RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1267638 - SELinux is preventing iscsid from 'read' accesses on the file /usr/lib/modules/4.1.6-200.fc22.x86_64/modules.dep.bin.
Summary: SELinux is preventing iscsid from 'read' accesses on the file /usr/lib/module...
Keywords:
Status: CLOSED DUPLICATE of bug 1266928
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.2
Hardware: x86_64
OS: Unspecified
urgent
unspecified
Target Milestone: rc
: ---
Assignee: Miroslav Grepl
QA Contact: BaseOS QE Security Team
URL:
Whiteboard: abrt_hash:e7f6d79eaa46b58087c9785611d...
Depends On: 1258194
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-09-30 14:36 UTC by Filip Hubík
Modified: 2015-10-02 08:39 UTC (History)
14 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of: 1258194
Environment:
Last Closed: 2015-10-02 08:39:43 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description Filip Hubík 2015-09-30 14:36:08 UTC
Also appeared on RHEL Server release 7.2 Beta (Maipo).

selinux-policy-3.13.1-44.el7.noarch
kernel-3.10.0-306.0.1.el7.x86_64

+++ This bug was initially created as a clone of Bug #1258194 +++

Description of problem:
After updating to 4.1.6-200.fc22.x86_64 iscsi.service will not start and thus no iscsi volume will mount.
SELinux is preventing iscsid from 'read' accesses on the file /usr/lib/modules/4.1.6-200.fc22.x86_64/modules.dep.bin.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that iscsid should be allowed read access on the modules.dep.bin file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep iscsid /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:iscsid_t:s0
Target Context                unconfined_u:object_r:modules_dep_t:s0
Target Objects                /usr/lib/modules/4.1.6-200.fc22.x86_64/modules.dep
                              .bin [ file ]
Source                        iscsid
Source Path                   iscsid
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-128.12.fc22.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 4.1.6-200.fc22.x86_64 #1 SMP Mon
                              Aug 17 19:54:31 UTC 2015 x86_64 x86_64
Alert Count                   5
First Seen                    2015-08-30 12:38:10 AWST
Last Seen                     2015-08-30 15:30:53 AWST
Local ID                      0be9475c-165c-4c20-bf91-27ddd8d5675d

Raw Audit Messages
type=AVC msg=audit(1440919853.461:678): avc:  denied  { read } for  pid=1692 comm="iscsid" name="modules.dep.bin" dev="sdc4" ino=397616 scontext=system_u:system_r:iscsid_t:s0 tcontext=unconfined_u:object_r:modules_dep_t:s0 tclass=file permissive=0


Hash: iscsid,iscsid_t,modules_dep_t,file,read

Version-Release number of selected component:
selinux-policy-3.13.1-128.12.fc22.noarch

Additional info:
reporter:       libreport-2.6.2
hashmarkername: setroubleshoot
kernel:         4.1.6-200.fc22.x86_64
type:           libreport

--- Additional comment from Daniel Rowe on 2015-08-30 04:01:46 EDT ---

It not the update to the latest kernel as I rebooted into the previous and its still broken.

--- Additional comment from Daniel Rowe on 2015-08-30 04:16:17 EDT ---

This fixes it for me for now:

module iscsi_fix 1.0;

require {
	type iscsid_t;
	type modules_dep_t;
	class file { read getattr open };
}

#============= iscsid_t ==============
allow iscsid_t modules_dep_t:file getattr;

#!!!! This avc is allowed in the current policy
allow iscsid_t modules_dep_t:file { read open };

--- Additional comment from Corey Sheldon on 2015-08-30 07:19:21 EDT ---

Have you tried a  selinux relabel.  Your  comment (comment 2) seems to lend to the selinux tags NOT being natively  label properly.  What was the  previous  kernel 4.1.5  or  something previous to that ?  (Updated from Version /  kernel not  shown).

--- Additional comment from Daniel Rowe on 2015-08-30 07:27:54 EDT ---

I did a "restorecon -Rv /lib/modules" on the folder and there was no output.

