1439187 – AVC denied messages seen with selinux in permissive mode

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1439187 - AVC denied messages seen with selinux in permissive mode

Summary: AVC denied messages seen with selinux in permissive mode

Keywords:
Status:	CLOSED DUPLICATE of bug 1436689
Alias:	None
Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	selinux-policy
Sub Component:
Version:	7.4
Hardware:	x86_64
OS:	Linux
Priority:	unspecified
Severity:	unspecified
Target Milestone:	rc
Target Release:	---
Assignee:	Lukas Vrabec
QA Contact:	BaseOS QE Security Team
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2017-04-05 12:07 UTC by Varun Mylaraiah
Modified:	2017-04-05 12:38 UTC (History)
CC List:	6 users (show)
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:	2017-04-05 12:38:25 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)

Description Varun Mylaraiah 2017-04-05 12:07:34 UTC

Description of problem:
AVC denied messages seen while running Kerberos Lockout Policy with selinux in permissive mode

Version-Release number of selected component (if applicable):
selinux-policy-3.13.1-136.el7.noarch

How reproducible:
100%

Steps to Reproduce:
1.Ensure SELinux is in permissive mode
2.install ipa-server


[root@qe-blade-04 ~]# cat /var/log/audit/audit.log|audit2allow
 
 
#============= tomcat_t ==============
allow tomcat_t pki_tomcat_etc_rw_t:dir { getattr open read };
allow tomcat_t pki_tomcat_etc_rw_t:file getattr;
allow tomcat_t pki_tomcat_var_lib_t:dir { getattr open read };
 
 
 
[root@qe-blade-04 ~]# rpm -q selinux-policy
selinux-policy-3.13.1-136.el7.noarch
[root@qe-blade-04 ~]#
 
