Bug 1517656
| Summary: | PCP SELinux AVCs | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Marko Myllynen <myllynen> |
| Component: | pcp | Assignee: | Lukas Berk <lberk> |
| Status: | CLOSED ERRATA | QA Contact: | Michal Kolar <mkolar> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.4 | CC: | brolley, fche, jreznik, lberk, lmiksik, mcermak, mgoodwin, nathans |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | pcp-3.12.2-5.el7 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-04-10 17:08:10 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
type=AVC msg=audit(1511771694.686:575): avc: denied { read } for pid=28833 comm="pmproxy" name="unix" dev="proc" ino=4026532015 scontext=system_u:system_r:pcp_pmproxy_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file
Fix in my upstream repo, will get merged to upstream master soon.
commit 8dbdae14f11df0e8817a9a532fb3c37fc9a51c6a
Author: Lukas Berk <lberk>
Date: Mon Nov 27 11:16:00 2017 -0500
selinux: RHBZ1517656
Add three type enforcement context allowance lines
update qa, config bits for conditional context
After updating the latest Brew build, running restorecon -R / for a good measure, putting SELinux to Permissive in its configuration file and rebooting, this is what I see after doing pminfo -f as root & non-root:
# rpm -q pcp pcp-selinux
pcp-3.12.2-4.el7.x86_64
pcp-selinux-3.12.2-4.el7.x86_64
# grep denied /var/log/audit/audit.log
type=AVC msg=audit(1512402750.431:105): avc: denied { read } for pid=2875 comm="pmdalinux" name="pool_threads" dev="nfsd" ino=8 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:nfsd_fs_t:s0 tclass=file
type=AVC msg=audit(1512402750.431:105): avc: denied { open } for pid=2875 comm="pmdalinux" path="/proc/fs/nfsd/pool_threads" dev="nfsd" ino=8 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:nfsd_fs_t:s0 tclass=file
type=AVC msg=audit(1512402750.431:106): avc: denied { getattr } for pid=2875 comm="pmdalinux" path="/proc/fs/nfsd/pool_threads" dev="nfsd" ino=8 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:nfsd_fs_t:s0 tclass=file
type=AVC msg=audit(1512402776.271:118): avc: denied { read } for pid=2875 comm="pmdalinux" name="pool_threads" dev="nfsd" ino=8 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:nfsd_fs_t:s0 tclass=file
type=AVC msg=audit(1512402776.271:118): avc: denied { open } for pid=2875 comm="pmdalinux" path="/proc/fs/nfsd/pool_threads" dev="nfsd" ino=8 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:nfsd_fs_t:s0 tclass=file
type=AVC msg=audit(1512402776.271:119): avc: denied { getattr } for pid=2875 comm="pmdalinux" path="/proc/fs/nfsd/pool_threads" dev="nfsd" ino=8 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:nfsd_fs_t:s0 tclass=file
type=AVC msg=audit(1512402776.272:120): avc: denied { ipc_owner } for pid=2875 comm="pmdalinux" capability=15 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=capability
type=AVC msg=audit(1512402776.272:120): avc: denied { unix_read } for pid=2875 comm="pmdalinux" key=0 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=shm
type=AVC msg=audit(1512402776.272:120): avc: denied { getattr associate } for pid=2875 comm="pmdalinux" key=0 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=shm
type=AVC msg=audit(1512402776.279:121): avc: denied { ipc_owner } for pid=2875 comm="pmdalinux" capability=15 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=capability
type=AVC msg=audit(1512402776.337:122): avc: denied { getattr } for pid=2868 comm="pmdaproc" path="/dev/gpmctl" dev="devtmpfs" ino=18010 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:gpmctl_t:s0 tclass=sock_file
type=AVC msg=audit(1512402776.337:123): avc: denied { getattr } for pid=2868 comm="pmdaproc" path="/run/systemd/initctl/fifo" dev="tmpfs" ino=10112 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:initctl_t:s0 tclass=fifo_file
type=AVC msg=audit(1512402776.338:124): avc: denied { getattr } for pid=2868 comm="pmdaproc" path="/proc/kcore" dev="proc" ino=4026532045 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:proc_kcore_t:s0 tclass=file