[root@bajor 4.1.6-200.fc22.x86_64]# ls -Z modules.dep.bin
unconfined_u:object_r:modules_dep_t:s0 modules.dep.bin

I'm not sure it was the kernel, I just had a look at the logs and selinux policy was updated could it be an issue with this:

For the dnf.log:

Aug 30 12:32:26 DEBUG ---> Package selinux-policy.noarch 3.13.1-128.10.fc22 will be upgraded
Aug 30 12:32:26 DEBUG ---> Package selinux-policy.noarch 3.13.1-128.12.fc22 will be an upgrade
Aug 30 12:32:26 DEBUG ---> Package selinux-policy-targeted.noarch 3.13.1-128.10.fc22 will be upgraded
Aug 30 12:32:26 DEBUG ---> Package selinux-policy-targeted.noarch 3.13.1-128.12.fc22 will be an upgrade

--- Additional comment from Fredy Neeser on 2015-09-14 14:17:35 EDT ---

Same issue here with iscsi initiator (iscsid) no longer working due to SELinux AVCs.

The SELinux AVCs for iscsid started appearing in the Aug./Sept. 2015 time frame.  Using the following command I noted that the selinux default security contexts for certain files in /usr/lib/modules were changed recently:

# restorecon -nrv /usr/lib/modules
restorecon reset /usr/lib/modules/4.1.6-200.fc22.x86_64/modules.symbols.bin context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.1.6-200.fc22.x86_64/modules.softdep context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.1.6-200.fc22.x86_64/modules.builtin.bin context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.1.6-200.fc22.x86_64/modules.dep context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.1.6-200.fc22.x86_64/modules.alias context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.1.6-200.fc22.x86_64/modules.dep.bin context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.1.6-200.fc22.x86_64/modules.alias.bin context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.1.6-200.fc22.x86_64/modules.devname context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.1.6-200.fc22.x86_64/modules.symbols context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.0.8-300.fc22.x86_64/modules.symbols.bin context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.0.8-300.fc22.x86_64/modules.softdep context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.0.8-300.fc22.x86_64/modules.builtin.bin context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.0.8-300.fc22.x86_64/modules.dep context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.0.8-300.fc22.x86_64/modules.alias context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.0.8-300.fc22.x86_64/modules.dep.bin context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.0.8-300.fc22.x86_64/modules.alias.bin context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.0.8-300.fc22.x86_64/modules.devname context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.0.8-300.fc22.x86_64/modules.symbols context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0

OK ... so I had to fix these labels as follows:

# restorecon -rv /usr/lib/modules
restorecon reset /usr/lib/modules/4.1.6-200.fc22.x86_64/modules.symbols.bin context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.1.6-200.fc22.x86_64/modules.softdep context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.1.6-200.fc22.x86_64/modules.builtin.bin context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.1.6-200.fc22.x86_64/modules.dep context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.1.6-200.fc22.x86_64/modules.alias context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.1.6-200.fc22.x86_64/modules.dep.bin context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.1.6-200.fc22.x86_64/modules.alias.bin context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.1.6-200.fc22.x86_64/modules.devname context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.1.6-200.fc22.x86_64/modules.symbols context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.0.8-300.fc22.x86_64/modules.symbols.bin context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.0.8-300.fc22.x86_64/modules.softdep context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.0.8-300.fc22.x86_64/modules.builtin.bin context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.0.8-300.fc22.x86_64/modules.dep context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.0.8-300.fc22.x86_64/modules.alias context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.0.8-300.fc22.x86_64/modules.dep.bin context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.0.8-300.fc22.x86_64/modules.alias.bin context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.0.8-300.fc22.x86_64/modules.devname context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0
restorecon reset /usr/lib/modules/4.0.8-300.fc22.x86_64/modules.symbols context system_u:object_r:modules_object_t:s0->system_u:object_r:modules_dep_t:s0

This did the job, because 'restorecon -nrv' no longer generated any output after this:
# restorecon -nrv /usr/lib/modules

