Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1782437

Summary: AVC denial in tomcat when installing or restarting ipa server
Product: Red Hat Enterprise Linux 8 Reporter: Sergey Orlov <sorlov>
Component: selinux-policyAssignee: Zdenek Pytela <zpytela>
Status: CLOSED DUPLICATE QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: urgent Docs Contact:
Priority: urgent    
Version: 8.3CC: ascheel, dmoluguw, edewata, fdvorak, ksiddiqu, lvrabec, mmalik, plautrba, rcritten, ssekidde, ssidhaye, tscherf, zpytela
Target Milestone: rcKeywords: Regression, TestBlocker, Triaged
Target Release: 8.3Flags: pm-rhel: mirror+
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-07-29 13:44:50 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
/var/log/pki
none
/var/log/pki
none
/etc/tomcat
none
/var/log/audit/audit.log
none
journalctl none

Description Sergey Orlov 2019-12-11 16:19:33 UTC 
Description of problem:
When ipa-server is installed or restarted AVC failures are logged.


Version-Release number of selected component (if applicable):
tomcatjss-7.4.1-2.module+el8.2.0+4573+c3c38c7b.noarch
selinux-policy-3.14.3-29.el8.noarch
ipa-server-4.8.3-1.module+el8.2.0+4944+db58f418.x86_64

How reproducible:
Always

Steps to Reproduce:
1. install ipa server
2. run "ausearch -m AVC"

Actual results:
Multiple records like the following:

time->Wed Dec 11 17:02:33 2019
type=PROCTITLE msg=audit(1576080153.499:1903): proctitle=2F7573722F6C69622F6A766D2F6A72652D312E382E302D6F70656E6A646B2F62696E2F6A617661002D636C61737370617468002F7573722F73686172652F746F6D6361742F62
696E2F626F6F7473747261702E6A61723A2F7573722F73686172652F746F6D6361742F62696E2F746F6D6361742D6A756C692E6A61723A2F7573
type=SYSCALL msg=audit(1576080153.499:1903): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7ff23c04b920 a2=20000 a3=0 items=0 ppid=1 pid=22895 auid=4294967295 uid=17 gid=17 euid=17 s
uid=17 fsuid=17 egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.232.b09-3.el8.x86_64/jre/bin/java" subj=system_u:system_r:tomcat_t:s0 key=(
null)
type=AVC msg=audit(1576080153.499:1903): avc:  denied  { read } for  pid=22895 comm="java" name="hsperfdata_pkiuser" dev="vda2" ino=25864290 scontext=system_u:system_r:tomcat_t:s0 tcontext=unconfin
ed_u:object_r:user_tmp_t:s0 tclass=dir permissive=0


Expected results:
empty list
Comment 1 Rob Crittenden 2019-12-11 20:18:18 UTC 
Looks like tomcat is trying to read user temp files? (I assume /run/user)
Comment 2 Endi Sukma Dewata 2019-12-11 20:43:31 UTC 
Hi,

Could you provide some details about the environment? Is it in permissive mode?
Is it in FIPS mode? Which pki-* packages were installed?

What exactly are the commands that you executed? Did the commands succeed?

Did any of the logs say specifically which folder it's failing to read? Could
you provide the full error message and stack trace if available?

Thanks.
Comment 3 Sergey Orlov 2019-12-12 10:03:38 UTC 
Created attachment 1644354 [details]
/var/log/pki
Comment 4 Sergey Orlov 2019-12-12 10:08:28 UTC 
Created attachment 1644356 [details]
/var/log/pki
Comment 5 Sergey Orlov 2019-12-12 10:09:45 UTC 
Created attachment 1644358 [details]
/etc/tomcat
Comment 6 Sergey Orlov 2019-12-12 10:10:28 UTC 
Created attachment 1644359 [details]
/var/log/audit/audit.log
Comment 7 Sergey Orlov 2019-12-12 10:12:23 UTC 
Created attachment 1644360 [details]
journalctl
Comment 8 Sergey Orlov 2019-12-12 10:13:14 UTC 
On a just provisioned VM (image 1MT-RHEL-8.2.0-20191209.n.0)

[root@ci-vm-10-0-137-154 ~]# cat /etc/redhat-release
Red Hat Enterprise Linux release 8.2 Beta (Ootpa)

# selinuxenabled ; echo $?
0

# getenforce
Enforcing

# cat /proc/sys/crypto/fips_enabled
0

# dnf module enable idm:DL1/dn
...

# dnf install ipa-server-dns
...

# rpm -qa | grep pki-
pki-tools-10.8.0-0.2.module+el8.2.0+4848+e3cc8195.x86_64
pki-ca-10.8.0-0.2.module+el8.2.0+4848+e3cc8195.noarch
python3-pki-10.8.0-0.2.module+el8.2.0+4848+e3cc8195.noarch
pki-symkey-10.8.0-0.2.module+el8.2.0+4848+e3cc8195.x86_64
pki-base-java-10.8.0-0.2.module+el8.2.0+4848+e3cc8195.noarch
pki-servlet-engine-9.0.7-16.module+el8.1.0+3366+6dfb954c.noarch
pki-server-10.8.0-0.2.module+el8.2.0+4848+e3cc8195.noarch
pki-kra-10.8.0-0.2.module+el8.2.0+4848+e3cc8195.noarch
pki-base-10.8.0-0.2.module+el8.2.0+4848+e3cc8195.noarch
pki-servlet-4.0-api-9.0.7-16.module+el8.1.0+3366+6dfb954c.noarch

