Bug 1743093

+++ This bug was initially created as a clone of Bug #1721943 +++

Note: This bug should perhaps be filed on the VMWare bugtracking platform as it is supposed to install the appropriate local policy module.  If this is the case, feel free to close and consider this a FYI.   


Description of problem: sealert reports that SELinux is preventing /usr/sbin/ip from write access on the file /var/log/vmware-imc/toolsDeployPkg.log


Version-Release number of selected component (if applicable): selinux-policy.noarch 3.14.1-61.el8


How reproducible: Always


Steps to Reproduce: sealert -a /var/log/audit/audit.log


Actual results: sealert reports that SELinux is preventing /usr/sbin/ip from write access on the file /var/log/vmware-imc/toolsDeployPkg.log


Expected results: A SELinux policy should be in place to allow access to that file 


Additional info: (output of sealert command follows)

found 1 alerts in /var/log/audit/audit.log
--------------------------------------------------------------------------------

SELinux is preventing /usr/sbin/ip from write access on the file /var/log/vmware-imc/toolsDeployPkg.log.

*****  Plugin leaks (86.2 confidence) suggests   *****************************

If you want to ignore ip trying to write access the toolsDeployPkg.log file, because you believe it should not need this access.
Then you should report this as a bug.
You can generate a local policy module to dontaudit this access.
Do
# ausearch -x /usr/sbin/ip --raw | audit2allow -D -M my-ip
# semodule -X 300 -i my-ip.pp

*****  Plugin catchall (14.7 confidence) suggests   **************************

If you believe that ip should be allowed write access on the toolsDeployPkg.log file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'ip' --raw | audit2allow -M my-ip
# semodule -X 300 -i my-ip.pp


Additional Information:
Source Context                system_u:system_r:ifconfig_t:s0
Target Context                system_u:object_r:vmware_log_t:s0
Target Objects                /var/log/vmware-imc/toolsDeployPkg.log [ file ]
Source                        ip
Source Path                   /usr/sbin/ip
Port                          <Unknown>
Host                          <Unknown>
Source RPM Packages           iproute-4.18.0-11.el8.x86_64
Target RPM Packages
Policy RPM                    selinux-policy-3.14.1-61.el8.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     <redacted>
Platform                      Linux <redacted> 4.18.0-80.1.2.el8_0.x86_64 #1 SMP
                              Sun Apr 28 09:21:22 UTC 2019 x86_64 x86_64
Alert Count                   4
First Seen                    2019-06-18 15:29:42 CEST
Last Seen                     2019-06-18 15:29:42 CEST
Local ID                      ee6df0d5-5c48-4b25-a2ff-1ca0c42ab87b

Raw Audit Messages
type=AVC msg=audit(1560864582.306:23): avc:  denied  { write } for  pid=1167 comm="ip" path="/var/log/vmware-imc/toolsDeployPkg.log" dev="dm-4" ino=23119 scontext=system_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:vmware_log_t:s0 tclass=file permissive=0


type=SYSCALL msg=audit(1560864582.306:23): arch=x86_64 syscall=execve success=yes exit=0 a0=5585ddd3c790 a1=5585ddcea120 a2=5585dd622e80 a3=8 items=0 ppid=1106 pid=1167 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=ip exe=/usr/sbin/ip subj=system_u:system_r:ifconfig_t:s0 key=(null)ARCH=x86_64 SYSCALL=execve AUID=unset UID=root GID=root EUID=root SUID=root FSUID=root EGID=root SGID=root FSGID=root

Hash: ip,ifconfig_t,vmware_log_t,file,write

--- Additional comment from Lukas Vrabec on 2019-07-24 23:07:21 EST ---

Hi Daniele, 

Do you have any idea why would ip command write to "/var/log/vmware-imc/toolsDeployPkg.log" ? This doesn't looks like to me that should be enabled by default. Could you please describe what's going on that machine? 

Thanks,
Lukas.

--- Additional comment from daniele.raffo on 2019-07-25 21:28:06 EST ---

There's not much to say.  It's just a fresh RHEL 8 install on a test VM, configured with user authentication (via sssd) from a remote LDAP server.
The package open-vm-tools is installed (v10.3.0-2.el8).

--- Additional comment from Lukas Vrabec on 2019-07-26 00:23:08 EST ---

Fixes for Fedora:
commit 2f909f93138b6b66f8a6bc62afdbe5598da00f29 (HEAD -> rawhide)
Author: Lukas Vrabec <lvrabec>
Date:   Thu Jul 25 16:22:22 2019 +0200

    Allow ifconfig_t domain to manage vmware logs