Bug 1364513 - selinux denial when bringing interface up or down with dhcp
Summary: selinux denial when bringing interface up or down with dhcp
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.2
Hardware: All
OS: Linux
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Lukas Vrabec
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-08-05 14:26 UTC by Jason Montleon
Modified: 2018-10-30 10:00 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-10-30 09:59:15 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:3111 None None None 2018-10-30 10:00:02 UTC

Description Jason Montleon 2016-08-05 14:26:15 UTC
Description of problem:
We are seeing the errors below when bringing interfaces up and down on RHEL 7.2 with dhcp enabled. The error does not appear when dhcp is not used,

Adding the following fixes this:
require {
	type dhcpc_t;
	type policykit_t;
	class dbus send_msg;
}

allow dhcpc_t policykit_t:dbus send_msg;
allow policykit_t dhcpc_t:dbus send_msg;

[root@sat62fusor ~]# ifdown em3

** (pkttyagent:38203): WARNING **: Unable to register authentication agent: GDBus.Error:org.freedesktop.DBus.Error.AccessDenied: An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_call", sender=":1.902" (uid=0 pid=38203 comm="/usr/bin/pkttyagent --notify-fd 5 --fallback ") interface="org.freedesktop.PolicyKit1.Authority" member="RegisterAuthenticationAgentWithOptions" error name="(unset)" requested_reply="0" destination=":1.4" (uid=997 pid=1155 comm="/usr/lib/polkit-1/polkitd --no-debug ")
Error registering authentication agent: GDBus.Error:org.freedesktop.DBus.Error.AccessDenied: An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_call", sender=":1.902" (uid=0 pid=38203 comm="/usr/bin/pkttyagent --notify-fd 5 --fallback ") interface="org.freedesktop.PolicyKit1.Authority" member="RegisterAuthenticationAgentWithOptions" error name="(unset)" requested_reply="0" destination=":1.4" (uid=997 pid=1155 comm="/usr/lib/polkit-1/polkitd --no-debug ") (g-dbus-error-quark, 9)
[root@sat62fusor ~]# ifup em3

Determining IP information for em3...
** (pkttyagent:38365): WARNING **: Unable to register authentication agent: GDBus.Error:org.freedesktop.DBus.Error.AccessDenied: An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_call", sender=":1.909" (uid=0 pid=38365 comm="/usr/bin/pkttyagent --notify-fd 5 --fallback ") interface="org.freedesktop.PolicyKit1.Authority" member="RegisterAuthenticationAgentWithOptions" error name="(unset)" requested_reply="0" destination=":1.4" (uid=997 pid=1155 comm="/usr/lib/polkit-1/polkitd --no-debug ")
Error registering authentication agent: GDBus.Error:org.freedesktop.DBus.Error.AccessDenied: An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_call", sender=":1.909" (uid=0 pid=38365 comm="/usr/bin/pkttyagent --notify-fd 5 --fallback ") interface="org.freedesktop.PolicyKit1.Authority" member="RegisterAuthenticationAgentWithOptions" error name="(unset)" requested_reply="0" destination=":1.4" (uid=997 pid=1155 comm="/usr/lib/polkit-1/polkitd --no-debug ") (g-dbus-error-quark, 9)
 done.

[root@sat62fusor ~]# 


Version-Release number of selected component (if applicable):

[root@sat62fusor ~]# cat /etc/redhat-release 
Red Hat Enterprise Linux Server release 7.2 (Maipo)
[root@sat62fusor ~]# rpm -q selinux-policy-targeted dhclient
selinux-policy-targeted-3.13.1-60.el7_2.7.noarch
dhclient-4.2.5-42.el7.x86_64

How reproducible:
Seems always if dhcp is used

Steps to Reproduce:
1. Install RHEL 7.2
2. configure an interface to use dhcp
3. manually bring interface up or down

Actual results:
ugly message printed to the console. avc's logged in the audit.log

Expected results:
Interface comes up without errors

Additional info:
AVC's:
type=USER_AVC msg=audit(1470405534.657:2639): pid=1109 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_call interface=org.freedesktop.DBus.Properties member=GetAll dest=:1.4 spid=35859 tpid=1155 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=system_u:system_r:policykit_t:s0 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1470405534.658:2640): pid=1109 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_call interface=org.freedesktop.PolicyKit1.Authority member=RegisterAuthenticationAgentWithOptions dest=:1.4 spid=35859 tpid=1155 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=system_u:system_r:policykit_t:s0 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1470405703.620:2665): pid=1109 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.831 spid=1155 tpid=36249 scontext=system_u:system_r:policykit_t:s0 tcontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1470405728.648:2666): pid=1109 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=signal interface=org.freedesktop.PolicyKit1.Authority member=Changed dest=org.freedesktop.DBus spid=1155 tpid=36249 scontext=system_u:system_r:policykit_t:s0 tcontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1470405728.648:2667): pid=1109 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.831 spid=1155 tpid=36249 scontext=system_u:system_r:policykit_t:s0 tcontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1470405753.692:2668): pid=1109 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.832 spid=1155 tpid=36295 scontext=system_u:system_r:policykit_t:s0 tcontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'

Comment 3 James Olin Oden 2016-08-08 12:57:16 UTC
I have one, if you can get to it this morning.   My irc handles is oden.

Comment 5 Jason Montleon 2016-09-26 12:51:54 UTC
James offered to provide a host, removing the needinfo tag. Note it may be necessary to remove the fusor-selinux package if it is installed to see this error at this point.

Comment 8 Milos Malik 2017-04-10 15:35:16 UTC
The problem could be system_u versus unconfined_u:

scontext=system_u:system_r:policykit_t:s0 tcontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tclass=dbus

What's your opinion Lukas?

Comment 13 errata-xmlrpc 2018-10-30 09:59:15 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3111


Note You need to log in before you can comment on or make changes to this bug.