Bug 1577057 - chronyc commands do not return values when run on the console with selinux enabled
Summary: chronyc commands do not return values when run on the console with selinux en...
Status: CLOSED DUPLICATE of bug 1574418
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.5
Hardware: All
OS: Linux
Target Milestone: rc
: ---
Assignee: Lukas Vrabec
QA Contact: Milos Malik
Depends On:
TreeView+ depends on / blocked
Reported: 2018-05-11 06:30 UTC by Sandeep MJ
Modified: 2018-05-20 22:34 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2018-05-20 22:34:16 UTC
Target Upstream Version:

Attachments (Terms of Use)

Description Sandeep MJ 2018-05-11 06:30:21 UTC
Description of problem:
"SELinux is preventing chronyc from 'read, write' accesses on the chr_file /dev/tty1"
Running "chronyc sources" or "chronyc tracking" on the console of the VM does not yield results. Outputs shown as expected on running commands after ssh-ing in.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Build VM
2. Access the console
3. Run "chronyc" commands

Actual results:

Expected results:
# chronyc sources
210 Number of sources = 4
MS Name/IP address         Stratum Poll Reach LastRx Last sample               
^+ mika.470n.act.tsgnl.co        2   9   377   330  -1439us[-1439us] +/-   73ms
^* mice.spiderspace.co.uk        2  10   377   653  +2097us[+6988us] +/-   22ms
^+ ntp1.ds.network               2  10   377   629   -476us[ -476us] +/-   34ms
^- y.ns.gin.ntt.net              2   9   377   373  +8883us[+8883us] +/-  135ms

Additional info:

Disabling the don't audit rules:

# semodule -DB
# sealert -l f5658a65-4e95-4a14-a831-7c70fe4ee471
SELinux is preventing chronyc from 'read, write' accesses on the chr_file /dev/tty1.

*****  Plugin catchall_boolean (89.3 confidence) suggests   ******************

If you want to allow all daemons the ability to read/write terminals
Then you must tell SELinux about this by enabling the 'daemons_use_tty' boolean.

setsebool -P daemons_use_tty 1

*****  Plugin catchall (11.6 confidence) suggests   **************************

If you believe that chronyc should be allowed read write access on the tty1 chr_file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
allow this access for now by executing:
# ausearch -c 'chronyc' --raw | audit2allow -M my-chronyc
# semodule -i my-chronyc.pp

Additional Information:
Source Context                unconfined_u:unconfined_r:chronyc_t:s0-s0:c0.c1023
Target Context                unconfined_u:object_r:user_tty_device_t:s0
Target Objects                /dev/tty1 [ chr_file ]
Source                        chronyc
Source Path                   chronyc
Port                          <Unknown>
Host                          server.dns.com
Source RPM Packages           chrony-3.2-2.el7.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-192.el7_5.3.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     server.com
Platform                      Linux server.dns.com 3.10.0-862.el7.x86_64 #1 SMP
                              Wed Mar 21 18:14:51 EDT 2018 x86_64 x86_64
Alert Count                   2
First Seen                    2018-05-11 14:43:04 AEST
Last Seen                     2018-05-11 16:14:30 AEST
Local ID                      f5658a65-4e95-4a14-a831-7c70fe4ee471

Raw Audit Messages
type=AVC msg=audit(1526019270.702:390): avc:  denied  { read write } for  pid=16036 comm="chronyc" path="/dev/tty1" dev="devtmpfs" ino=1043 scontext=unconfined_u:unconfined_r:chronyc_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_tty_device_t:s0 tclass=chr_file

Comment 2 Milos Malik 2018-05-11 06:33:59 UTC
I believe that BZ#1575002 and BZ#1577057 are duplicates.

Comment 3 Lukas Vrabec 2018-05-20 22:34:16 UTC

*** This bug has been marked as a duplicate of bug 1574418 ***

Note You need to log in before you can comment on or make changes to this bug.