Red Hat Bugzilla – Bug 1441081
ipmievd service wants to load certain kernel modules but SELinux complains
Last modified: 2018-04-10 08:32:07 EDT
Description of problem: Version-Release number of selected component (if applicable): selinux-policy-minimum-3.13.1-141.el7.noarch selinux-policy-devel-3.13.1-140.el7.noarch selinux-policy-mls-3.13.1-141.el7.noarch selinux-policy-targeted-3.13.1-141.el7.noarch selinux-policy-3.13.1-141.el7.noarch How reproducible: * always Steps to Reproduce: 0. get a RHEL-7.4 machine (targeted policy is active) 1. install and enable the ipmievd service 2. reboot the machine 3. search for SELinux denials Actual results (enforcing mode): ---- type=PROCTITLE msg=audit(04/11/2017 09:01:28.932:99) : proctitle=modprobe ipmi_msghandler type=SYSCALL msg=audit(04/11/2017 09:01:28.932:99) : arch=x86_64 syscall=finit_module success=yes exit=0 a0=0x3 a1=0x41a2d8 a2=0x0 a3=0x3 items=0 ppid=1027 pid=1041 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=modprobe exe=/usr/bin/kmod subj=system_u:system_r:ipmievd_t:s0 key=(null) type=AVC msg=audit(04/11/2017 09:01:28.932:99) : avc: denied { module_load } for pid=1041 comm=modprobe path=/usr/lib/modules/4.10.0-6.el7.x86_64/kernel/drivers/char/ipmi/ipmi_msghandler.ko dev="vda2" ino=25535880 scontext=system_u:system_r:ipmievd_t:s0 tcontext=system_u:object_r:modules_object_t:s0 tclass=system permissive=1 ---- type=PROCTITLE msg=audit(04/11/2017 09:01:28.992:102) : proctitle=modprobe ipmi_msghandler type=SYSCALL msg=audit(04/11/2017 09:01:28.992:102) : arch=x86_64 syscall=finit_module success=yes exit=0 a0=0x4 a1=0x41a2d8 a2=0x0 a3=0x4 items=0 ppid=1027 pid=1041 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=modprobe exe=/usr/bin/kmod subj=system_u:system_r:ipmievd_t:s0 key=(null) type=AVC msg=audit(04/11/2017 09:01:28.992:102) : avc: denied { module_load } for pid=1041 comm=modprobe path=/usr/lib/modules/4.10.0-6.el7.x86_64/kernel/drivers/char/ipmi/ipmi_devintf.ko dev="vda2" ino=25535879 scontext=system_u:system_r:ipmievd_t:s0 tcontext=system_u:object_r:modules_object_t:s0 tclass=system permissive=1 ---- Expected results: * no SELinux denials
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0763