Bug 1491585
| Summary: | Allow /usr/sbin/abrt-harvest-vmcore capabilities for /var/crash | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Martin Kutlak <mkutlak> |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | medium | Docs Contact: | |
| Priority: | high | ||
| Version: | 7.4 | CC: | lvrabec, mkutlak, mkyral, mmalik, plautrba, ragrao, ssekidde |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-08-06 12:51:45 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1446410, 1546167, 1653106 | ||
Could you re-run your scenario in permissive mode? I expect additional SELinux denials to be logged, for example: { add_name } and { create }.
You were right. I've rerun the scenario with permissive mode and got these:
1)
Additional Information:
Source Context system_u:system_r:abrt_t:s0-s0:c0.c1023
Target Context system_u:object_r:kdump_crash_t:s0
Target Objects 127.0.0.1-2017-10-17-14:37:22 [ dir ]
Source abrt-harvest-vm
Source Path /usr/bin/python2.7
Port <Unknown>
Host localhost.localdomain
Source RPM Packages python-2.7.5-58.el7.x86_64
Target RPM Packages
Policy RPM selinux-policy-3.13.1-166.el7.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Permissive
Host Name localhost.localdomain
Platform Linux localhost.localdomain 3.10.0-693.el7.x86_64
#1 SMP Thu Jul 6 19:56:57 EDT 2017 x86_64 x86_64
Alert Count 1
First Seen 2017-10-17 14:37:37 CEST
Last Seen 2017-10-17 14:37:37 CEST
Local ID b90f3b24-23f8-43b3-91a9-938cdedd8b66
Raw Audit Messages
type=AVC msg=audit(1508243857.827:114): avc: denied { write } for pid=1491 comm="abrt-harvest-vm" name="127.0.0.1-2017-10-17-14:37:22" dev="dm-0" ino=44641 scontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tcontext=system_u:object_r:kdump_crash_t:s0 tclass=dir
type=AVC msg=audit(1508243857.827:114): avc: denied { remove_name } for pid=1491 comm="abrt-harvest-vm" name="vmcore-dmesg.txt" dev="dm-0" ino=44650 scontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tcontext=system_u:object_r:kdump_crash_t:s0 tclass=dir
type=AVC msg=audit(1508243857.827:114): avc: denied { unlink } for pid=1491 comm="abrt-harvest-vm" name="vmcore-dmesg.txt" dev="dm-0" ino=44650 scontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tcontext=system_u:object_r:kdump_crash_t:s0 tclass=file
type=SYSCALL msg=audit(1508243857.827:114): arch=x86_64 syscall=unlink success=yes exit=0 a0=f1c410 a1=0 a2=1 a3=fffffff0 items=0 ppid=1 pid=1491 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=abrt-harvest-vm exe=/usr/bin/python2.7 subj=system_u:system_r:abrt_t:s0-s0:c0.c1023 key=(null)
2)
Raw Audit Messages
type=AVC msg=audit(1508243857.830:115): avc: denied { rmdir } for pid=1491 comm="abrt-harvest-vm" name="127.0.0.1-2017-10-17-14:37:22" dev="dm-0" ino=44641 scontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tcontext=system_u:object_r:kdump_crash_t:s0 tclass=dir
type=SYSCALL msg=audit(1508243857.830:115): arch=x86_64 syscall=rmdir success=yes exit=0 a0=f1c620 a1=0 a2=1 a3=fffffff0 items=0 ppid=1 pid=1491 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=abrt-harvest-vm exe=/usr/bin/python2.7 subj=system_u:system_r:abrt_t:s0-s0:c0.c1023 key=(null)
Following rule (mentioned in comment#3) is missing: allow abrt_t kdump_crash_t : dir { rmdir }; # rpm -qa selinux\* selinux-policy-targeted-3.13.1-225.el7.noarch selinux-policy-doc-3.13.1-225.el7.noarch selinux-policy-minimum-3.13.1-225.el7.noarch selinux-policy-mls-3.13.1-225.el7.noarch selinux-policy-3.13.1-225.el7.noarch selinux-policy-sandbox-3.13.1-225.el7.noarch selinux-policy-devel-3.13.1-225.el7.noarch # *** Bug 1546167 has been marked as a duplicate of this bug. *** commit d5ee2354148e66167aff265c0dfe6e4098b98455 (HEAD -> rhel7.7-contrib)
Author: Lukas Vrabec <lvrabec>
Date: Thu Jan 31 15:35:45 2019 +0100
Update kdump_manage_crash() interface to allow also manage dirs by caller domain
Resolves: rhbz#1491585
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:2127 |
Description of problem: abrt-addon-vmcore has an option to move (copy then delete) vmcores, by setting 'CopyVMcore' to 'no' under /etc/abrt/plugins/vmcore.conf. But SELinux is preventing /usr/sbin/abrt-harvest-vmcore from deleting vmcores from /var/crash dir. Version-Release number of selected component (if applicable): selinux-policy-3.13.1-166.el7.noarch How reproducible: Always Steps to Reproduce: 1. Configure kdump and set default dump path to /var/crash 2. Install abrt along with its addon abrt-addon-vmcore 3. Set copyvmcore=no under /etc/abrt/plugins/vmcore.conf 4. Restart abrt-vmcore.service 5. Crash the system Actual results: abrt-harvest-vmcore: Unable to delete '/var/crash/127.0.0.1-2017-09-12-10:25:49'. Ignoring SELinux is preventing /usr/bin/python2.7 from write access on the directory 127.0.0.1-2017-09-12-10:25:49. Additional info: type=AVC msg=audit(1505294459.205:166): avc: denied { write } for pid=1715 comm="abrt-harvest-vm" name="127.0.0.1-2017-09-12-10:25:49" dev="dm-0" ino=44716 scontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tcontext=system_u:object_r:kdump_crash_t:s0 tclass=dir