Bug 1727902
| Summary: | SELinux restricted accounts cannot access polkit | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Martin Pitt <mpitt> |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 8.1 | CC: | lvrabec, mmalik, plautrba, ssekidde, zpytela |
| Target Milestone: | rc | Keywords: | AutoVerified, Patch, Reopened |
| Target Release: | 8.2 | Flags: | pm-rhel:
mirror+
|
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-3.14.3-22.el8 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-04-28 16:40:41 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1727382, 1778780 | ||
|
Description
Martin Pitt
2019-07-08 13:19:28 UTC
Following SELinux denial appears in enforcing mode after removing the dontaudit rules:
----
type=PROCTITLE msg=audit(07/09/2019 02:25:56.197:345) : proctitle=pkaction
type=SYSCALL msg=audit(07/09/2019 02:25:56.197:345) : arch=x86_64 syscall=connect success=no exit=EACCES(Permission denied) a0=0x5 a1=0x7ffecd4b1ff0 a2=0x6e a3=0x0 items=0 ppid=4801 pid=4845 auid=unpriv uid=unpriv gid=unpriv euid=unpriv suid=unpriv fsuid=unpriv egid=unpriv sgid=unpriv fsgid=unpriv tty=pts1 ses=7 comm=pkaction exe=/usr/bin/pkaction subj=guest_u:guest_r:guest_t:s0 key=(null)
type=AVC msg=audit(07/09/2019 02:25:56.197:345) : avc: denied { search } for pid=4845 comm=pkaction name=dbus dev="tmpfs" ino=19407 scontext=guest_u:guest_r:guest_t:s0 tcontext=system_u:object_r:system_dbusd_var_run_t:s0 tclass=dir permissive=0
----
# rpm -qa selinux\* polkit\* | sort
polkit-0.115-6.el8.x86_64
polkit-libs-0.115-6.el8.x86_64
polkit-pkla-compat-0.1-12.el8.x86_64
selinux-policy-3.14.3-9.el8.noarch
selinux-policy-targeted-3.14.3-9.el8.noarch
#
Following SELinux denials appear in permissive mode:
----
type=PROCTITLE msg=audit(07/09/2019 02:27:26.683:348) : proctitle=pkaction
type=SYSCALL msg=audit(07/09/2019 02:27:26.683:348) : arch=x86_64 syscall=connect success=yes exit=0 a0=0x5 a1=0x7ffc73567e90 a2=0x6e a3=0x0 items=0 ppid=4801 pid=4851 auid=unpriv uid=unpriv gid=unpriv euid=unpriv suid=unpriv fsuid=unpriv egid=unpriv sgid=unpriv fsgid=unpriv tty=pts1 ses=7 comm=pkaction exe=/usr/bin/pkaction subj=guest_u:guest_r:guest_t:s0 key=(null)
type=AVC msg=audit(07/09/2019 02:27:26.683:348) : avc: denied { connectto } for pid=4851 comm=pkaction path=/run/dbus/system_bus_socket scontext=guest_u:guest_r:guest_t:s0 tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=1
type=AVC msg=audit(07/09/2019 02:27:26.683:348) : avc: denied { write } for pid=4851 comm=pkaction name=system_bus_socket dev="tmpfs" ino=19408 scontext=guest_u:guest_r:guest_t:s0 tcontext=system_u:object_r:system_dbusd_var_run_t:s0 tclass=sock_file permissive=1
type=AVC msg=audit(07/09/2019 02:27:26.683:348) : avc: denied { search } for pid=4851 comm=pkaction name=dbus dev="tmpfs" ino=19407 scontext=guest_u:guest_r:guest_t:s0 tcontext=system_u:object_r:system_dbusd_var_run_t:s0 tclass=dir permissive=1
----
type=USER_AVC msg=audit(07/09/2019 02:27:26.684:349) : pid=604 uid=dbus auid=unset ses=unset subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.DBus member=Hello dest=org.freedesktop.DBus spid=4851 scontext=guest_u:guest_r:guest_t:s0 tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=dbus permissive=1 exe=/usr/bin/dbus-daemon sauid=dbus hostname=? addr=? terminal=?'
----
type=USER_AVC msg=audit(07/09/2019 02:27:26.686:350) : pid=604 uid=dbus auid=unset ses=unset subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.DBus.Properties member=GetAll dest=:1.3 spid=4851 tpid=622 scontext=guest_u:guest_r:guest_t:s0 tcontext=system_u:system_r:policykit_t:s0 tclass=dbus permissive=1 exe=/usr/bin/dbus-daemon sauid=dbus hostname=? addr=? terminal=?'
----
type=USER_AVC msg=audit(07/09/2019 02:27:26.686:351) : pid=604 uid=dbus auid=unset ses=unset subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.43 spid=622 tpid=4851 scontext=system_u:system_r:policykit_t:s0 tcontext=guest_u:guest_r:guest_t:s0 tclass=dbus permissive=1 exe=/usr/bin/dbus-daemon sauid=dbus hostname=? addr=? terminal=?'
----
This bug is not a duplicate of BZ#1718814, because the SELinux denials are completely different. I tested this on Fedora 31 and RHEL 8.2 nightly, and confirm that this works now. Thank you! Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:1773 |