RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1364513 - selinux denial when bringing interface up or down with dhcp
Summary: selinux denial when bringing interface up or down with dhcp
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.2
Hardware: All
OS: Linux
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Lukas Vrabec
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-08-05 14:26 UTC by Jason Montleon
Modified: 2018-10-30 10:00 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-10-30 09:59:15 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:3111 0 None None None 2018-10-30 10:00:02 UTC

Description Jason Montleon 2016-08-05 14:26:15 UTC 
Description of problem:
We are seeing the errors below when bringing interfaces up and down on RHEL 7.2 with dhcp enabled. The error does not appear when dhcp is not used,

Adding the following fixes this:
require {
	type dhcpc_t;
	type policykit_t;
	class dbus send_msg;
}

allow dhcpc_t policykit_t:dbus send_msg;
allow policykit_t dhcpc_t:dbus send_msg;

[root@sat62fusor ~]# ifdown em3

** (pkttyagent:38203): WARNING **: Unable to register authentication agent: GDBus.Error:org.freedesktop.DBus.Error.AccessDenied: An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_call", sender=":1.902" (uid=0 pid=38203 comm="/usr/bin/pkttyagent --notify-fd 5 --fallback ") interface="org.freedesktop.PolicyKit1.Authority" member="RegisterAuthenticationAgentWithOptions" error name="(unset)" requested_reply="0" destination=":1.4" (uid=997 pid=1155 comm="/usr/lib/polkit-1/polkitd --no-debug ")
Error registering authentication agent: GDBus.Error:org.freedesktop.DBus.Error.AccessDenied: An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_call", sender=":1.902" (uid=0 pid=38203 comm="/usr/bin/pkttyagent --notify-fd 5 --fallback ") interface="org.freedesktop.PolicyKit1.Authority" member="RegisterAuthenticationAgentWithOptions" error name="(unset)" requested_reply="0" destination=":1.4" (uid=997 pid=1155 comm="/usr/lib/polkit-1/polkitd --no-debug ") (g-dbus-error-quark, 9)
[root@sat62fusor ~]# ifup em3

Determining IP information for em3...
** (pkttyagent:38365): WARNING **: Unable to register authentication agent: GDBus.Error:org.freedesktop.DBus.Error.AccessDenied: An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_call", sender=":1.909" (uid=0 pid=38365 comm="/usr/bin/pkttyagent --notify-fd 5 --fallback ") interface="org.freedesktop.PolicyKit1.Authority" member="RegisterAuthenticationAgentWithOptions" error name="(unset)" requested_reply="0" destination=":1.4" (uid=997 pid=1155 comm="/usr/lib/polkit-1/polkitd --no-debug ")
Error registering authentication agent: GDBus.Error:org.freedesktop.DBus.Error.AccessDenied: An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_call", sender=":1.909" (uid=0 pid=38365 comm="/usr/bin/pkttyagent --notify-fd 5 --fallback ") interface="org.freedesktop.PolicyKit1.Authority" member="RegisterAuthenticationAgentWithOptions" error name="(unset)" requested_reply="0" destination=":1.4" (uid=997 pid=1155 comm="/usr/lib/polkit-1/polkitd --no-debug ") (g-dbus-error-quark, 9)
 done.

[root@sat62fusor ~]# 


Version-Release number of selected component (if applicable):

[root@sat62fusor ~]# cat /etc/redhat-release 
Red Hat Enterprise Linux Server release 7.2 (Maipo)
[root@sat62fusor ~]# rpm -q selinux-policy-targeted dhclient
selinux-policy-targeted-3.13.1-60.el7_2.7.noarch
dhclient-4.2.5-42.el7.x86_64

How reproducible:
Seems always if dhcp is used

Steps to Reproduce:
1. Install RHEL 7.2
2. configure an interface to use dhcp
3. manually bring interface up or down

Actual results:
ugly message printed to the console. avc's logged in the audit.log

Expected results:
Interface comes up without errors

Additional info:
AVC's:
type=USER_AVC msg=audit(1470405534.657:2639): pid=1109 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_call interface=org.freedesktop.DBus.Properties member=GetAll dest=:1.4 spid=35859 tpid=1155 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=system_u:system_r:policykit_t:s0 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1470405534.658:2640): pid=1109 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_call interface=org.freedesktop.PolicyKit1.Authority member=RegisterAuthenticationAgentWithOptions dest=:1.4 spid=35859 tpid=1155 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=system_u:system_r:policykit_t:s0 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1470405703.620:2665): pid=1109 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.831 spid=1155 tpid=36249 scontext=system_u:system_r:policykit_t:s0 tcontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1470405728.648:2666): pid=1109 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=signal interface=org.freedesktop.PolicyKit1.Authority member=Changed dest=org.freedesktop.DBus spid=1155 tpid=36249 scontext=system_u:system_r:policykit_t:s0 tcontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1470405728.648:2667): pid=1109 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.831 spid=1155 tpid=36249 scontext=system_u:system_r:policykit_t:s0 tcontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1470405753.692:2668): pid=1109 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.832 spid=1155 tpid=36295 scontext=system_u:system_r:policykit_t:s0 tcontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
Comment 3 James Olin Oden 2016-08-08 12:57:16 UTC 
I have one, if you can get to it this morning.   My irc handles is oden.
Comment 5 Jason Montleon 2016-09-26 12:51:54 UTC 
James offered to provide a host, removing the needinfo tag. Note it may be necessary to remove the fusor-selinux package if it is installed to see this error at this point.
Comment 8 Milos Malik 2017-04-10 15:35:16 UTC 
The problem could be system_u versus unconfined_u:

scontext=system_u:system_r:policykit_t:s0 tcontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tclass=dbus

What's your opinion Lukas?
Comment 13 errata-xmlrpc 2018-10-30 09:59:15 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3111
Note You need to log in before you can comment on or make changes to this bug.