 
[root@qe-blade-04 ~]#
[root@qe-blade-04 ~]# ausearch -m AVC -m USER_AVC -m SELINUX_ERR
----
time->Wed Apr  5 06:30:26 2017
type=PATH msg=audit(1491388226.294:545): item=0 name="/etc/pki/pki-tomcat/Catalina/localhost" inode=68486630 dev=fd:00 mode=040770 ouid=17 ogid=17 rdev=00:00 obj=system_u:object_r:pki_tomcat_etc_rw_t:s0 objtype=NORMAL
type=CWD msg=audit(1491388226.294:545):  cwd="/usr/share/tomcat"
type=SYSCALL msg=audit(1491388226.294:545): arch=c000003e syscall=257 success=yes exit=87 a0=ffffffffffffff9c a1=7f3920000e70 a2=90800 a3=0 items=1 ppid=1 pid=26662 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.121-9.b14.el7.x86_64/jre/bin/java" subj=system_u:system_r:tomcat_t:s0 key=(null)
type=AVC msg=audit(1491388226.294:545): avc:  denied  { open } for  pid=26662 comm="java" path="/etc/pki/pki-tomcat/Catalina/localhost" dev="dm-0" ino=68486630 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=dir
type=AVC msg=audit(1491388226.294:545): avc:  denied  { read } for  pid=26662 comm="java" name="localhost" dev="dm-0" ino=68486630 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=dir
----
time->Wed Apr  5 06:30:36 2017
type=PATH msg=audit(1491388236.296:546): item=0 name="/etc/pki/pki-tomcat" inode=84438 dev=fd:00 mode=040770 ouid=17 ogid=17 rdev=00:00 obj=system_u:object_r:pki_tomcat_etc_rw_t:s0 objtype=NORMAL
type=CWD msg=audit(1491388236.296:546):  cwd="/usr/share/tomcat"
type=SYSCALL msg=audit(1491388236.296:546): arch=c000003e syscall=6 success=yes exit=0 a0=7f398e14eb30 a1=7f398e14da00 a2=7f398e14da00 a3=617461432f746163 items=1 ppid=1 pid=26662 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.121-9.b14.el7.x86_64/jre/bin/java" subj=system_u:system_r:tomcat_t:s0 key=(null)
type=AVC msg=audit(1491388236.296:546): avc:  denied  { getattr } for  pid=26662 comm="java" path="/etc/pki/pki-tomcat" dev="dm-0" ino=84438 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=dir
----
time->Wed Apr  5 06:30:56 2017
type=PATH msg=audit(1491388256.298:547): item=0 name="/etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml" inode=68486631 dev=fd:00 mode=0100660 ouid=17 ogid=17 rdev=00:00 obj=system_u:object_r:pki_tomcat_etc_rw_t:s0 objtype=NORMAL
type=CWD msg=audit(1491388256.298:547):  cwd="/usr/share/tomcat"
type=SYSCALL msg=audit(1491388256.298:547): arch=c000003e syscall=4 success=yes exit=0 a0=7f3920001420 a1=7f398e1502d0 a2=7f398e1502d0 a3=617461432f746163 items=1 ppid=1 pid=26662 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.121-9.b14.el7.x86_64/jre/bin/java" subj=system_u:system_r:tomcat_t:s0 key=(null)
type=AVC msg=audit(1491388256.298:547): avc:  denied  { getattr } for  pid=26662 comm="java" path="/etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml" dev="dm-0" ino=68486631 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=file
----
time->Wed Apr  5 07:05:36 2017
type=PATH msg=audit(1491390336.480:576): item=0 name="/etc/pki/pki-tomcat" inode=84438 dev=fd:00 mode=040770 ouid=17 ogid=17 rdev=00:00 obj=system_u:object_r:pki_tomcat_etc_rw_t:s0 objtype=NORMAL
type=CWD msg=audit(1491390336.480:576):  cwd="/usr/share/tomcat"
type=SYSCALL msg=audit(1491390336.480:576): arch=c000003e syscall=6 success=yes exit=0 a0=7f398e14e9e0 a1=7f398e14d8b0 a2=7f398e14d8b0 a3=617461432f746163 items=1 ppid=1 pid=26662 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.121-9.b14.el7.x86_64/jre/bin/java" subj=system_u:system_r:tomcat_t:s0 key=(null)
type=AVC msg=audit(1491390336.480:576): avc:  denied  { getattr } for  pid=26662 comm="java" path="/etc/pki/pki-tomcat" dev="dm-0" ino=84438 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=dir
----
time->Wed Apr  5 07:05:36 2017
type=PATH msg=audit(1491390336.480:577): item=0 name="/etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml" inode=68486631 dev=fd:00 mode=0100660 ouid=17 ogid=17 rdev=00:00 obj=system_u:object_r:pki_tomcat_etc_rw_t:s0 objtype=NORMAL
type=CWD msg=audit(1491390336.480:577):  cwd="/usr/share/tomcat"
