Bug 1290310 - SELinux policy (daemons) changes required for package: chrony
Summary: SELinux policy (daemons) changes required for package: chrony
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy
Version: 6.8
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Miroslav Grepl
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On: Engineering1281473
Blocks: Red Hat1274811
TreeView+ depends on / blocked
 
Reported: 2015-12-10 07:36 UTC by Eng Ops Maitai User
Modified: 2016-05-10 20:03 UTC (History)
8 users (show)

Fixed In Version: selinux-policy-3.7.19-286.el6
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-05-10 20:03:27 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2016:0763 0 normal SHIPPED_LIVE selinux-policy bug fix update 2016-05-10 22:33:46 UTC

Comment 1 Milos Malik 2015-12-15 14:54:43 UTC
refclock SOCK /var/run/chronyd.sock refid PPS

Above-mentioned line added to /etc/chrony.conf caused following AVC in enforcing mode:
----
type=PATH msg=audit(12/15/2015 15:52:00.883:1803) : item=2 name=(null) nametype=CREATE 
type=PATH msg=audit(12/15/2015 15:52:00.883:1803) : item=1 name=(null) inode=508 dev=fc:03 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:var_run_t:s0 nametype=PARENT 
type=PATH msg=audit(12/15/2015 15:52:00.883:1803) : item=0 name=(null) inode=508 dev=fc:03 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:var_run_t:s0 nametype=PARENT 
type=SOCKADDR msg=audit(12/15/2015 15:52:00.883:1803) : saddr=local /var/run/chronyd.sock 
type=SYSCALL msg=audit(12/15/2015 15:52:00.883:1803) : arch=x86_64 syscall=bind success=no exit=-13(Permission denied) a0=0x6 a1=0x7ffc9a082340 a2=0x6e a3=0x0 items=3 ppid=1 pid=846 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=1 comm=chronyd exe=/usr/sbin/chronyd subj=unconfined_u:system_r:chronyd_t:s0 key=(null) 
type=AVC msg=audit(12/15/2015 15:52:00.883:1803) : avc:  denied  { create } for  pid=846 comm=chronyd name=chronyd.sock scontext=unconfined_u:system_r:chronyd_t:s0 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=sock_file 
----

Comment 2 Milos Malik 2015-12-15 15:01:29 UTC
The same scenario triggered following AVC in permissive mode:
----
type=PATH msg=audit(12/15/2015 16:00:03.745:1852) : item=4 name=(null) inode=15029 dev=fc:03 mode=socket,755 ouid=root ogid=root rdev=00:00 obj=unconfined_u:object_r:var_run_t:s0 nametype=CREATE 
type=PATH msg=audit(12/15/2015 16:00:03.745:1852) : item=3 name=(null) inode=508 dev=fc:03 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:var_run_t:s0 nametype=PARENT 
type=PATH msg=audit(12/15/2015 16:00:03.745:1852) : item=2 name=(null) nametype=CREATE 
type=PATH msg=audit(12/15/2015 16:00:03.745:1852) : item=1 name=(null) inode=508 dev=fc:03 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:var_run_t:s0 nametype=PARENT 
type=PATH msg=audit(12/15/2015 16:00:03.745:1852) : item=0 name=(null) inode=508 dev=fc:03 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:var_run_t:s0 nametype=PARENT 
type=SOCKADDR msg=audit(12/15/2015 16:00:03.745:1852) : saddr=local /var/run/chronyd.sock 
type=SYSCALL msg=audit(12/15/2015 16:00:03.745:1852) : arch=x86_64 syscall=bind success=yes exit=0 a0=0x6 a1=0x7ffc933111f0 a2=0x6e a3=0x0 items=5 ppid=1 pid=4688 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=1 comm=chronyd exe=/usr/sbin/chronyd subj=unconfined_u:system_r:chronyd_t:s0 key=(null) 
type=AVC msg=audit(12/15/2015 16:00:03.745:1852) : avc:  denied  { create } for  pid=4688 comm=chronyd name=chronyd.sock scontext=unconfined_u:system_r:chronyd_t:s0 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=sock_file 
----

Comment 3 Milos Malik 2015-12-15 15:10:41 UTC
File context pattern is missing in RHEL-6.7:
# matchpathcon /var/run/chronyd.sock
/var/run/chronyd.sock	system_u:object_r:var_run_t:s0
#

File context pattern is defined on RHEL-7.2:
# matchpathcon /var/run/chronyd.sock
/var/run/chronyd.sock	system_u:object_r:chronyd_var_run_t:s0
#

Comment 7 errata-xmlrpc 2016-05-10 20:03:27 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-0763.html


Note You need to log in before you can comment on or make changes to this bug.