This service will be undergoing maintenance at 00:00 UTC, 2017-10-23 It is expected to last about 30 minutes
Bug 1308770 - ssh-keygen fails on the kvm image from RH website and hostname doesn't change properly
ssh-keygen fails on the kvm image from RH website and hostname doesn't change...
Status: NEW
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy (Show other bugs)
7.2
Unspecified Unspecified
medium Severity low
: rc
: ---
Assigned To: Lukas Vrabec
BaseOS QE Security Team
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2016-02-15 19:28 EST by David Hill
Modified: 2017-09-04 08:09 EDT (History)
7 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description David Hill 2016-02-15 19:28:23 EST
Description of problem:

[root@undercloud-rhosp8 audit]# cat audit.log | grep denied
type=AVC msg=audit(1455581062.544:32): avc:  denied  { getattr } for  pid=698 comm="mountpoint" path="/sys/fs/cgroup/systemd" dev="cgroup" ino=7083 scontext=system_u:system_r:sshd_keygen_t:s0 tcontext=system_u:object_r:cgroup_t:s0 tclass=dir
type=USER_AVC msg=audit(1455581819.619:325): pid=522 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.28 spid=20379 tpid=20378 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
type=AVC msg=audit(1455581826.978:457): avc:  denied  { create } for  pid=21057 comm="systemd-journal" name="4093bf66a4a4444886ac88feb9f56896" scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:initrc_var_log_t:s0 tclass=dir
[root@undercloud-rhosp8 audit]# cat audit.log | grep denied | audit2allow -R

require {
	type sshd_keygen_t;
	type syslogd_t;
	type initrc_var_log_t;
	type systemd_hostnamed_t;
	class dir create;
}

#============= sshd_keygen_t ==============
fs_relabel_cgroup_dirs(sshd_keygen_t)

#============= syslogd_t ==============
allow syslogd_t initrc_var_log_t:dir create;

#============= systemd_hostnamed_t ==============
init_dbus_send_script(systemd_hostnamed_t)


Version-Release number of selected component (if applicable):


How reproducible:
Everytime

Steps to Reproduce:
1. Get KVM image
2. Boot KVM image
3. Inject S01customize.local in it

Actual results:
SElinux blocks it

Expected results:
Shouldn't it be unconfined at this point?

Additional info:
Comment 5 David Hill 2017-09-04 08:09:29 EDT
I'm deploying in permissive in order to catch these kind of errors but I'm now using the RHEL 7.4 images and I don't think I've seen these errors.  I'll update if I see it again.

Note You need to log in before you can comment on or make changes to this bug.