Red Hat Bugzilla – Bug 1438532
SELinux prevents tgtd from opening /etc/pki/tls/legacy-settings
Last modified: 2018-04-10 08:29:13 EDT
Description of problem: * if /usr/lib64/tgt/backing-store/bs_glfs.so is installed, then tgtd loads it and then the AVC appears because: # ldd /usr/lib64/tgt/backing-store/bs_glfs.so | grep crypt libcrypto.so.10 => /lib64/libcrypto.so.10 (0x00007fa23d6e1000) # Version-Release number of selected component (if applicable): scsi-target-utils-1.0.55-4.el7.x86_64 scsi-target-utils-gluster-1.0.55-4.el7.x86_64 How reproducible: * always Steps to Reproduce: 1. get a RHEL-7.4 machine (targeted policy is active) 2. service tgtd restart 3. ausearch -m avc -i -ts recent Actual results: ---- type=PATH msg=audit(04/03/2017 18:06:56.731:828) : item=0 name=/etc/pki/tls/legacy-settings objtype=UNKNOWN type=CWD msg=audit(04/03/2017 18:06:56.731:828) : cwd=/ type=SYSCALL msg=audit(04/03/2017 18:06:56.731:828) : arch=x86_64 syscall=open success=no exit=EACCES(Permission denied) a0=0x7efee091a622 a1=O_RDONLY a2=0x1b6 a3=0x24 items=1 ppid=1 pid=20890 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=tgtd exe=/usr/sbin/tgtd subj=system_u:system_r:tgtd_t:s0 key=(null) type=AVC msg=audit(04/03/2017 18:06:56.731:828) : avc: denied { search } for pid=20890 comm=tgtd name=pki dev="vda3" ino=33595530 scontext=system_u:system_r:tgtd_t:s0 tcontext=system_u:object_r:cert_t:s0 tclass=dir ---- Expected results: * no SELinux denials
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0763