Bug 1488116
| Summary: | pmlogger triggers SELinux AVC | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Marko Myllynen <myllynen> |
| Component: | pcp | Assignee: | Lukas Berk <lberk> |
| Status: | CLOSED ERRATA | QA Contact: | Michal Kolar <mkolar> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.4 | CC: | brolley, fche, lberk, mcermak, mgoodwin, mkolar, mprchlik, myllynen, nathans, ovasik |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-04-10 17:06:22 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
pcp-3.12.2-1.fc26 has been submitted as an update to Fedora 26. https://bodhi.fedoraproject.org/updates/FEDORA-2017-d09a03d294 pcp-3.12.2-1.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2017-3267272d85 pcp-3.12.2-1.fc26 has been pushed to the Fedora 26 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-d09a03d294 pcp-3.12.2-1.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-3267272d85 I am not able to reproduce it. Only verified that required (needed for eliminate denials) selinux rules are applied. Verified against pcp-3.12.2-4.el7. (In reply to Michal Kolar from comment #7) > I am not able to reproduce it. Only verified that required (needed for > eliminate denials) selinux rules are applied. Verified against > pcp-3.12.2-4.el7. I'm still seeing AVCs with pcp-3.12.2-4.el7.x86_64. Please let me know if you want me to provide some additional details. (In reply to Marko Myllynen from comment #8) > (In reply to Michal Kolar from comment #7) > > I am not able to reproduce it. Only verified that required (needed for > > eliminate denials) selinux rules are applied. Verified against > > pcp-3.12.2-4.el7. > > I'm still seeing AVCs with pcp-3.12.2-4.el7.x86_64. > > Please let me know if you want me to provide some additional details. Yes please, could you please post the avc denials you're seeing? Sure, here's what I did:
# vi /etc/selinux/config # put SELinux in Permissive
# systemctl enable pmcd pmlogger pmie pmproxy
# restorecon -R /
# echo > /var/log/audit/audit.log
# reboot
Then logged to GNOME etc and did this once as regular user and once as root:
# pminfo -f
Lastly, "grep denied /var/log/audit/audit.log" shows:
type=AVC msg=audit(1515679910.428:108): avc: denied { read } for pid=2503 comm="pmdalinux" name="pool_threads" dev="nfsd" ino=8 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:nfsd_fs_t:s0 tclass=file
type=AVC msg=audit(1515679910.428:108): avc: denied { open } for pid=2503 comm="pmdalinux" path="/proc/fs/nfsd/pool_threads" dev="nfsd" ino=8 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:nfsd_fs_t:s0 tclass=file
type=AVC msg=audit(1515679910.429:109): avc: denied { getattr } for pid=2503 comm="pmdalinux" path="/proc/fs/nfsd/pool_threads" dev="nfsd" ino=8 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:nfsd_fs_t:s0 tclass=file
type=AVC msg=audit(1515679922.007:120): avc: denied { read } for pid=2503 comm="pmdalinux" name="pool_threads" dev="nfsd" ino=8 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:nfsd_fs_t:s0 tclass=file
type=AVC msg=audit(1515679922.007:120): avc: denied { open } for pid=2503 comm="pmdalinux" path="/proc/fs/nfsd/pool_threads" dev="nfsd" ino=8 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:nfsd_fs_t:s0 tclass=file
type=AVC msg=audit(1515679922.007:121): avc: denied { getattr } for pid=2503 comm="pmdalinux" path="/proc/fs/nfsd/pool_threads" dev="nfsd" ino=8 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:nfsd_fs_t:s0 tclass=file
type=AVC msg=audit(1515680069.355:123): avc: denied { read } for pid=2503 comm="pmdalinux" name="pool_threads" dev="nfsd" ino=8 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:nfsd_fs_t:s0 tclass=file
type=AVC msg=audit(1515680069.355:123): avc: denied { open } for pid=2503 comm="pmdalinux" path="/proc/fs/nfsd/pool_threads" dev="nfsd" ino=8 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:nfsd_fs_t:s0 tclass=file
