.2.24-1.1.el7.x86_64

How reproducible:
Sometimes

Steps to Reproduce:
1. provoke AVC

Actual results:
Aug 28 09:27:04 dhcp-24-114.brq.redhat.com setroubleshoot[4686]: failed to retrieve rpm info for /dev/vport0p2
Aug 28 09:27:04 dhcp-24-114.brq.redhat.com setroubleshoot[4686]: Plugin Exception restorecon_source
Aug 28 09:27:04 dhcp-24-114.brq.redhat.com setroubleshoot[4686]: SELinux is preventing /usr/bin/spice-vdagent from getattr access on the chr_file /dev/vport0p2. For compl
Aug 28 09:27:04 dhcp-24-114.brq.redhat.com dbus-daemon[658]: 'list' object has no attribute 'split'
Aug 28 09:27:04 dhcp-24-114.brq.redhat.com python[4686]: SELinux is preventing /usr/bin/spice-vdagent from getattr access on the chr_file /dev/vport0p2.
                                                         
                                                         *****  Plugin catchall (100. confidence) suggests   **************************
                                                         
                                                         If you believe that spice-vdagent should be allowed getattr access on the vport0p2 chr_file by default.
                                                         Then you should report this as a bug.
                                                         You can generate a local policy module to allow this access.
                                                         Do
                                                         allow this access for now by executing:
                                                         # grep spice-vdagent /var/log/audit/audit.log | audit2allow -M mypol
                                                         # semodule -i mypol.pp

Comment 2 Miroslav Grepl 2015-08-28 08:21:25 UTC

Could you attach raw AVC msg?

Comment 3 Milos Malik 2015-08-28 08:36:53 UTC

Every AVC seems to trigger it:

# grep split /var/log/messages
Aug 24 15:29:15 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 25 08:19:30 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 25 16:24:39 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 25 16:38:37 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 25 16:40:08 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 25 16:40:31 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 25 16:42:05 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 25 16:42:29 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 26 10:26:51 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 26 10:39:54 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 26 11:25:18 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 26 11:34:40 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 26 11:39:02 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 27 09:23:35 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 27 12:04:51 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 27 12:05:16 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 27 12:07:22 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 27 12:07:46 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 27 12:10:04 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 27 12:13:10 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 27 12:14:22 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 27 12:15:31 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 27 12:19:13 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 27 12:20:40 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 27 12:21:05 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 27 12:24:23 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 27 12:25:04 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 27 12:27:46 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 27 12:30:03 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 27 12:35:03 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 27 14:03:03 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 27 14:06:43 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 27 14:26:45 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 27 14:27:33 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 27 14:32:26 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 27 14:33:24 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 28 10:05:06 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 28 10:16:21 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 28 10:17:37 rhel72 dbus-daemon: 'list' object has no attribute 'split'
Aug 28 10:18:05 rhel72 dbus-daemon: 'list' object has no attribute 'split'
#

Comment 4 Jakub Filak 2015-08-28 08:39:55 UTC

time->Fri Aug 28 09:27:03 2015
type=SYSCALL msg=audit(1440746823.649:378): arch=c000003e syscall=4 success=no exit=-13 a0=409bd0 a1=7ffcaffb4790 a2=7ffcaffb4790 a3=7ffcaffb4480 items=0 ppid=4532 pid=46
76 auid=4294967295 uid=42 gid=42 euid=42 suid=42 fsuid=42 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm="spice-vdagent" exe="/usr/bin/spice-vdagent" subj=system
_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1440746823.649:378): avc:  denied  { getattr } for  pid=4676 comm="spice-vdagent" path="/dev/vport0p2" dev="devtmpfs" ino=8740 scontext=system_u:system
_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:virtio_device_t:s0 tclass=chr_file

Comment 6 Petr Lautrbach 2015-09-11 14:16:42 UTC

This is not a blocker material for rhel-7.2 however it's quite annoying and it should be fixed. Given that setroubleshoot-plugins tends not to be included on ACLs very often I would probably propose this for rhel-7.2.z update.

Comment 11 errata-xmlrpc 2016-11-04 06:32:12 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2441.html

Note You need to log in before you can comment on or make changes to this bug.