Description of problem:

With tmpwatch-2.11-6.el7 shipped with RHEL7.7, AVcs are seen when "tmpwatch" executes internally "fuser" while running as a system cron job (domain is then "tmpreaper_t").
These are due to "fuser" not being able to read /proc/<PID>, which is necessary to find processes having opened some file.

After adding "domain_read_all_domains_state(tmpreaper_t)" rules, "fuser" then works but still some AVCs are seen:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
allow tmpreaper_t fixed_disk_device_t:blk_file getattr;
allow tmpreaper_t proc_net_t:file read;
allow tmpreaper_t system_mail_t:unix_dgram_socket getattr;
allow tmpreaper_t system_mail_t:unix_stream_socket getattr;
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Note that there may be more, depending on what is read from /proc.
Very probably, all the other AVCs happening while reading /proc can be dont-audit'ed because fuser's use case here is to find out unused files, not other types.


Version-Release number of selected component (if applicable):

selinux-policy-3.13.1-252.el7.1
tmpwatch-2.11-6.el7


How reproducible:

Always


Steps to Reproduce:
1. Install latest tmpwatch

  # yum -y install tmpwatch

2. Create a temporary file

  # mkdir /tmp/test
  # touch /tmp/test/file

3. Execute tmpwatch through crond with "-s" (i.e. "--fuser") option

  # echo "* * * * * root /usr/sbin/tmpwatch -vds -m 0 /tmp/test" >> /etc/crontab
  # sleep 60
  # ausearch -m avc -ts recent | audit2allow

Actual results:


#============= tmpreaper_t ==============
allow tmpreaper_t NetworkManager_t:dir { getattr search };
allow tmpreaper_t abrt_t:unix_dgram_socket getattr;
allow tmpreaper_t abrt_t:unix_stream_socket getattr;
allow tmpreaper_t auditd_t:dir { getattr search };
allow tmpreaper_t crond_t:dir { getattr search };
allow tmpreaper_t dhcpc_t:dir { getattr search };
allow tmpreaper_t fixed_disk_device_t:blk_file getattr;
..


Expected results:

No AVC


Additional info:

With tmpwatch-2.11-5.el7 shipped with RHEL7.6, this was not happening because "fuser" was not called, even if option was passed to "tmpwatch".
A workaround is to run "tmpwatch" as a user cron instead of system cron, which will then make "tmpwatch" run as the user's context (e.g. "unconfined_t").

Custom policy module that "helps" (but doesn't fix everything):

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
policy_module(local_tmpwatch, 1.0)

gen_require(`
	type tmpreaper_t;
')

domain_read_all_domains_state(tmpreaper_t)
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------