type=SYSCALL msg=audit(1491390336.480:577): arch=c000003e syscall=6 success=yes exit=0 a0=7f398e14e9e0 a1=7f398e14d8b0 a2=7f398e14d8b0 a3=617461432f746163 items=1 ppid=1 pid=26662 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.121-9.b14.el7.x86_64/jre/bin/java" subj=system_u:system_r:tomcat_t:s0 key=(null)
type=AVC msg=audit(1491390336.480:577): avc:  denied  { getattr } for  pid=26662 comm="java" path="/etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml" dev="dm-0" ino=68486631 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=file
----
time->Wed Apr  5 07:05:36 2017
type=PATH msg=audit(1491390336.480:578): item=0 name="/var/lib/pki/pki-tomcat" inode=35084705 dev=fd:00 mode=040770 ouid=17 ogid=17 rdev=00:00 obj=system_u:object_r:pki_tomcat_var_lib_t:s0 objtype=NORMAL
type=CWD msg=audit(1491390336.480:578):  cwd="/usr/share/tomcat"
type=SYSCALL msg=audit(1491390336.480:578): arch=c000003e syscall=6 success=yes exit=0 a0=7f398e14ebe0 a1=7f398e14dab0 a2=7f398e14dab0 a3=62696c2f7261762f items=1 ppid=1 pid=26662 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.121-9.b14.el7.x86_64/jre/bin/java" subj=system_u:system_r:tomcat_t:s0 key=(null)
type=AVC msg=audit(1491390336.480:578): avc:  denied  { getattr } for  pid=26662 comm="java" path="/var/lib/pki/pki-tomcat" dev="dm-0" ino=35084705 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_var_lib_t:s0 tclass=dir
----
time->Wed Apr  5 07:05:36 2017
type=PATH msg=audit(1491390336.481:579): item=0 name="/var/lib/pki/pki-tomcat/webapps" inode=101567439 dev=fd:00 mode=040755 ouid=17 ogid=17 rdev=00:00 obj=system_u:object_r:pki_tomcat_var_lib_t:s0 objtype=NORMAL
type=CWD msg=audit(1491390336.481:579):  cwd="/usr/share/tomcat"
type=SYSCALL msg=audit(1491390336.481:579): arch=c000003e syscall=257 success=yes exit=87 a0=ffffffffffffff9c a1=7f3920000e70 a2=90800 a3=0 items=1 ppid=1 pid=26662 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.121-9.b14.el7.x86_64/jre/bin/java" subj=system_u:system_r:tomcat_t:s0 key=(null)
type=AVC msg=audit(1491390336.481:579): avc:  denied  { open } for  pid=26662 comm="java" path="/var/lib/pki/pki-tomcat/webapps" dev="dm-0" ino=101567439 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_var_lib_t:s0 tclass=dir
type=AVC msg=audit(1491390336.481:579): avc:  denied  { read } for  pid=26662 comm="java" name="webapps" dev="dm-0" ino=101567439 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_var_lib_t:s0 tclass=dir
----
time->Wed Apr  5 07:05:36 2017
type=PATH msg=audit(1491390336.481:580): item=0 name="/etc/pki/pki-tomcat/Catalina/localhost" inode=68486630 dev=fd:00 mode=040770 ouid=17 ogid=17 rdev=00:00 obj=system_u:object_r:pki_tomcat_etc_rw_t:s0 objtype=NORMAL
type=CWD msg=audit(1491390336.481:580):  cwd="/usr/share/tomcat"
type=SYSCALL msg=audit(1491390336.481:580): arch=c000003e syscall=257 success=yes exit=87 a0=ffffffffffffff9c a1=7f3920000e70 a2=90800 a3=0 items=1 ppid=1 pid=26662 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.121-9.b14.el7.x86_64/jre/bin/java" subj=system_u:system_r:tomcat_t:s0 key=(null)
type=AVC msg=audit(1491390336.481:580): avc:  denied  { open } for  pid=26662 comm="java" path="/etc/pki/pki-tomcat/Catalina/localhost" dev="dm-0" ino=68486630 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=dir
type=AVC msg=audit(1491390336.481:580): avc:  denied  { read } for  pid=26662 comm="java" name="localhost" dev="dm-0" ino=68486630 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=dir
----
time->Wed Apr  5 07:20:06 2017
type=PATH msg=audit(1491391206.554:594): item=0 name="/etc/pki/pki-tomcat" inode=84438 dev=fd:00 mode=040770 ouid=17 ogid=17 rdev=00:00 obj=system_u:object_r:pki_tomcat_etc_rw_t:s0 objtype=NORMAL
type=CWD msg=audit(1491391206.554:594):  cwd="/usr/share/tomcat"
type=SYSCALL msg=audit(1491391206.554:594): arch=c000003e syscall=6 success=yes exit=0 a0=7f398e14e990 a1=7f398e14d860 a2=7f398e14d860 a3=617461432f746163 items=1 ppid=1 pid=26662 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.121-9.b14.el7.x86_64/jre/bin/java" subj=system_u:system_r:tomcat_t:s0 key=(null)
type=AVC msg=audit(1491391206.554:594): avc:  denied  { getattr } for  pid=26662 comm="java" path="/etc/pki/pki-tomcat" dev="dm-0" ino=84438 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=dir
