RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1271822 - selinux denies pmlogger access to it's own config file
Summary: selinux denies pmlogger access to it's own config file
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.2
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: rc
: ---
Assignee: Miroslav Grepl
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-10-14 19:47 UTC by Lukas Berk
Modified: 2020-09-10 09:27 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-10-19 06:03:06 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)

Description Lukas Berk 2015-10-14 19:47:57 UTC 
Description of problem:
Upon starting the pmlogger service, selinux blocks pmlogger from reading it's own config file, which causes pmlogger to error out.

Version-Release number of selected component (if applicable):
selinux-policy-3.13.1-57.el7.noarch

How reproducible:
Always

Steps to Reproduce:
1.yum install pcp
2.systemctl start pmcd pmlogger
3.

Actual results:
pmlogger doesn't start, AVC denial triggered, pmlogger log file shows unable
to read it's config file.

Expected results:
pmlogger starts

Additional info:
AVC denial output
SELinux is preventing /usr/bin/pmlogger from open access on the file /var/lib/pcp/config/pmlogger/config.default.

*****  Plugin restorecon (99.5 confidence) suggests   ************************

If you want to fix the label. 
/var/lib/pcp/config/pmlogger/config.default default label should be pcp_var_lib_t.
Then you can run restorecon.
Do
# /sbin/restorecon -v /var/lib/pcp/config/pmlogger/config.default

*****  Plugin catchall (1.49 confidence) suggests   **************************

If you believe that pmlogger should be allowed open access on the config.default file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep pmlogger /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:pcp_pmlogger_t:s0-s0:c0.c1023
Target Context                system_u:object_r:tmp_t:s0
Target Objects                /var/lib/pcp/config/pmlogger/config.default [ file
                              ]
Source                        pmlogger
Source Path                   /usr/bin/pmlogger
Port                          <Unknown>
Host                          rhel7
Source RPM Packages           pcp-3.10.6-2.el7.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-57.el7.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     rhel7
Platform                      Linux rhel7 3.10.0-322.el7.x86_64 #1 SMP Mon Oct 5
                              21:41:10 EDT 2015 x86_64 x86_64
Alert Count                   30
First Seen                    2015-10-14 00:10:13 EDT
Last Seen                     2015-10-14 14:25:10 EDT
Local ID                      bcb45d5e-0c5b-4914-8564-102740c84c4b

Raw Audit Messages
type=AVC msg=audit(1444847110.570:14420): avc:  denied  { open } for  pid=31773 comm="pmlogger" path="/var/lib/pcp/config/pmlogger/config.default" dev="dm-0" ino=70955975 scontext=system_u:system_r:pcp_pmlogger_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmp_t:s0 tclass=file


type=SYSCALL msg=audit(1444847110.570:14420): arch=x86_64 syscall=open success=no exit=EACCES a0=7f0dfe754010 a1=0 a2=1b6 a3=24 items=0 ppid=27772 pid=31773 auid=992 uid=992 gid=990 euid=992 suid=992 fsuid=992 egid=990 sgid=990 fsgid=990 tty=(none)
Comment 2 Milos Malik 2015-10-15 08:22:07 UTC 
The config file is mislabeled, correct label is:

# matchpathcon /var/lib/pcp/config/pmlogger/config.default 
/var/lib/pcp/config/pmlogger/config.default	system_u:object_r:pcp_var_lib_t:s0
#

Please run following command:

# restorecon -Rv /var/lib/pcp
Comment 3 Miroslav Grepl 2015-10-19 06:03:06 UTC 
Lukas,
please try to fix labeling how Milos described above and re-open the bug if you are able to reproduce it. 

Thank you.
Note You need to log in before you can comment on or make changes to this bug.