Red Hat Bugzilla – Bug 1422000
SELinux is preventing /usr/bin/certwatch from using the dac_override capability
Last modified: 2018-04-10 08:26:56 EDT
Description of problem: there are many denial Version-Release number of selected component (if applicable): crypto-utils-2.4.1-42.el7.x86_64 selinux-policy-3.13.1-117.el7.noarch How reproducible: tried once only Steps to Reproduce: 1.reboot the machine 2. 3. Actual results: /varlog/message: Feb 13 15:30:02 localhost certwatch: ObjectStore.cpp(59): Failed to enumerate object store in /var/lib/softhsm/tokens/ Feb 13 15:30:02 localhost certwatch: SoftHSM.cpp(476): Could not load the object store Feb 13 15:30:02 localhost certwatch: ObjectStore.cpp(59): Failed to enumerate object store in /var/lib/softhsm/tokens/ Feb 13 15:30:02 localhost certwatch: SoftHSM.cpp(476): Could not load the object store Feb 13 15:30:02 localhost dbus-daemon: dbus[710]: [system] Activating service name='org.fedoraproject.Setroubleshootd' (using servicehelper) Feb 13 15:30:02 localhost dbus[710]: [system] Activating service name='org.fedoraproject.Setroubleshootd' (using servicehelper) Feb 13 15:30:02 localhost certwatch: ObjectStore.cpp(59): Failed to enumerate object store in /var/lib/softhsm/tokens/ Feb 13 15:30:02 localhost certwatch: SoftHSM.cpp(476): Could not load the object store Feb 13 15:30:02 localhost certwatch: ObjectStore.cpp(59): Failed to enumerate object store in /var/lib/softhsm/tokens/ Feb 13 15:30:02 localhost certwatch: SoftHSM.cpp(476): Could not load the object store Feb 13 15:30:02 localhost certwatch: ObjectStore.cpp(59): Failed to enumerate object store in /var/lib/softhsm/tokens/ Feb 13 15:30:02 localhost certwatch: SoftHSM.cpp(476): Could not load the object store Feb 13 15:30:02 localhost certwatch: ObjectStore.cpp(59): Failed to enumerate object store in /var/lib/softhsm/tokens/ Feb 13 15:30:02 localhost certwatch: SoftHSM.cpp(476): Could not load the object store Feb 13 15:30:02 localhost dbus[710]: [system] Successfully activated service 'org.fedoraproject.Setroubleshootd' Feb 13 15:30:02 localhost dbus-daemon: dbus[710]: [system] Successfully activated service 'org.fedoraproject.Setroubleshootd' Feb 13 15:30:03 localhost setroubleshoot: SELinux is preventing /usr/bin/certwatch from using the dac_override capability. For complete SELinux messages. run sealert -l 62b6dfbb-62e0-449b-86df-b073cd038129 Feb 13 15:30:03 localhost python: SELinux is preventing /usr/bin/certwatch from using the dac_override capability.#012#012***** Plugin dac_override (91.4 confidence) suggests **********************#012#012If you want to help identify if domain needs this access or you have a file with the wrong permissions on your system#012Then turn on full auditing to get path information about the offending file and generate the error again.#012Do#012#012Turn on full auditing#012# auditctl -w /etc/shadow -p w#012Try to recreate AVC. Then execute#012# ausearch -m avc -ts recent#012If you see PATH record check ownership/permissions on file, and fix it,#012otherwise report as a bugzilla.#012#012***** Plugin catchall (9.59 confidence) suggests **************************#012#012If you believe that certwatch should have the dac_override capability by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this access.#012Do#012allow this access for now by executing:#012# ausearch -c 'certwatch' --raw | audit2allow -M my-certwatch#012# semodule -i my-certwatch.pp#012 Feb 13 15:30:03 localhost setroubleshoot: SELinux is preventing /usr/bin/certwatch from using the dac_override capability. For complete SELinux messages. run sealert -l 62b6dfbb-62e0-449b-86df-b073cd038129 /var/log/audit/audit.log type=AVC msg=audit(1486996202.302:395): avc: denied { dac_override } for pid=17404 comm="certwatch" capability=1 scontext=system_u:system_r:certwatch_t:s0-s0:c0.c1023 tcontext=system_u:system_r:certwatch_t:s0-s0:c0.c1023 tclass=capability type=AVC msg=audit(1486996202.302:395): avc: denied { dac_read_search } for pid=17404 comm="certwatch" capability=2 scontext=system_u:system_r:certwatch_t:s0-s0:c0.c1023 tcontext=system_u:system_r:certwatch_t:s0-s0:c0.c1023 tclass=capability type=AVC msg=audit(1486996202.303:396): avc: denied { dac_override } for pid=17404 comm="certwatch" capability=1 scontext=system_u:system_r:certwatch_t:s0-s0:c0.c1023 tcontext=system_u:system_r:certwatch_t:s0-s0:c0.c1023 tclass=capability type=AVC msg=audit(1486996202.303:396): avc: denied { dac_read_search } for pid=17404 comm="certwatch" capability=2 scontext=system_u:system_r:certwatch_t:s0-s0:c0.c1023 tcontext=system_u:system_r:certwatch_t:s0-s0:c0.c1023 tclass=capability type=AVC msg=audit(1486996202.327:397): avc: denied { dac_override } for pid=17405 comm="certwatch" capability=1 scontext=system_u:system_r:certwatch_t:s0-s0:c0.c1023 tcontext=system_u:system_r:certwatch_t:s0-s0:c0.c1023 tclass=capability type=AVC msg=audit(1486996202.327:397): avc: denied { dac_read_search } for pid=17405 comm="certwatch" capability=2 scontext=system_u:system_r:certwatch_t:s0-s0:c0.c1023 tcontext=system_u:system_r:certwatch_t:s0-s0:c0.c1023 tclass=capability Expected results: no denial? Additional info:
Could you paste here the output of following command? # ls -lR /var/lib/softhsm
[root@localhost ~]# ls -lR /var/lib/softhsm /var/lib/softhsm: total 0 drwxrwx---. 2 ods ods 6 Jun 23 2016 tokens /var/lib/softhsm/tokens: total 0
I have also experienced this AVC denial. Based on for example bug 1389945, I ran the following: auditctl -w /var/lib/softhsm/tokens -p r I then manually reproduced the problem with: runcon -t certwatch_t -u system_u -r system_r /etc/cron.daily/certwatch After that, running "ausearch -m avc -ts recent" returns: time->Wed Apr 26 02:05:38 2017 type=PATH msg=audit(1493168738.149:36388): item=0 name="/var/lib/softhsm/tokens/" objtype=UNKNOWN type=CWD msg=audit(1493168738.149:36388): cwd="/root" type=SYSCALL msg=audit(1493168738.149:36388): arch=c000003e syscall=257 success=no exit=-13 a0=ffffffffffffff9c a1=88d358 a2=90800 a3=0 items=1 ppid=6391 pid=6395 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1 comm="certwatch" exe="/usr/bin/certwatch" subj=system_u:system_r:certwatch_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1493168738.149:36388): avc: denied { dac_read_search } for pid=6395 comm="certwatch" capability=2 scontext=system_u:system_r:certwatch_t:s0-s0:c0.c1023 tcontext=system_u:system_r:certwatch_t:s0-s0:c0.c1023 tclass=capability type=AVC msg=audit(1493168738.149:36388): avc: denied { dac_override } for pid=6395 comm="certwatch" capability=1 scontext=system_u:system_r:certwatch_t:s0-s0:c0.c1023 tcontext=system_u:system_r:certwatch_t:s0-s0:c0.c1023 tclass=capability ---- time->Wed Apr 26 02:05:38 2017 type=PATH msg=audit(1493168738.150:36389): item=0 name="/var/lib/softhsm/tokens/" objtype=UNKNOWN type=CWD msg=audit(1493168738.150:36389): cwd="/root" type=SYSCALL msg=audit(1493168738.150:36389): arch=c000003e syscall=257 success=no exit=-13 a0=ffffffffffffff9c a1=88d318 a2=90800 a3=0 items=1 ppid=6391 pid=6395 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1 comm="certwatch" exe="/usr/bin/certwatch" subj=system_u:system_r:certwatch_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1493168738.150:36389): avc: denied { dac_read_search } for pid=6395 comm="certwatch" capability=2 scontext=system_u:system_r:certwatch_t:s0-s0:c0.c1023 tcontext=system_u:system_r:certwatch_t:s0-s0:c0.c1023 tclass=capability type=AVC msg=audit(1493168738.150:36389): avc: denied { dac_override } for pid=6395 comm="certwatch" capability=1 scontext=system_u:system_r:certwatch_t:s0-s0:c0.c1023 tcontext=system_u:system_r:certwatch_t:s0-s0:c0.c1023 tclass=capability ---- (and more) Perhaps this info will be useful for those with more selinux-fu than I. Jifl
*** Bug 1465185 has been marked as a duplicate of this bug. ***
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0763