Bug 1266695 - SELinux is preventing /usr/sbin/tmpwatch from 'setattr' accesses on the directory /var/lib/argus/archive.
SELinux is preventing /usr/sbin/tmpwatch from 'setattr' accesses on the direc...
Status: CLOSED CURRENTRELEASE
Product: Fedora
Classification: Fedora
Component: argus (Show other bugs)
22
x86_64 Linux
unspecified Severity unspecified
: ---
: ---
Assigned To: Gwyn Ciesla
Fedora Extras Quality Assurance
abrt_hash:445abcc4fbd783db61e96703cf8...
:
: 1269755 (view as bug list)
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2015-09-26 12:09 EDT by Reinier Bikker
Modified: 2016-01-14 02:22 EST (History)
8 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-01-14 02:22:24 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Reinier Bikker 2015-09-26 12:09:47 EDT
Description of problem:
The nightly 'argus' cron job results in an selinux avc. The line '/sbin/tmpwatch -m 366d $ARGUSPATH/archive' appears to be the cause. 

Please add a type enforcement (TE) allow rule in the default install of argus.
SELinux is preventing /usr/sbin/tmpwatch from 'setattr' accesses on the directory /var/lib/argus/archive.

*****  Plugin catchall_labels (83.8 confidence) suggests   *******************

If you want to allow tmpwatch to have setattr access on the archive directory
Then you need to change the label on /var/lib/argus/archive
Do
# semanage fcontext -a -t FILE_TYPE '/var/lib/argus/archive'
where FILE_TYPE is one of the following: NetworkManager_tmp_t, abrt_tmp_t, abrt_upload_watch_tmp_t, abrt_var_cache_t, admin_crontab_tmp_t, alsa_home_t, alsa_tmp_t, amanda_tmp_t, antivirus_db_t, antivirus_home_t, antivirus_tmp_t, apcupsd_tmp_t, apmd_tmp_t, arpwatch_tmp_t, asterisk_tmp_t, audio_home_t, auditadm_sudo_tmp_t, auth_home_t, automount_tmp_t, awstats_tmp_t, bacula_tmp_t, bitlbee_tmp_t, bluetooth_helper_tmp_t, bluetooth_helper_tmpfs_t, bluetooth_tmp_t, boinc_project_tmp_t, boinc_tmp_t, bootloader_tmp_t, bugzilla_tmp_t, cache_home_t, cardmgr_dev_t, ccs_tmp_t, cdcc_tmp_t, chrome_sandbox_home_t, chrome_sandbox_tmp_t, cinder_api_tmp_t, cinder_backup_tmp_t, cinder_scheduler_tmp_t, cinder_volume_tmp_t, cloud_init_tmp_t, cluster_tmp_t, cobbler_tmp_t, cockpit_tmp_t, collectd_script_tmp_t, colord_tmp_t, comsat_tmp_t, condor_master_tmp_t, condor_schedd_tmp_t, condor_startd_tmp_t, config_home_t, conman_tmp_t, couchdb_tmp_t, crack_tmp_t, crond_tmp_t, crontab_tmp_t, ctdbd_tmp_t, cups_pdf_tmp_t, cupsd_lpd_tmp_t, cupsd_tmp_t, cvs_home_t, cvs_tmp_t, cyphesis_tmp_t, cyrus_tmp_t, data_home_t, dbadm_sudo_tmp_t, dbskkd_tmp_t, dbus_home_t, dcc_client_tmp_t, dcc_dbclean_tmp_t, dccd_tmp_t, dccifd_tmp_t, dccm_tmp_t, ddclient_tmp_t, deltacloudd_tmp_t, devicekit_tmp_t, dhcpc_tmp_t, dhcpd_tmp_t, dirsrv_tmp_t, dirsrvadmin_tmp_t, disk_munin_plugin_tmp_t, dkim_milter_tmp_t, dnssec_trigger_tmp_t, docker_home_t, docker_tmp_t, dovecot_auth_tmp_t, dovecot_deliver_tmp_t, dovecot_tmp_t, drbd_tmp_t, exim_tmp_t, fail2ban_tmp_t, fenced_tmp_t, fetchmail_home_t, firewalld_tmp_t, firewallgui_tmp_t, fsadm_tmp_t, fsdaemon_tmp_t, ftpd_tmp_t, ftpdctl_tmp_t, games_tmp_t, games_tmpfs_t, gconf_home_t, gconf_tmp_t, geoclue_tmp_t, getty_tmp_t, git_script_tmp_t, git_user_content_t, gkeyringd_gnome_home_t, gkeyringd_tmp_t, glance_registry_tmp_t, glance_tmp_t, glusterd_tmp_t, gnome_home_t, gpg_agent_tmp_t, gpg_pinentry_tmp_t, gpg_pinentry_tmpfs_t, gpg_secret_t, gpm_tmp_t, gssd_tmp_t, gstreamer_home_t, home_bin_t, home_cert_t, httpd_cache_t, httpd_php_tmp_t, httpd_suexec_tmp_t, httpd_tmp_t, httpd_user_content_t, httpd_user_htaccess_t, httpd_user_ra_content_t, httpd_user_rw_content_t, httpd_user_script_exec_t, icc_data_home_t, iceauth_home_t, inetd_child_tmp_t, inetd_tmp_t, init_tmp_t, initrc_tmp_t, ipsec_tmp_t, iptables_tmp_t, irc_home_t, irc_tmp_t, irssi_home_t, iscsi_tmp_t, kadmind_tmp_t, kdumpctl_tmp_t, kdumpgui_tmp_t, keystone_tmp_t, kismet_home_t, kismet_log_t, kismet_tmp_t, kismet_tmpfs_t, klogd_tmp_t, krb5_home_t, krb5_host_rcache_t, krb5kdc_tmp_t, ktalkd_tmp_t, l2tpd_tmp_t, ldconfig_tmp_t, livecd_tmp_t, local_login_home_t, logrotate_mail_tmp_t, logrotate_tmp_t, logwatch_mail_tmp_t, logwatch_tmp_t, lpd_tmp_t, lpr_tmp_t, lsassd_tmp_t, lsmd_plugin_tmp_t, lvm_tmp_t, mail_home_rw_t, mail_home_t, mail_munin_plugin_tmp_t, mailman_cgi_tmp_t, mailman_mail_tmp_t, mailman_queue_tmp_t, man_cache_t, man_t, mandb_cache_t, mandb_home_t, mediawiki_tmp_t, mock_tmp_t, mojomojo_tmp_t, mongod_tmp_t, mount_tmp_t, mozilla_home_t, mozilla_plugin_tmp_t, mozilla_plugin_tmpfs_t, mozilla_tmp_t, mozilla_tmpfs_t, mpd_home_t, mpd_tmp_t, mpd_user_data_t, mplayer_home_t, mplayer_tmpfs_t, mscan_tmp_t, munin_script_tmp_t, munin_tmp_t, mysqld_home_t, mysqld_tmp_t, nagios_eventhandler_plugin_tmp_t, nagios_openshift_plugin_tmp_t, nagios_system_plugin_tmp_t, nagios_tmp_t, named_tmp_t, netutils_tmp_t, neutron_tmp_t, nova_ajax_tmp_t, nova_api_tmp_t, nova_cert_tmp_t, nova_compute_tmp_t, nova_conductor_tmp_t, nova_console_tmp_t, nova_direct_tmp_t, nova_network_tmp_t, nova_objectstore_tmp_t, nova_scheduler_tmp_t, nova_vncproxy_tmp_t, nova_volume_tmp_t, ntop_tmp_t, ntpd_tmp_t, nut_upsd_tmp_t, nut_upsdrvctl_tmp_t, nut_upsmon_tmp_t, nx_server_tmp_t, openshift_cgroup_read_tmp_t, openshift_cron_tmp_t, openshift_initrc_tmp_t, openshift_tmp_t, openshift_var_lib_t, openvpn_tmp_t, openvswitch_tmp_t, openwsman_tmp_t, pam_timestamp_tmp_t, passenger_tmp_t, pcp_tmp_t, pegasus_openlmi_storage_tmp_t, pegasus_tmp_t, piranha_web_tmp_t, pkcs_slotd_tmp_t, pki_tomcat_tmp_t, podsleuth_tmp_t, podsleuth_tmpfs_t, policykit_tmp_t, polipo_cache_home_t, polipo_config_home_t, portmap_tmp_t, postfix_bounce_tmp_t, postfix_cleanup_tmp_t, postfix_local_tmp_t, postfix_map_tmp_t, postfix_pickup_tmp_t, postfix_pipe_tmp_t, postfix_qmgr_tmp_t, postfix_smtp_tmp_t, postfix_smtpd_tmp_t, postfix_virtual_tmp_t, postgresql_tmp_t, pppd_tmp_t, prelink_tmp_t, prelude_lml_tmp_t, print_spool_t, procmail_home_t, procmail_tmp_t, psad_tmp_t, pulseaudio_home_t, pulseaudio_tmpfs_t, puppet_tmp_t, puppetmaster_tmp_t, qpidd_tmp_t, racoon_tmp_t, realmd_tmp_t, rhev_agentd_tmp_t, rhsmcertd_tmp_t, ricci_tmp_t, rlogind_home_t, rlogind_tmp_t, rolekit_tmp_t, rpm_script_tmp_t, rpm_tmp_t, rpm_var_cache_t, rssh_ro_t, rssh_rw_t, rsync_tmp_t, rtas_errd_tmp_t, samba_net_tmp_t, sandbox_file_t, sblim_tmp_t, screen_home_t, secadm_sudo_tmp_t, sectool_tmp_t, selinux_munin_plugin_tmp_t, semanage_tmp_t, sendmail_tmp_t, services_munin_plugin_tmp_t, session_dbusd_tmp_t, sge_tmp_t, shorewall_tmp_t, slapd_tmp_t, smbd_tmp_t, smoltclient_tmp_t, smsd_tmp_t, snort_tmp_t, sosreport_tmp_t, soundd_tmp_t, spamc_home_t, spamc_tmp_t, spamd_tmp_t, speech-dispatcher_home_t, speech-dispatcher_tmp_t, squid_tmp_t, squirrelmail_spool_t, ssh_agent_tmp_t, ssh_home_t, ssh_keygen_tmp_t, ssh_tmpfs_t, staff_sudo_tmp_t, stapserver_tmp_t, stunnel_tmp_t, svirt_home_t, svirt_tmp_t, svnserve_tmp_t, swat_tmp_t, swift_tmp_t, sysadm_passwd_tmp_t, sysadm_sudo_tmp_t, syslogd_tmp_t, system_cronjob_tmp_t, system_dbusd_tmp_t, system_mail_tmp_t, system_munin_plugin_tmp_t, systemd_home_t, tcpd_tmp_t, telepathy_cache_home_t, telepathy_data_home_t, telepathy_gabble_cache_home_t, telepathy_gabble_tmp_t, telepathy_idle_tmp_t, telepathy_logger_cache_home_t, telepathy_logger_data_home_t, telepathy_logger_tmp_t, telepathy_mission_control_cache_home_t, telepathy_mission_control_data_home_t, telepathy_mission_control_home_t, telepathy_mission_control_tmp_t, telepathy_msn_tmp_t, telepathy_salut_tmp_t, telepathy_sofiasip_tmp_t, telepathy_stream_engine_tmp_t, telepathy_sunshine_home_t, telepathy_sunshine_tmp_t, telnetd_tmp_t, tetex_data_t, texlive_home_t, tgtd_tmp_t, thumb_home_t, thumb_tmp_t, tmp_t, tmpfs_t, tomcat_tmp_t, tuned_tmp_t, tvtime_home_t, tvtime_tmp_t, tvtime_tmpfs_t, udev_tmp_t, uml_ro_t, uml_rw_t, uml_tmp_t, uml_tmpfs_t, unconfined_munin_plugin_tmp_t, unlabeled_t, update_modules_tmp_t, user_fonts_cache_t, user_fonts_config_t, user_fonts_t, user_home_t, user_mail_tmp_t, user_tmp_t, usr_t, uucpd_tmp_t, var_spool_t, varnishd_tmp_t, virt_content_t, virt_home_t, virt_qemu_ga_tmp_t, virt_tmp_t, vmtools_tmp_t, vmware_conf_t, vmware_file_t, vmware_host_tmp_t, vmware_tmp_t, vmware_tmpfs_t, vpnc_tmp_t, w3c_validator_tmp_t, webadm_tmp_t, webalizer_tmp_t, wine_home_t, wireshark_home_t, wireshark_tmp_t, wireshark_tmpfs_t, xauth_home_t, xauth_tmp_t, xdm_home_t, xend_tmp_t, xenstored_tmp_t, xserver_tmpfs_t, ypbind_tmp_t, ypserv_tmp_t, zabbix_tmp_t, zarafa_deliver_tmp_t, zarafa_indexer_tmp_t, zarafa_server_tmp_t, zarafa_var_lib_t, zebra_tmp_t. 
Then execute: 
restorecon -v '/var/lib/argus/archive'


