Red Hat Bugzilla – Bug 1509277
SELinux prevents several domains from doing dac_read_search
Last modified: 2018-04-10 08:46:56 EDT
Created attachment 1347348 [details] console Description of problem: There are numerous audit msgs on RHEL 7.5-ALT nightly [ 45.896682] audit: type=1400 audit(1509723988.131:6): avc: denied { execute _no_trans } for pid=2945 comm="chrony-helper" path="/usr/bin/chronyc" dev="dm-0 " ino=34078725 scontext=system_u:system_r:chronyd_t:s0 tcontext=system_u:object_ r:chronyc_exec_t:s0 tclass=file permissive=0 [ 47.600873] audit: type=1400 audit(1509723989.841:7): avc: denied { dac_rea d_search } for pid=3099 comm="find" capability=2 scontext=system_u:system_r:po stfix_master_t:s0 tcontext=system_u:system_r:postfix_master_t:s0 tclass=capabili ty permissive=0 [ 47.600966] audit: type=1400 audit(1509723989.841:8): avc: denied { dac_rea d_search } for pid=3099 comm="find" capability=2 scontext=system_u:system_r:po stfix_master_t:s0 tcontext=system_u:system_r:postfix_master_t:s0 tclass=capabili ty permissive=0 Version-Release number of selected component (if applicable): How reproducible: 100% Steps to Reproduce: 1.Using RHEL-ALT-7.5-20171103.n.0 2.look at console log 3. Actual results: numerous audit avc Expected results: no avcs Additional info:
This is a bit like opening a bug against rsyslog and saying there's messages in my logs. :-) If I understand it right, you are seeing AVC's which might indicate there is a problem with selinux policy because there should be no AVC's. If this is correct, this bz should be transferred to selinux-policy so they can fix the policy to match system activity.
When the attachment file is piped into audit2allow, audit2allow says that following rules are missing: allow getty_t self:capability dac_read_search; allow passwd_t self:capability dac_read_search; allow postfix_master_t self:capability dac_read_search;
I'm suggesting this as a duplicate of #1532022.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0763