Bug 1586042 - SElinux troubleshooter is not started in enforcing mode
Summary: SElinux troubleshooter is not started in enforcing mode
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.6
Hardware: All
OS: Linux
unspecified
urgent
Target Milestone: rc
: ---
Assignee: Lukas Vrabec
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-06-05 11:40 UTC by Lukas Slebodnik
Modified: 2018-10-30 10:05 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-10-30 10:05:00 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:3111 None None None 2018-10-30 10:05:28 UTC

Description Lukas Slebodnik 2018-06-05 11:40:50 UTC
Version-Release number of selected component (if applicable):
sh# rpm -q selinux-policy
selinux-policy-3.13.1-201.el7.noarch

How reproducible:
deterministic

Steps to Reproduce:
1. yum install -y setroubleshoot-server
2. service auditd restart
3. systemctl status auditd | grep sedispatch

Actual results:
[root@host ~]# service auditd restart
Stopping logging:
Redirecting start to /bin/systemctl start auditd.service
[root@host ~]# systemctl status auditd | grep sedispatch
[root@host ~]# echo $?
1

Expected results:
[root@host ~]# service auditd restart
Stopping logging:                                          [  OK  ]
Redirecting start to /bin/systemctl start auditd.service
[root@host ~]# systemctl status auditd | grep sedispatch
           └─11469 /usr/sbin/sedispatch

Additional info:
[root@host ~]# dmesg
[  917.890298] type=1131 audit(1528198591.203:112): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=auditd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
[  918.893104] type=1107 audit(1528198592.206:113): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  received setenforce notice (enforcing=1)
 exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
[  918.925927] type=1400 audit(1528198592.238:114): avc:  denied  { map } for  pid=11367 comm="audispd" path="/usr/sbin/audispd" dev="dm-0" ino=33745933 scontext=system_u:system_r:auditd_t:s0 tcontext=system_u:object_r:audisp_exec_t:s0 tclass=file permissive=0
[  918.925960] type=1305 audit(1528198592.239:115): audit_enabled=1 old=1 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
[  918.925967] type=1305 audit(1528198592.239:116): audit_pid=11365 old=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditd_t:s0 res=1

[root@host ~]# dmesg | audit2allow


#============= auditd_t ==============
allow auditd_t audisp_exec_t:file map;

Comment 2 Lukas Slebodnik 2018-06-05 11:41:32 UTC
I forgot to mention

[root@host ~]# rpm -q setroubleshoot-server
setroubleshoot-server-3.2.30-1.el7.x86_64

Comment 6 errata-xmlrpc 2018-10-30 10:05:00 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3111


Note You need to log in before you can comment on or make changes to this bug.