*****  Plugin catchall (17.1 confidence) suggests   **************************

If you believe that tmpwatch should be allowed setattr access on the archive directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep tmpwatch /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:tmpreaper_t:s0-s0:c0.c1023
Target Context                system_u:object_r:var_lib_t:s0
Target Objects                /var/lib/argus/archive [ dir ]
Source                        tmpwatch
Source Path                   /usr/sbin/tmpwatch
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           tmpwatch-2.11-6.fc21.x86_64
Target RPM Packages           argus-3.0.8-3.fc21.x86_64
Policy RPM                    selinux-policy-3.13.1-105.20.fc21.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     (removed)
Platform                      Linux (removed) 4.0.8-200.fc21.x86_64 #1 SMP Fri
                              Jul 10 21:09:54 UTC 2015 x86_64 x86_64
Alert Count                   2
First Seen                    2015-09-25 03:46:04 CEST
Last Seen                     2015-09-26 03:14:03 CEST
Local ID                      0f0e46e6-77b0-4df7-aab8-d8a9c870733e

Raw Audit Messages
type=AVC msg=audit(1443230043.823:30210): avc:  denied  { setattr } for  pid=18963 comm="tmpwatch" name="archive" dev="md0" ino=4194557 scontext=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_lib_t:s0 tclass=dir permissive=1


type=SYSCALL msg=audit(1443230043.823:30210): arch=x86_64 syscall=utime success=yes exit=0 a0=4042f7 a1=7fffe7a47f50 a2=13de0 a3=8041 items=0 ppid=18957 pid=18963 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1949 comm=tmpwatch exe=/usr/sbin/tmpwatch subj=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023 key=(null)

Hash: tmpwatch,tmpreaper_t,var_lib_t,dir,setattr

Version-Release number of selected component:
selinux-policy-3.13.1-105.20.fc21.noarch

Additional info:
reporter:       libreport-2.3.0
hashmarkername: setroubleshoot
kernel:         4.0.8-200.fc21.x86_64
type:           libreport
Comment 1 Daniel Walsh 2015-09-27 06:28:03 EDT
What kind of data is stored in /var/lib/argus/archive?
Comment 2 Reinier Bikker 2015-09-27 09:21:43 EDT
(In reply to Daniel Walsh from comment #1)
> What kind of data is stored in /var/lib/argus/archive?

