Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1695342

Summary:	SELinux is preventing rhsmcertd-worke from open access on the file /var/log/yum.log
Product:	Red Hat Enterprise Linux 7	Reporter:	Lukas Slebodnik <lslebodn>
Component:	selinux-policy	Assignee:	Lukas Vrabec <lvrabec>
Status:	CLOSED ERRATA	QA Contact:	Milos Malik <mmalik>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	7.7	CC:	lvrabec, mmalik, plautrba, ssekidde, vmojzis, zpytela
Target Milestone:	rc	Keywords:	Regression, Reopened
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-08-06 12:53:24 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Lukas Slebodnik 2019-04-02 20:53:57 UTC

SELinux is preventing rhsmcertd-worke from open access on the file /var/log/yum.log.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that rhsmcertd-worke should be allowed open access on the yum.log file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'rhsmcertd-worke' --raw | audit2allow -M my-rhsmcertdworke
# semodule -i my-rhsmcertdworke.pp


Additional Information:
Source Context                system_u:system_r:rhsmcertd_t:s0
Target Context                system_u:object_r:rpm_log_t:s0
Target Objects                /var/log/yum.log [ file ]
Source                        rhsmcertd-worke
Source Path                   rhsmcertd-worke
Port                          <Unknown>
Host                          kvm-01-guest18.example.com
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-242.el7.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     kvm-01-guest18.example.com
Platform                      Linux kvm-01-guest18.example.com
                              3.10.0-1033.el7.x86_64 #1 SMP Fri Mar 29 11:09:52
                              UTC 2019 x86_64 x86_64
Alert Count                   1
First Seen                    2019-04-02 23:11:50 IDT
Last Seen                     2019-04-02 23:11:50 IDT
Local ID                      e4487ba6-ced0-4e28-8571-a57df85c388e

Raw Audit Messages
type=AVC msg=audit(1554235910.330:131): avc:  denied  { open } for  pid=17013 comm="rhsmcertd-worke" path="/var/log/yum.log" dev="dm-0" ino=8256 scontext=system_u:system_r:rhsmcertd_t:s0 tcontext=system_u:object_r:rpm_log_t:s0 tclass=file permissive=1


Hash: rhsmcertd-worke,rhsmcertd_t,rpm_log_t,file,open

Comment 2 Lukas Slebodnik 2019-04-02 21:03:14 UTC

journald does not contain anything relevant

Apr 02 23:11:48 kvm-01-guest18.example.com dockerd-current[12863]:   Installing : 389-ds-base-1.3.8.4-23.el7_6.x86_64                      246/406 
Apr 02 23:11:48 kvm-01-guest18.example.com dockerd-current[12863]:   Installing : slapi-nis-0.56.0-8.el7.x86_64                            247/406 
Apr 02 23:11:50 kvm-01-guest18.example.com dockerd-current[12863]:   Installing : sysvinit-tools-2.88-14.dsf.el7.x86_64                    248/406 
Apr 02 23:11:52 kvm-01-guest18.example.com dockerd-current[12863]:   Installing : initscripts-9.49.46-1.el7.x86_64                         249/406 
Apr 02 23:11:53 kvm-01-guest18.example.com dbus[919]: [system] Activating service name='org.fedoraproject.Setroubleshootd' (using servicehelper)
Apr 02 23:11:54 kvm-01-guest18.example.com dbus[919]: [system] Successfully activated service 'org.fedoraproject.Setroubleshootd'
Apr 02 23:11:54 kvm-01-guest18.example.com dockerd-current[12863]:   Installing : hesiod-3.2.1-3.el7.x86_64                                250/406 
Apr 02 23:11:54 kvm-01-guest18.example.com setroubleshoot[17312]: failed to retrieve rpm info for /var/log/yum.log
Apr 02 23:11:54 kvm-01-guest18.example.com setroubleshoot[17312]: SELinux is preventing rhsmcertd-worke from open access on the file /var/log/yum.log. For complete SELinux messages run: sealert -l e4487ba6-ced0-4e28-8571-a57df85c388e
Apr 02 23:11:54 kvm-01-guest18.example.com python[17312]: SELinux is preventing rhsmcertd-worke from open access on the file /var/log/yum.log.


I could see the same AVC also in enforcing mode.

