Red Hat Bugzilla – Bug 1440515
selinux will prevent named-chroot from properly reloading
Last modified: 2018-04-10 08:32:07 EDT
Description of problem: selinux will prevent named-chroot from properly reloading [root@binarystorm audit]# cat audit.log | grep denied type=USER_AVC msg=audit(1491723362.182:146514): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: denied { reload } for auid=0 uid=0 gid=0 cmdline="/usr/bin/systemctl reload named-chroot.service" scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:system_r:init_t:s0 tclass=service exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?' [root@binarystorm audit]# cat audit.log | grep denied | grep audit2allow -R [root@binarystorm audit]# cat audit.log | grep denied | audit2allow -R require { type logrotate_t; } #============= logrotate_t ============== init_reload_transient_unit(logrotate_t) Version-Release number of selected component (if applicable): Latest How reproducible: Update to latest Steps to Reproduce: 1. Install named and let logrotate do it's job 2. 3. Actual results: Selinux block Expected results: Selinux allows or hide Additional info:
Seen on my Pegas-7.4 VM in enforcing mode: ---- type=USER_AVC msg=audit(04/10/2017 12:30:49.215:203) : pid=1 uid=root auid=unset ses=unset subj=system_u:system_r:init_t:s0 msg='avc: denied { reload } for auid=root uid=root gid=root cmdline="/usr/bin/systemctl reload named-sdb-chroot.service" scontext=system_u:system_r:logrotate_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=service exe=/usr/lib/systemd/systemd sauid=root hostname=? addr=? terminal=?' ---- # rpm -qa selinux-policy\* selinux-policy-targeted-3.13.1-140.el7.noarch selinux-policy-devel-3.13.1-140.el7.noarch selinux-policy-mls-3.13.1-140.el7.noarch selinux-policy-3.13.1-140.el7.noarch selinux-policy-minimum-3.13.1-140.el7.noarch #
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0763