I'm not sure. I don't actively use it. The package is part of the "Security Lab" group. According to the daily cron job the output of argus (/var/lib/argus/argus.out) is moved to the archive and gzipped. 

The problems started after the update below, which was installed here on September 24th. This update introduced the cron script, which does the daily rotation of the argus data. (Regardless of whether there is any such data, which is another bug.)

https://bodhi.fedoraproject.org/updates/FEDORA-2015-15923

The cron script is a response to bugzilla bug 1219565. 

Best ask the maintainer...
Comment 3 Daniel Walsh 2015-10-08 06:42:57 EDT
Should the data that tmpreaper is attempting to cleanup in /var/lib/argus/archive? be stored there?   Is this data massive, would it be better to store this in /run directory?
Comment 4 Daniel Walsh 2015-10-08 07:51:42 EDT
*** Bug 1269755 has been marked as a duplicate of this bug. ***
Comment 5 Gwyn Ciesla 2015-10-08 14:14:02 EDT
I'm honestly not sure either.  Do you think fixing the aforementioned cron issue using logrotate (https://bugzilla.redhat.com/show_bug.cgi?id=1266304) would ameliorate the issue?
Comment 6 David 2015-10-09 03:28:19 EDT
Description of problem:
Incident happened unattended as PC was running PDFCrack (2nd day).

Version-Release number of selected component:
selinux-policy-3.13.1-128.16.fc22.noarch

Additional info:
reporter:       libreport-2.6.2
hashmarkername: setroubleshoot
kernel:         4.1.8-200.fc22.x86_64
type:           libreport
Comment 7 David 2015-10-10 03:44:07 EDT
Description of problem:
This happened overnight whilst the PC was unattended (working on PDFcrack).

Version-Release number of selected component:
selinux-policy-3.13.1-128.16.fc22.noarch

Additional info:
reporter:       libreport-2.6.2
hashmarkername: setroubleshoot
kernel:         4.1.8-200.fc22.x86_64
type:           libreport
Comment 8 David 2015-10-11 02:55:02 EDT
Description of problem:
Happened overnight whilst running PDFcrack.

Version-Release number of selected component:
selinux-policy-3.13.1-128.16.fc22.noarch

Additional info:
reporter:       libreport-2.6.2
hashmarkername: setroubleshoot
kernel:         4.1.8-200.fc22.x86_64
type:           libreport
Comment 9 David 2015-10-12 03:03:03 EDT
Description of problem:
PC running overnight PDFcracker.

Version-Release number of selected component:
selinux-policy-3.13.1-128.16.fc22.noarch

Additional info:
reporter:       libreport-2.6.2
hashmarkername: setroubleshoot
kernel:         4.1.8-200.fc22.x86_64
type:           libreport
Comment 10 David 2015-10-13 03:09:12 EDT
Description of problem:
Was reading an online newspaper in Firefox. Nothing stopped working or broke, just the alert popped up.

Version-Release number of selected component:
selinux-policy-3.13.1-128.16.fc22.noarch

Additional info:
reporter:       libreport-2.6.2
hashmarkername: setroubleshoot
kernel:         4.1.10-200.fc22.x86_64
type:           libreport
Comment 11 David 2015-10-14 04:30:32 EDT
Description of problem:
Was running MSupdate this time.

Version-Release number of selected component:
selinux-policy-3.13.1-128.16.fc22.noarch

Additional info:
reporter:       libreport-2.6.2
hashmarkername: setroubleshoot
kernel:         4.1.10-200.fc22.x86_64
type:           libreport
Comment 12 David 2015-10-15 03:25:13 EDT
Description of problem:
PC was unattended and downloading a file.