Comment 3 Lukas Slebodnik 2019-04-02 21:09:27 UTC

From other machine

[root@host ~]# cat /var/log/rhsm/rhsmcertd.log
Tue Apr  2 20:31:15 2019 [INFO] Starting rhsmcertd...
Tue Apr  2 20:31:15 2019 [INFO] Auto-attach interval: 1440.0 minutes [86400 seconds]
Tue Apr  2 20:31:15 2019 [INFO] Cert check interval: 240.0 minutes [14400 seconds]
Tue Apr  2 20:31:15 2019 [INFO] Waiting 2.0 minutes plus 29355 splay seconds [29475 seconds total] before performing first auto-attach.
Tue Apr  2 20:31:15 2019 [INFO] Waiting 2.0 minutes plus 1040 splay seconds [1160 seconds total] before performing first cert check.
Tue Apr  2 16:51:07 2019 [INFO] (Cert Check) Certificates updated.



Info: Searching AVC errors produced since 1554237926.31 (Tue Apr  2 16:45:26 2019)
Searching logs...
Running '/usr/bin/env LC_ALL=en_US.UTF-8 /sbin/ausearch -m AVC -m USER_AVC -m SELINUX_ERR -ts 04/02/2019 16:45:26 < /dev/null >/mnt/testarea/tmp.rhts-db-submit-result.8Jf6UZ 2>&1'
----
time->Tue Apr  2 16:51:06 2019
type=PROCTITLE msg=audit(1554238266.971:357): proctitle=2F7573722F62696E2F707974686F6E002F7573722F6C6962657865632F7268736D63657274642D776F726B6572
type=SYSCALL msg=audit(1554238266.971:357): arch=c000003e syscall=2 success=no exit=-13 a0=3c19360 a1=441 a2=1b6 a3=24 items=0 ppid=1072 pid=31441 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="rhsmcertd-worke" exe="/usr/bin/python2.7" subj=system_u:system_r:rhsmcertd_t:s0 key=(null)
type=AVC msg=audit(1554238266.971:357): avc:  denied  { open } for  pid=31441 comm="rhsmcertd-worke" path="/var/log/yum.log" dev="dm-0" ino=67168512 scontext=system_u:system_r:rhsmcertd_t:s0 tcontext=system_u:object_r:rpm_log_t:s0 tclass=file permissive=0
Fail: AVC messages found.
Checking for errors...
Using stronger AVC checks.
	Define empty RHTS_OPTION_STRONGER_AVC parameter if this causes any problems.
Running 'cat /mnt/testarea/tmp.rhts-db-submit-result.8Jf6UZ | /sbin/ausearch -m AVC -m SELINUX_ERR'
Fail: AVC messages found.
Running 'cat %s | /sbin/ausearch -m USER_AVC >/mnt/testarea/tmp.rhts-db-submit-result.c8HfnV 2>&1'
Info: No AVC messages found.
/bin/grep 'avc: ' /mnt/testarea/dmesg.log | /bin/grep --invert-match TESTOUT.log
No AVC messages found in dmesg
Running '/usr/sbin/sestatus'
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Max kernel policy version:      31
Running 'rpm -q selinux-policy || true'
selinux-policy-3.13.1-242.el7.noarch

Comment 4 Zdenek Pytela 2019-04-03 11:26:29 UTC

This issue was not selected to be included in Red Hat Enterprise Linux 7.7 because it is seen either as low or moderate impact to a small number of use-cases. The next release will be in Maintenance Support 1 Phase, which means that qualified Critical and Important Security errata advisories (RHSAs) and Urgent Priority Bug Fix errata advisories (RHBAs) may be released as they become available.

We will now close this issue, but if you believe that it qualifies for the Maintenance Support 1 Phase, please re-open; otherwise, we recommend moving the request to Red Hat Enterprise Linux 8 if applicable.

Comment 5 Lukas Slebodnik 2019-04-03 13:19:21 UTC

It cause useless failures in beaker tests and thus I do not agree with resolution.

Comment 16 Milos Malik 2019-04-29 11:28:20 UTC

# rpm -qa selinux\* subscr\* | sort
selinux-policy-3.13.1-244.el7.noarch
selinux-policy-devel-3.13.1-244.el7.noarch
selinux-policy-targeted-3.13.1-244.el7.noarch
subscription-manager-1.24.4-1.el7.x86_64
subscription-manager-rhsm-1.24.4-1.el7.x86_64
subscription-manager-rhsm-certificates-1.24.4-1.el7.x86_64
# sesearch -s rhsmcertd_t -t rpm_log_t -c file -p open -A -C -D

#

Comment 20 errata-xmlrpc 2019-08-06 12:53:24 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:2127