type=AVC msg=audit(1515680069.355:124): avc: denied { getattr } for pid=2503 comm="pmdalinux" path="/proc/fs/nfsd/pool_threads" dev="nfsd" ino=8 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:nfsd_fs_t:s0 tclass=file
type=AVC msg=audit(1515680069.372:125): avc: denied { ipc_owner } for pid=2503 comm="pmdalinux" capability=15 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=capability
type=AVC msg=audit(1515680069.372:125): avc: denied { unix_read } for pid=2503 comm="pmdalinux" key=0 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=shm
type=AVC msg=audit(1515680069.372:125): avc: denied { getattr associate } for pid=2503 comm="pmdalinux" key=0 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=shm
type=AVC msg=audit(1515680069.457:126): avc: denied { getattr } for pid=2483 comm="pmdaproc" path="/dev/gpmctl" dev="devtmpfs" ino=17047 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:gpmctl_t:s0 tclass=sock_file
type=AVC msg=audit(1515680069.457:127): avc: denied { getattr } for pid=2483 comm="pmdaproc" path="/run/systemd/initctl/fifo" dev="tmpfs" ino=2747 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:initctl_t:s0 tclass=fifo_file
type=AVC msg=audit(1515680069.458:128): avc: denied { getattr } for pid=2483 comm="pmdaproc" path="/proc/kcore" dev="proc" ino=4026532045 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:proc_kcore_t:s0 tclass=file
type=AVC msg=audit(1515680076.884:136): avc: denied { ipc_owner } for pid=2503 comm="pmdalinux" capability=15 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=capability
type=AVC msg=audit(1515680076.968:137): avc: denied { getattr } for pid=2483 comm="pmdaproc" path="/proc/kcore" dev="proc" ino=4026532045 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:proc_kcore_t:s0 tclass=file
type=AVC msg=audit(1515680076.969:138): avc: denied { getattr } for pid=2483 comm="pmdaproc" path="/dev/gpmctl" dev="devtmpfs" ino=17047 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:gpmctl_t:s0 tclass=sock_file
Thanks.
Thanks Marko, A couple data points; The AVC denials you just posted are all already in the pcpupstream.te for pcp-3.12.2-4. Running these though audit2allow all returned 'Unknown - would be allowed by active policy' for me. I've followed your steps to reproduce, but have been unable to reproduce getting these same denials (they all still reporting 'Unknown...') Is the pcpupstream.pp package currently installed/active on your machine? What is the output from; # semodule -l | grep pcp Thanks (In reply to Lukas Berk from comment #11) > > Is the pcpupstream.pp package currently installed/active on your machine? > What is the output from; > > # semodule -l | grep pcp Here are some additional details: # rpm -q pcp-selinux pcp-selinux-3.12.2-4.el7.x86_64 # rpm -V pcp-selinux # semodule -l | grep pcp pcp 1.0.0 pcpupstream 1.0 pcpupstream-container 1.0 # sesearch --allow -t gpmctl_t | grep pcp_pmcd_t allow pcp_pmcd_t file_type : filesystem getattr ; The above AVCs are from a somewhat actively used system, from mostly an idling test RHEL 7 VM after I removed all pcp packages, installed latest officially released PCP packages with yum (yum install pcp-system-tools so only 6 PCP packages present), did the above steps, then updated with rpm -Uvh those 6 packages to 3.12.2-4.el7 from Brew, the above four commands give same results, AVCs on the VM after reboot are then: type=AVC msg=audit(1516035157.961:63): avc: denied { unix_read } for pid=1067 comm="pmdalinux" key=18038969 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=shm type=AVC msg=audit(1516035157.961:63): avc: denied { getattr associate } for pid=1067 comm="pmdalinux" key=18038969 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=shm type=AVC