type=AVC msg=audit(1512402776.339:125): avc: denied { getattr } for pid=2868 comm="pmdaproc" path="/proc/kcore" dev="proc" ino=4026532045 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:proc_kcore_t:s0 tclass=file
type=AVC msg=audit(1512402776.379:126): avc: denied { getattr } for pid=2868 comm="pmdaproc" path="/run/systemd/initctl/fifo" dev="tmpfs" ino=10112 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:initctl_t:s0 tclass=fifo_file
type=AVC msg=audit(1512402780.932:127): avc: denied { getattr } for pid=2868 comm="pmdaproc" path="/dev/gpmctl" dev="devtmpfs" ino=18010 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:gpmctl_t:s0 tclass=sock_file
type=AVC msg=audit(1512402813.395:128): avc: denied { read } for pid=2875 comm="pmdalinux" name="pool_threads" dev="nfsd" ino=8 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:nfsd_fs_t:s0 tclass=file
type=AVC msg=audit(1512402813.395:128): avc: denied { open } for pid=2875 comm="pmdalinux" path="/proc/fs/nfsd/pool_threads" dev="nfsd" ino=8 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:nfsd_fs_t:s0 tclass=file
type=AVC msg=audit(1512402813.395:129): avc: denied { getattr } for pid=2875 comm="pmdalinux" path="/proc/fs/nfsd/pool_threads" dev="nfsd" ino=8 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:nfsd_fs_t:s0 tclass=file
#
When updating from 3.12.2-4.el7.x86_64 to 3.12.2-5.el7.x86_64 I see: 5:pcp-selinux-3.12.2-5.el7 ################################# [ 12%] libsemanage.semanage_pipe_data: Child process /usr/libexec/selinux/hll/pp failed with code: 255. (No such file or directory). pcpupstream: libsepol.policydb_read: policydb module version 19 does not match my version range 4-17 pcpupstream: libsepol.sepol_module_package_read: invalid module in module package (at section 0) pcpupstream: Failed to read policy package libsemanage.semanage_direct_commit: Failed to compile hll files into cil files. (No such file or directory). semodule: Failed! warning: %post(pcp-selinux-3.12.2-5.el7.x86_64) scriptlet failed, exit status 1 libsemanage.semanage_pipe_data: Child process /usr/libexec/selinux/hll/pp failed with code: 255. (No such file or directory). pcpupstream-container: libsepol.policydb_read: policydb module version 19 does not match my version range 4-17 pcpupstream-container: libsepol.sepol_module_package_read: invalid module in module package (at section 0) pcpupstream-container: Failed to read policy package libsemanage.semanage_direct_commit: Failed to compile hll files into cil files. (No such file or directory). semodule: Failed! warning: %triggerin(pcp-selinux-3.12.2-5.el7.x86_64) scriptlet failed, exit status 1 6:pcp-conf-3.12.2-5.el7 ################################# [ 14%] After upgrading to the following packages (from latest RHEL 7.4 packages - I haven't bisected what's the minimal set of packages needing to be upgraded) the error shown in comment 5 is gone when running the command on command line (semodule -X 400 -i /var/lib/pcp/selinux/pcpupstream.pp) and all AVCs are also gone. Thanks. Reproduced against pcp-3.11.8-7.el7 and verified against pcp-3.12.2-5.el7. (In reply to Marko Myllynen from comment #8) > After upgrading to the following packages (from latest RHEL 7.4 packages - I > haven't bisected what's the minimal set of packages needing to be upgraded) > the error shown in comment 5 is gone when running the command on command > line (semodule -X 400 -i /var/lib/pcp/selinux/pcpupstream.pp) and all AVCs > are also gone. Thanks. And here's the list of packages that I had to upgrade to make the issue shown in comment 5 to disappear: checkpolicy-2.5-6.el7.x86_64 container-selinux-2.41-1.git126c1c0.el7.noarch libsemanage-2.5-10.el7.x86_64 libsemanage-python-2.5-10.el7.x86_64 libsepol-2.5-8.1.el7.x86_64 libsepol-devel-2.5-8.1.el7.x86_64 policycoreutils-2.5-22.el7.x86_64 policycoreutils-python-2.5-22.el7.x86_64 selinux-policy-3.13.1-189.el7.noarch selinux-policy-targeted-3.13.1-189.el7.noarch