Hide Forgot
Description of problem: Version-Release number of selected component (if applicable): selinux-policy-3.13.1-60.el7.noarch selinux-policy-devel-3.13.1-60.el7.noarch selinux-policy-doc-3.13.1-60.el7.noarch selinux-policy-minimum-3.13.1-60.el7.noarch selinux-policy-mls-3.13.1-60.el7.noarch selinux-policy-sandbox-3.13.1-60.el7.noarch selinux-policy-targeted-3.13.1-60.el7.noarch systemd-219-19.el7.x86_64 systemd-devel-219-19.el7.x86_64 systemd-journal-gateway-219-19.el7.x86_64 systemd-libs-219-19.el7.x86_64 systemd-networkd-219-19.el7.x86_64 systemd-python-219-19.el7.x86_64 systemd-resolved-219-19.el7.x86_64 systemd-sysv-219-19.el7.x86_64 How reproducible: * very often Steps to Reproduce: 1. get a RHEL-7.2 machine with active targeted policy 2. service systemd-networkd start 3. wait few seconds 4. search for SELinux denials Actual results (enforcing mode): ---- type=PATH msg=audit(01/13/2016 11:42:41.524:461) : item=0 name=/dev/kmsg inode=4680 dev=00:05 mode=character,644 ouid=root ogid=root rdev=01:0b obj=system_u:object_r:kmsg_device_t:s0 objtype=NORMAL type=CWD msg=audit(01/13/2016 11:42:41.524:461) : cwd=/ type=SYSCALL msg=audit(01/13/2016 11:42:41.524:461) : arch=x86_64 syscall=open success=yes exit=4 a0=0x7f8173433aa5 a1=O_WRONLY|O_NOCTTY|O_CLOEXEC a2=0xffffffff a3=0x7f81727297b8 items=1 ppid=1 pid=11983 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=systemd-network exe=/usr/lib/systemd/systemd-networkd subj=system_u:system_r:systemd_networkd_t:s0 key=(null) type=AVC msg=audit(01/13/2016 11:42:41.524:461) : avc: denied { open } for pid=11983 comm=systemd-network path=/dev/kmsg dev="devtmpfs" ino=4680 scontext=system_u:system_r:systemd_networkd_t:s0 tcontext=system_u:object_r:kmsg_device_t:s0 tclass=chr_file type=AVC msg=audit(01/13/2016 11:42:41.524:461) : avc: denied { write } for pid=11983 comm=systemd-network name=kmsg dev="devtmpfs" ino=4680 scontext=system_u:system_r:systemd_networkd_t:s0 tcontext=system_u:object_r:kmsg_device_t:s0 tclass=chr_file ---- Expected results: * no such denials
It happens when the current kernel was started with following parameters: systemd.debug systemd.log_level=debug systemd.log_target=kmsg
Milos, Could you attach logs from permissive mode? Thank you.
The domain is already permissive: # semanage permissive -l | grep networkd systemd_networkd_t # ---- type=PATH msg=audit(02/19/2016 08:52:28.104:145) : item=0 name=/dev/kmsg inode=4719 dev=00:05 mode=character,644 ouid=root ogid=root rdev=01:0b obj=system_u:object_r:kmsg_device_t:s0 objtype=NORMAL type=CWD msg=audit(02/19/2016 08:52:28.104:145) : cwd=/ type=SYSCALL msg=audit(02/19/2016 08:52:28.104:145) : arch=x86_64 syscall=open success=yes exit=4 a0=0x7f2bf2745aa5 a1=O_WRONLY|O_NOCTTY|O_CLOEXEC a2=0xffffffff a3=0x7f2bf1a3b7b8 items=1 ppid=1 pid=2391 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=systemd-network exe=/usr/lib/systemd/systemd-networkd subj=system_u:system_r:systemd_networkd_t:s0 key=(null) type=AVC msg=audit(02/19/2016 08:52:28.104:145) : avc: denied { open } for pid=2391 comm=systemd-network path=/dev/kmsg dev="devtmpfs" ino=4719 scontext=system_u:system_r:systemd_networkd_t:s0 tcontext=system_u:object_r:kmsg_device_t:s0 tclass=chr_file type=AVC msg=audit(02/19/2016 08:52:28.104:145) : avc: denied { write } for pid=2391 comm=systemd-network name=kmsg dev="devtmpfs" ino=4719 scontext=system_u:system_r:systemd_networkd_t:s0 tcontext=system_u:object_r:kmsg_device_t:s0 tclass=chr_file ----
This bug was accidentally moved from POST to MODIFIED via an error in automation, please see mmccune with any questions
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-2283.html