----
time->Wed Apr  5 07:20:06 2017
type=PATH msg=audit(1491391206.554:595): item=0 name="/etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml" inode=68486631 dev=fd:00 mode=0100660 ouid=17 ogid=17 rdev=00:00 obj=system_u:object_r:pki_tomcat_etc_rw_t:s0 objtype=NORMAL
type=CWD msg=audit(1491391206.554:595):  cwd="/usr/share/tomcat"
type=SYSCALL msg=audit(1491391206.554:595): arch=c000003e syscall=6 success=yes exit=0 a0=7f398e14e990 a1=7f398e14d860 a2=7f398e14d860 a3=617461432f746163 items=1 ppid=1 pid=26662 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.121-9.b14.el7.x86_64/jre/bin/java" subj=system_u:system_r:tomcat_t:s0 key=(null)
type=AVC msg=audit(1491391206.554:595): avc:  denied  { getattr } for  pid=26662 comm="java" path="/etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml" dev="dm-0" ino=68486631 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=file
----
time->Wed Apr  5 07:20:06 2017
type=PATH msg=audit(1491391206.555:596): item=0 name="/etc/pki/pki-tomcat/Catalina/localhost" inode=68486630 dev=fd:00 mode=040770 ouid=17 ogid=17 rdev=00:00 obj=system_u:object_r:pki_tomcat_etc_rw_t:s0 objtype=NORMAL
type=CWD msg=audit(1491391206.555:596):  cwd="/usr/share/tomcat"
type=SYSCALL msg=audit(1491391206.555:596): arch=c000003e syscall=257 success=yes exit=87 a0=ffffffffffffff9c a1=7f3920000e70 a2=90800 a3=0 items=1 ppid=1 pid=26662 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.121-9.b14.el7.x86_64/jre/bin/java" subj=system_u:system_r:tomcat_t:s0 key=(null)
type=AVC msg=audit(1491391206.555:596): avc:  denied  { open } for  pid=26662 comm="java" path="/etc/pki/pki-tomcat/Catalina/localhost" dev="dm-0" ino=68486630 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=dir
type=AVC msg=audit(1491391206.555:596): avc:  denied  { read } for  pid=26662 comm="java" name="localhost" dev="dm-0" ino=68486630 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=dir
----
time->Wed Apr  5 07:27:06 2017
type=PATH msg=audit(1491391626.588:598): item=0 name="/var/lib/pki/pki-tomcat/webapps" inode=101567439 dev=fd:00 mode=040755 ouid=17 ogid=17 rdev=00:00 obj=system_u:object_r:pki_tomcat_var_lib_t:s0 objtype=NORMAL
type=CWD msg=audit(1491391626.588:598):  cwd="/usr/share/tomcat"
type=SYSCALL msg=audit(1491391626.588:598): arch=c000003e syscall=257 success=yes exit=87 a0=ffffffffffffff9c a1=7f3920000e70 a2=90800 a3=0 items=1 ppid=1 pid=26662 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.121-9.b14.el7.x86_64/jre/bin/java" subj=system_u:system_r:tomcat_t:s0 key=(null)
type=AVC msg=audit(1491391626.588:598): avc:  denied  { open } for  pid=26662 comm="java" path="/var/lib/pki/pki-tomcat/webapps" dev="dm-0" ino=101567439 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_var_lib_t:s0 tclass=dir
type=AVC msg=audit(1491391626.588:598): avc:  denied  { read } for  pid=26662 comm="java" name="webapps" dev="dm-0" ino=101567439 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_var_lib_t:s0 tclass=dir
----
time->Wed Apr  5 07:27:06 2017
type=PATH msg=audit(1491391626.588:597): item=0 name="/var/lib/pki/pki-tomcat" inode=35084705 dev=fd:00 mode=040770 ouid=17 ogid=17 rdev=00:00 obj=system_u:object_r:pki_tomcat_var_lib_t:s0 objtype=NORMAL
type=CWD msg=audit(1491391626.588:597):  cwd="/usr/share/tomcat"
type=SYSCALL msg=audit(1491391626.588:597): arch=c000003e syscall=6 success=yes exit=0 a0=7f398e14eb80 a1=7f398e14da50 a2=7f398e14da50 a3=62696c2f7261762f items=1 ppid=1 pid=26662 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.121-9.b14.el7.x86_64/jre/bin/java" subj=system_u:system_r:tomcat_t:s0 key=(null)
type=AVC msg=audit(1491391626.588:597): avc:  denied  { getattr } for  pid=26662 comm="java" path="/var/lib/pki/pki-tomcat" dev="dm-0" ino=35084705 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_var_lib_t:s0 tclass=dir
[root@qe-blade-04 ~]#

Comment 2 Lukas Vrabec 2017-04-05 12:38:25 UTC


*** This bug has been marked as a duplicate of bug 1436689 ***

Note You need to log in before you can comment on or make changes to this bug.