--- Additional comment from Fredy Neeser on 2015-09-14 14:27:03 EDT ---

The above did not resolve the AVC denials to iscsid.  Symptoms included:

audit[1612]: <audit-1400> avc:  denied  { read } for  pid=1612 comm="iscsid" name="modules.softdep" dev="dm-2" ino=3025080 scontext=system_u:system_r:iscsid_t:s0 tcontext=unconfined_u:object_r:modules_dep_t:s0 tclass=file permissive=0

audit[1612]: <audit-1300> arch=c000003e syscall=2 success=no exit=-13 a0=7ffe04b980a0 a1=80000 a2=7ffe04b980d2 a3=5f3638782e323263 items=0 ppid=1 pid=1612 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iscsid" exe="/usr/sbin/iscsid" subj=system_u:system_r:iscsid_t:s0 key=(null)
  
iscsiadm[1607]: iscsiadm: initiator reported error (12 - iSCSI driver not found. Please make sure it is loaded, and retry the operation)

iscsid[1611]: Could not insert module tcp. Kmod error -38


SELinux suggests the following, along with similar suggestions for other files in /usr/lib/modules:

python[1624]: SELinux is preventing /usr/sbin/iscsid from read access on the file /usr/lib/modules/4.1.3-201.fc22.x86_64/modules.softdep.
                                                    
                                                    *****  Plugin catchall (100. confidence) suggests   **************************
                                                    
                                                    If you believe that iscsid should be allowed read access on the modules.softdep file by default.
                                                    Then you should report this as a bug.
                                                    You can generate a local policy module to allow this access.
                                                    Do
                                                    allow this access for now by executing:
                                                    # grep iscsid /var/log/audit/audit.log | audit2allow -M mypol
                                                    # semodule -i mypol.pp


===> OK, I'll try this next ...

--- Additional comment from Fredy Neeser on 2015-09-14 14:54:16 EDT ---

The selinux suggestions do not explain that one may need multiple iterations to create a local policy module for fixing the AVCs generated by iscsid.  After doing a first iteration that allows a certain access, iscsid may do other things that trigger different AVCs ...

So we need to iteratively create/install/test a local policy module 'iscsi-fix' by repeating

  # grep iscsid /var/log/audit/audit.log | audit2allow -M iscsi-fix  
  # semodule -r iscsi-fix
  # semodule -i iscsi-fix.pp
  
  % Should probably restart iscsid.service
  # systemctl restart iscsid.service
  % Retest iscsid ... 
  
until iscsid no longer generates any AVC denials.  

This procedure keeps updating two files in the work directory, namely
  iscsi-fix.pp
  iscsi-fix.te

Note that directly installing (or upgrading) the updated iscsi-fix
did not work, but it was possible to remove and then reinstall the
local policy module.

With the above iterative approach, I ended up with an iscsi-fix.te as shown below (equivalent to the one in Comment 2):

module iscsi-fix 1.0;

require {
	type iscsid_t;
	type modules_dep_t;
	class file { read getattr open };
}

#============= iscsid_t ==============
allow iscsid_t modules_dep_t:file getattr;

#!!!! This avc is allowed in the current policy
allow iscsid_t modules_dep_t:file { read open };

--- Additional comment from Fredy Neeser on 2015-09-14 15:00:43 EDT ---

After applying the steps in Comment 7 and rebooting, the journal no longer shows any of the previous errors:

- SELinux access denials (avc: denied ...) for iscsid
- iscsiadm[1607]: iscsiadm: initiator reported error (12 - iSCSI driver not found. Please make sure it is loaded, and retry the operation)
- iscsid[1611]: Could not insert module tcp. Kmod error -38
- setroubleshoot messages for iscsid

Comment 2 Milos Malik 2015-09-30 14:47:06 UTC
I believe this bug is a duplicate of BZ#1266928.

Comment 3 Miroslav Grepl 2015-10-02 08:39:43 UTC

*** This bug has been marked as a duplicate of bug 1266928 ***


Note You need to log in before you can comment on or make changes to this bug.