msg=audit(1516035157.962:64): avc: denied { unix_read } for pid=1067 comm="pmdalinux" key=0 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=sem type=AVC msg=audit(1516035157.962:64): avc: denied { getattr associate } for pid=1067 comm="pmdalinux" key=0 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=sem type=AVC msg=audit(1516035158.061:65): avc: denied { getattr } for pid=1059 comm="pmdaproc" path="/dev/gpmctl" dev="devtmpfs" ino=14168 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:gpmctl_t:s0 tclass=sock_file type=AVC msg=audit(1516035158.062:66): avc: denied { getattr } for pid=1059 comm="pmdaproc" path="/run/systemd/initctl/fifo" dev="tmpfs" ino=9050 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:initctl_t:s0 tclass=fifo_file type=AVC msg=audit(1516035158.062:67): avc: denied { getattr } for pid=1059 comm="pmdaproc" path="/proc/kcore" dev="proc" ino=4026532033 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:proc_kcore_t:s0 tclass=file The gpm/httpd related ones you'll need to have gpm/httpd installed and running but I'm not sure what's needed to trigger the others. Thanks. Marko, From the QE perspective, the bug is fixed and verified per Comment 7. Please, open a separate bug report for the issue you are observing for consideration in the rhel-7.6 timeframe. Thank you. (In reply to Martin Cermak from comment #13) > Marko, From the QE perspective, the bug is fixed and verified per Comment 7. > Please, open a separate bug report for the issue you are observing for > consideration in the rhel-7.6 timeframe. Thank you. With pcp-selinux-3.12.2-5.el7.x86_64 I don't see these AVCs anymore, I think part of the confusion here was due to %post scriplet dependencies / issues which are now most taken care of (https://bugzilla.redhat.com/show_bug.cgi?id=1517656#c10) so I think these AVC BZs (this one - 1488116 and 1517656) are fine. Thanks. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0926 |
Description of problem: On latest RHEL 7.4 after booting up and logging into GNOME it would seem that pmlogger triggers SELinux AVC - please adjust the Summary if this is not the case: SELinux is preventing /usr/bin/ps from search access on the directory /home/testuser. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that ps should be allowed search access on the testuser directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'ps' --raw | audit2allow -M my-ps # semodule -i my-ps.pp Additional Information: Source Context system_u:system_r:pcp_pmlogger_t:s0 Target Context unconfined_u:object_r:user_home_dir_t:s0 Target Objects /home/testuser [ dir ] Source ps Source Path /usr/bin/ps Port <Unknown> Host localhost Source RPM Packages procps-ng-3.3.10-16.el7.x86_64 Target RPM Packages Policy RPM selinux-policy-3.13.1-166.el7.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name localhost Platform Linux localhost 3.10.0-693.1.1.el7.x86_64 #1 SMP Thu Aug 3 08:15:31 EDT 2017 x86_64 x86_64 Alert Count 3 First Seen 2017-09-04 09:40:20 EEST Last Seen 2017-09-04 12:15:26 EEST Local ID bb294cf8-ea5a-480d-8294-21dae1ad1be1 Raw Audit Messages type=AVC msg=audit(1504516526.487:431): avc: denied { search } for pid=18056 comm="ps" name="testuser" dev="dm-0" ino=539096275 scontext=system_u:system_r:pcp_pmlogger_t:s0 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=dir type=SYSCALL msg=audit(1504516526.487:431): arch=x86_64 syscall=stat success=no exit=EACCES a0=7fdbb7637440 a1=7ffe1126e540 a2=7ffe1126e540 a3=6 items=0 ppid=18024 pid=18056 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=ps exe=/usr/bin/ps subj=system_u:system_r:pcp_pmlogger_t:s0 key=(null) Hash: ps,pcp_pmlogger_t,user_home_dir_t,dir,search Version-Release number of selected component (if applicable): pcp-3.11.8-7.el7.x86_64 pcp-selinux-3.11.8-7.el7.x86_64 selinux-policy-targeted-3.13.1-166.el7.noarch