Bug 1461893
| Summary: | selinux errors when logging in via ssh | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Dominik Perpeet <dperpeet> |
| Component: | container-selinux | Assignee: | Lokesh Mandvekar <lsm5> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | atomic-bugs <atomic-bugs> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.4 | CC: | dwalsh, jpazdziora, miabbott, mpitt |
| Target Milestone: | rc | Keywords: | Extras |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-01-10 18:31:17 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Dominik Perpeet
2017-06-15 14:21:45 UTC
Upstream logs: https://fedorapeople.org/groups/cockpit/logs/pull-6360-20170615-110606-37a7348b-verify-rhel-7-4/log.html One of the journal extracts: https://fedorapeople.org/groups/cockpit/logs/pull-6360-20170615-110606-37a7348b-verify-rhel-7-4/TestNetworking-testBasic-10.111.113.207-FAIL.log For the record, on current RHEL Atomic they look slightly differently: type=1401 audit(1499275045.747:7): op=security_compute_av reason=bounds scontext=system_u:system_r:spc_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:svirt_lxc_net_t:s0-s0:c0.c1023 tclass=process perms=transition type=1401 audit(1499275045.767:8): op=security_compute_av reason=bounds scontext=system_u:system_r:spc_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:svirt_lxc_net_t:s0-s0:c0.c1023 tclass=process perms=transition type=1401 audit(1499275045.913:9): op=security_compute_av reason=bounds scontext=system_u:system_r:spc_t:s0 tcontext=root:sysadm_r:svirt_lxc_net_t:s0 tclass=process perms=transition type=1401 audit(1499275045.994:10): op=security_compute_av reason=bounds scontext=system_u:system_r:spc_t:s0 tcontext=root:system_r:svirt_lxc_net_t:s0 tclass=process perms=transition type=1401 audit(1499275046.014:11): op=security_compute_av reason=bounds scontext=system_u:system_r:spc_t:s0 tcontext=root:unconfined_r:svirt_lxc_net_t:s0 tclass=process perms=transition From https://fedorapeople.org/groups/cockpit/logs/pull-7148-20170705-165757-1548446a-verify-rhel-atomic/log.html#121 Dominick the messages you are showing are not SELinux errors (avc. Martin did you see anything actually break? These all seem to be bounds checks not AVC's @Daniel: No, the actual tests seem fine, we just get these unexpected journal messages. Should these just be ignored? Yes I believe so. We should be handling bounds checking better in future versions of RHEL selinux policy and tool chain. In the cockpit tests we haven't seen this in a while, and now it came back on the latest RHEL 7.5 nightly build with full force: *every* test case now failed on this: https://fedorapeople.org/groups/cockpit/logs/pull-8538-20180206-202525-969c2f48-verify-rhel-7-5/log.html As type=1401 means "internal SELinux error" (https://github.com/torvalds/linux/blob/master/include/uapi/linux/audit.h#L119) I'm wary to just generally ignore these, as that would potentially hide bugs (although not in Cockpit itself). We are seeing this on the RHEL Atomic Host 7.5 Snap3 compose images, too. During SSH login and local console login. # journalctl -b | grep security_compute_av Feb 12 14:50:22 localhost.localdomain kernel: type=1401 audit(1518465022.246:5): op=security_compute_av reason=bounds scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:spc_t:s0-s0:c0.c1023 tclass=process perms=sigchld Feb 12 14:51:19 localhost.localdomain kernel: type=1401 audit(1518465079.278:6): op=security_compute_av reason=bounds scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:spc_t:s0-s0:c0.c1023 tclass=process perms=sigchld Feb 12 14:51:19 localhost.localdomain kernel: type=1401 audit(1518465079.351:7): op=security_compute_av reason=bounds scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:container_t:s0-s0:c0.c1023 tclass=process perms=transition,sigchld,sigstop,signull,signal,getattr Feb 12 14:51:19 localhost.localdomain kernel: type=1401 audit(1518465079.374:8): op=security_compute_av reason=bounds scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:container_t:s0-s0:c0.c1023 tclass=process perms=transition,sigchld,sigstop,signull,signal,getattr I'm unable to reproduce this on RHEL 7.5 Server, though. Nothing seems to be broken, but these messages could cause service calls from the field. I don't think we still have this issue. |