Version-Release number of selected component:
selinux-policy-3.13.1-128.16.fc22.noarch

Additional info:
reporter:       libreport-2.6.2
hashmarkername: setroubleshoot
kernel:         4.1.10-200.fc22.x86_64
type:           libreport
Comment 13 David 2015-10-17 03:18:59 EDT
Description of problem:
Was running Firefox on XP in an Oracle Virtualbox container on a base Fedora 22 system. Nothing broke, slowed down or did anything noticeable. 

Version-Release number of selected component:
selinux-policy-3.13.1-128.16.fc22.noarch

Additional info:
reporter:       libreport-2.6.2
hashmarkername: setroubleshoot
kernel:         4.1.10-200.fc22.x86_64
type:           libreport
Comment 14 David 2015-10-18 04:38:47 EDT
Description of problem:
Was underneath the desk trying to fix a faulty microphone connection when this alert popped up. 

Version-Release number of selected component:
selinux-policy-3.13.1-128.16.fc22.noarch

Additional info:
reporter:       libreport-2.6.2
hashmarkername: setroubleshoot
kernel:         4.2.3-200.fc22.x86_64
type:           libreport
Comment 15 David 2015-10-20 04:19:31 EDT
Description of problem:
PC was unattended.

Version-Release number of selected component:
selinux-policy-3.13.1-128.16.fc22.noarch

Additional info:
reporter:       libreport-2.6.2
hashmarkername: setroubleshoot
kernel:         4.2.3-200.fc22.x86_64
type:           libreport
Comment 16 David 2015-10-21 05:19:10 EDT
Description of problem:
Had just done a Yum Extender (who thinks these daft titles up?!!). PC was unattended.

Version-Release number of selected component:
selinux-policy-3.13.1-128.16.fc22.noarch

Additional info:
reporter:       libreport-2.6.2
hashmarkername: setroubleshoot
kernel:         4.1.10-200.fc22.x86_64
type:           libreport
Comment 17 David 2015-10-22 04:04:27 EDT
Description of problem:
PC was unattended but doing Backup. 

Version-Release number of selected component:
selinux-policy-3.13.1-128.16.fc22.noarch

Additional info:
reporter:       libreport-2.6.2
hashmarkername: setroubleshoot
kernel:         4.2.3-200.fc22.x86_64
type:           libreport
Comment 18 David 2015-10-23 05:50:17 EDT
Description of problem:
Was running Virtualbox. PC was unattended.

Version-Release number of selected component:
selinux-policy-3.13.1-128.16.fc22.noarch

Additional info:
reporter:       libreport-2.6.2
hashmarkername: setroubleshoot
kernel:         4.2.3-200.fc22.x86_64
type:           libreport
Comment 19 David 2015-10-24 04:17:31 EDT
Description of problem:
PC was unattended at the time. 

Version-Release number of selected component:
selinux-policy-3.13.1-128.16.fc22.noarch

Additional info:
reporter:       libreport-2.6.2
hashmarkername: setroubleshoot
kernel:         4.2.3-200.fc22.x86_64
type:           libreport
Comment 20 David 2015-11-01 02:20:14 EST
Description of problem:
This second alert popped up when I clicked on the 'If you were trying to' option for the first alert.

Version-Release number of selected component:
selinux-policy-3.13.1-128.18.fc22.noarch

Additional info:
reporter:       libreport-2.6.3
hashmarkername: setroubleshoot
kernel:         4.2.3-200.fc22.x86_64
type:           libreport
Comment 21 David 2015-11-02 03:46:18 EST
Description of problem:
Was simply reading an online newspaper using Firefox. Nothing slowed down, stopped or broke so far as I could determine.

Version-Release number of selected component:
selinux-policy-3.13.1-128.18.fc22.noarch

Additional info:
reporter:       libreport-2.6.3
hashmarkername: setroubleshoot
kernel:         4.2.3-200.fc22.x86_64
type:           libreport
Comment 22 Reinier Bikker 2016-01-14 02:22:24 EST
Solved here https://bugzilla.redhat.com/show_bug.cgi?id=1266304

Note You need to log in before you can comment on or make changes to this bug.