Hide Forgot
Created attachment 1191662 [details] TE policy file. Description of problem: A new version of cloud-init that supports the effort to provision RHEL Atomic on Microsoft Azure requires some a new policy that allows dhclient/dhclient hooks to call cloud-init. A sample of the log: type=AVC msg=audit(1471446337.842:847): avc: denied { getattr } for pid=5514 comm="dhclient-script" path="/usr/bin/cloud-init" dev="sda2" ino=34851037 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=system_u:object_r:cloud_init_exec_t:s0 tclass=file type=SYSCALL msg=audit(1471446337.842:847): arch=c000003e syscall=4 success=no exit=-13 a0=1320e70 a1=7ffdea8a8ec0 a2=7ffdea8a8ec0 a3=4 items=0 ppid=5472 pid=5514 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=2 comm="dhclient-script" exe="/usr/bin/bash" subj=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1471446337.842:848): avc: denied { getattr } for pid=5514 comm="dhclient-script" path="/usr/bin/cloud-init" dev="sda2" ino=34851037 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=system_u:object_r:cloud_init_exec_t:s0 tclass=file type=SYSCALL msg=audit(1471446337.842:848): arch=c000003e syscall=4 success=no exit=-13 a0=1320e70 a1=7ffdea8a8ec0 a2=7ffdea8a8ec0 a3=4 items=0 ppid=5472 pid=5514 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=2 comm="dhclient-script" exe="/usr/bin/bash" subj=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 key=(null) type=NETFILTER_CFG msg=audit(1471446338.312:849): table=filter family=2 entries=79 [root@baude-rhel-ci3 dhclient.d]# audit2allow -a #============= dhcpc_t ============== allow dhcpc_t cloud_init_exec_t:file { execute getattr read open ioctl execute_no_trans }; allow dhcpc_t cloud_var_lib_t:file { read getattr open }; allow dhcpc_t cloud_var_lib_t:lnk_file read; allow dhcpc_t ldconfig_exec_t:file { read execute open execute_no_trans }; allow dhcpc_t var_run_t:file unlink; I will attach the policy.
Could you attach raw AVC msgs? Thank you.
Please, re-run your scenario after installing the latest selinux-policy* packages (3.13.1-96.el7). Let us know, if the scenario generates any SELinux denials.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-2283.html