Bug 1290310 - SELinux policy (daemons) changes required for package: chrony
SELinux policy (daemons) changes required for package: chrony
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy (Show other bugs)
6.8
All Linux
medium Severity medium
: rc
: ---
Assigned To: Miroslav Grepl
Milos Malik
:
Depends On: 1281473
Blocks: 1274811
  Show dependency treegraph
 
Reported: 2015-12-10 02:36 EST by Eng Ops Maitai User
Modified: 2016-05-10 16:03 EDT (History)
8 users (show)

See Also:
Fixed In Version: selinux-policy-3.7.19-286.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-05-10 16:03:27 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Comment 1 Milos Malik 2015-12-15 09:54:43 EST
refclock SOCK /var/run/chronyd.sock refid PPS

Above-mentioned line added to /etc/chrony.conf caused following AVC in enforcing mode:
----
type=PATH msg=audit(12/15/2015 15:52:00.883:1803) : item=2 name=(null) nametype=CREATE 
type=PATH msg=audit(12/15/2015 15:52:00.883:1803) : item=1 name=(null) inode=508 dev=fc:03 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:var_run_t:s0 nametype=PARENT 
type=PATH msg=audit(12/15/2015 15:52:00.883:1803) : item=0 name=(null) inode=508 dev=fc:03 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:var_run_t:s0 nametype=PARENT 
type=SOCKADDR msg=audit(12/15/2015 15:52:00.883:1803) : saddr=local /var/run/chronyd.sock 
type=SYSCALL msg=audit(12/15/2015 15:52:00.883:1803) : arch=x86_64 syscall=bind success=no exit=-13(Permission denied) a0=0x6 a1=0x7ffc9a082340 a2=0x6e a3=0x0 items=3 ppid=1 pid=846 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=1 comm=chronyd exe=/usr/sbin/chronyd subj=unconfined_u:system_r:chronyd_t:s0 key=(null) 
type=AVC msg=audit(12/15/2015 15:52:00.883:1803) : avc:  denied  { create } for  pid=846 comm=chronyd name=chronyd.sock scontext=unconfined_u:system_r:chronyd_t:s0 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=sock_file 
----
Comment 2 Milos Malik 2015-12-15 10:01:29 EST
The same scenario triggered following AVC in permissive mode:
----
type=PATH msg=audit(12/15/2015 16:00:03.745:1852) : item=4 name=(null) inode=15029 dev=fc:03 mode=socket,755 ouid=root ogid=root rdev=00:00 obj=unconfined_u:object_r:var_run_t:s0 nametype=CREATE 
type=PATH msg=audit(12/15/2015 16:00:03.745:1852) : item=3 name=(null) inode=508 dev=fc:03 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:var_run_t:s0 nametype=PARENT 
type=PATH msg=audit(12/15/2015 16:00:03.745:1852) : item=2 name=(null) nametype=CREATE 
type=PATH msg=audit(12/15/2015 16:00:03.745:1852) : item=1 name=(null) inode=508 dev=fc:03 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:var_run_t:s0 nametype=PARENT 
type=PATH msg=audit(12/15/2015 16:00:03.745:1852) : item=0 name=(null) inode=508 dev=fc:03 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:var_run_t:s0 nametype=PARENT 
type=SOCKADDR msg=audit(12/15/2015 16:00:03.745:1852) : saddr=local /var/run/chronyd.sock 
type=SYSCALL msg=audit(12/15/2015 16:00:03.745:1852) : arch=x86_64 syscall=bind success=yes exit=0 a0=0x6 a1=0x7ffc933111f0 a2=0x6e a3=0x0 items=5 ppid=1 pid=4688 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=1 comm=chronyd exe=/usr/sbin/chronyd subj=unconfined_u:system_r:chronyd_t:s0 key=(null) 
type=AVC msg=audit(12/15/2015 16:00:03.745:1852) : avc:  denied  { create } for  pid=4688 comm=chronyd name=chronyd.sock scontext=unconfined_u:system_r:chronyd_t:s0 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=sock_file 
----
Comment 3 Milos Malik 2015-12-15 10:10:41 EST
File context pattern is missing in RHEL-6.7:
# matchpathcon /var/run/chronyd.sock
/var/run/chronyd.sock	system_u:object_r:var_run_t:s0
#

File context pattern is defined on RHEL-7.2:
# matchpathcon /var/run/chronyd.sock
/var/run/chronyd.sock	system_u:object_r:chronyd_var_run_t:s0
#
Comment 7 errata-xmlrpc 2016-05-10 16:03:27 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-0763.html

Note You need to log in before you can comment on or make changes to this bug.