setools-console-3.3.8-2.el7.x86_64 setools-libs-3.3.8-2.el7.x86_64 Thanks. (In reply to Marko Myllynen from comment #10) > (In reply to Marko Myllynen from comment #8) > > After upgrading to the following packages (from latest RHEL 7.4 packages - I > > haven't bisected what's the minimal set of packages needing to be upgraded) > > the error shown in comment 5 is gone when running the command on command > > line (semodule -X 400 -i /var/lib/pcp/selinux/pcpupstream.pp) and all AVCs > > are also gone. Thanks. > > And here's the list of packages that I had to upgrade to make the issue > shown in comment 5 to disappear: > > checkpolicy-2.5-6.el7.x86_64 > container-selinux-2.41-1.git126c1c0.el7.noarch > libsemanage-2.5-10.el7.x86_64 > libsemanage-python-2.5-10.el7.x86_64 > libsepol-2.5-8.1.el7.x86_64 > libsepol-devel-2.5-8.1.el7.x86_64 > policycoreutils-2.5-22.el7.x86_64 > policycoreutils-python-2.5-22.el7.x86_64 > selinux-policy-3.13.1-189.el7.noarch > selinux-policy-targeted-3.13.1-189.el7.noarch > setools-console-3.3.8-2.el7.x86_64 > setools-libs-3.3.8-2.el7.x86_64 I've filed a separate BZ about this: https://bugzilla.redhat.com/show_bug.cgi?id=1548025 Thanks. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0926 |
Description of problem: root@mars:/var/log/audit# grep denied audit.log type=AVC msg=audit(1511770140.085:443): avc: denied { read } for pid=21132 comm="python2" name="libvirt.conf" dev="dm-0" ino=538359106 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:virt_etc_t:s0 tclass=file type=AVC msg=audit(1511770140.085:443): avc: denied { open } for pid=21132 comm="python2" path="/etc/libvirt/libvirt.conf" dev="dm-0" ino=538359106 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:virt_etc_t:s0 tclass=file type=AVC msg=audit(1511770140.085:444): avc: denied { connectto } for pid=21132 comm="python2" path="/run/libvirt/libvirt-sock-ro" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:virtd_t:s0-s0:c0.c1023 tclass=unix_stream_socket type=AVC msg=audit(1511770149.183:448): avc: denied { read } for pid=25720 comm="pmie" name="unix" dev="proc" ino=4026532015 scontext=system_u:system_r:pcp_pmie_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file type=AVC msg=audit(1511770170.277:449): avc: denied { ipc_owner } for pid=21128 comm="pmdalinux" capability=15 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=capability type=AVC msg=audit(1511770170.277:449): avc: denied { unix_read } for pid=21128 comm="pmdalinux" key=0 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=shm type=AVC msg=audit(1511770170.277:449): avc: denied { getattr associate } for pid=21128 comm="pmdalinux" key=0 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=shm type=AVC msg=audit(1511770170.388:450): avc: denied { getattr } for pid=21125 comm="pmdaproc" path="/dev/gpmctl" dev="devtmpfs" ino=15296 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:gpmctl_t:s0 tclass=sock_file type=AVC msg=audit(1511770170.389:451): avc: denied { getattr } for pid=21125 comm="pmdaproc" path="/run/systemd/initctl/fifo" dev="tmpfs" ino=13225 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:initctl_t:s0 tclass=fifo_file type=AVC msg=audit(1511770170.390:452): avc: denied { getattr } for pid=21125 comm="pmdaproc" path="/proc/kcore" dev="proc" ino=4026532045 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:proc_kcore_t:s0 tclass=file type=AVC msg=audit(1511770172.879:453): avc: denied { unix_read } for pid=21128 comm="pmdalinux" key=0 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=shm type=AVC msg=audit(1511770172.879:453): avc: denied { getattr associate } for pid=21128 comm="pmdalinux" key=0 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=shm Version-Release number of selected component (if applicable): pcp-3.11.8-7.el7.x86_64 pcp-selinux-3.11.8-7.el7.x86_64 selinux-policy-targeted-3.13.1-166.el7_4.5.noarch How reproducible: Always Steps to Reproduce: 1. setenforce 0 2. systemctl restart pmcd pmlogger pmie 3. pminfo -f