# hostnamectl set-hostname master.testrealm.test

# ipa-server-install --setup-dns  --auto-forwarders --allow-zone-overlap --hostname=master.testrelm.test  -r TESTREALM.TEST -n  testrealm.test -p Secret123 -a Secret123 -U
<Success>

# ausearch -m AVC
----
time->Thu Dec 12 04:42:56 2019
type=PROCTITLE msg=audit(1576143776.856:575): proctitle=2F7573722F6C69622F6A766D2F6A72652D312E382E302D6F70656E6A646B2F62696E2F6A617661002D636C61737370617468002F7573722F73686172652F746F6D6361742F62696E2F626F6F7473747261702E6A61723A2F7573722F73686172652F746F6D6361742F62696E2F746F6D6361742D6A756C692E6A61723A2F7573
type=SYSCALL msg=audit(1576143776.856:575): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7f83e804b920 a2=20000 a3=0 items=0 ppid=1 pid=8301 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.232.b09-3.el8.x86_64/jre/bin/java" subj=system_u:system_r:tomcat_t:s0 key=(null)
type=AVC msg=audit(1576143776.856:575): avc:  denied  { read } for  pid=8301 comm="java" name="hsperfdata_pkiuser" dev="vda1" ino=485563 scontext=system_u:system_r:tomcat_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=dir permissive=0
----
time->Thu Dec 12 04:43:59 2019
type=PROCTITLE msg=audit(1576143839.631:576): proctitle=2F7573722F6C69622F6A766D2F6A72652D312E382E302D6F70656E6A646B2F62696E2F6A617661002D636C61737370617468002F7573722F73686172652F746F6D6361742F62696E2F626F6F7473747261702E6A61723A2F7573722F73686172652F746F6D6361742F62696E2F746F6D6361742D6A756C692E6A61723A2F7573
type=SYSCALL msg=audit(1576143839.631:576): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7fbd4c04b720 a2=20000 a3=0 items=0 ppid=1 pid=8514 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.232.b09-3.el8.x86_64/jre/bin/java" subj=system_u:system_r:tomcat_t:s0 key=(null)
type=AVC msg=audit(1576143839.631:576): avc:  denied  { read } for  pid=8514 comm="java" name="hsperfdata_pkiuser" dev="vda1" ino=485563 scontext=system_u:system_r:tomcat_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=dir permissive=0
----
time->Thu Dec 12 04:44:02 2019
type=PROCTITLE msg=audit(1576143842.193:579): proctitle=2F7573722F6C69622F6A766D2F6A72652D312E382E302D6F70656E6A646B2F62696E2F6A617661002D636C61737370617468002F7573722F73686172652F746F6D6361742F62696E2F626F6F7473747261702E6A61723A2F7573722F73686172652F746F6D6361742F62696E2F746F6D6361742D6A756C692E6A61723A2F7573
type=SYSCALL msg=audit(1576143842.193:579): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7f16c804b920 a2=20000 a3=0 items=0 ppid=1 pid=8656 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.232.b09-3.el8.x86_64/jre/bin/java" subj=system_u:system_r:tomcat_t:s0 key=(null)
type=AVC msg=audit(1576143842.193:579): avc:  denied  { read } for  pid=8656 comm="java" name="hsperfdata_pkiuser" dev="vda1" ino=485563 scontext=system_u:system_r:tomcat_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=dir permissive=0
----
time->Thu Dec 12 04:44:18 2019
type=PROCTITLE msg=audit(1576143858.560:580): proctitle=2F7573722F6C69622F6A766D2F6A72652D312E382E302D6F70656E6A646B2F62696E2F6A617661002D636C61737370617468002F7573722F73686172652F746F6D6361742F62696E2F626F6F7473747261702E6A61723A2F7573722F73686172652F746F6D6361742F62696E2F746F6D6361742D6A756C692E6A61723A2F7573
type=SYSCALL msg=audit(1576143858.560:580): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7f312004b720 a2=20000 a3=0 items=0 ppid=1 pid=8838 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.232.b09-3.el8.x86_64/jre/bin/java" subj=system_u:system_r:tomcat_t:s0 key=(null)
type=AVC msg=audit(1576143858.560:580): avc:  denied  { read } for  pid=8838 comm="java" name="hsperfdata_pkiuser" dev="vda1" ino=485563 scontext=system_u:system_r:tomcat_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=dir permissive=0
----
time->Thu Dec 12 04:44:21 2019
type=PROCTITLE msg=audit(1576143861.103:583): proctitle=2F7573722F6C69622F6A766D2F6A72652D312E382E302D6F70656E6A646B2F62696E2F6A617661002D636C61737370617468002F7573722F73686172652F746F6D6361742F62696E2F626F6F7473747261702E6A61723A2F7573722F73686172652F746F6D6361742F62696E2F746F6D6361742D6A756C692E6A61723A2F7573
type=SYSCALL msg=audit(1576143861.103:583): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7f39e404b920 a2=20000 a3=0 items=0 ppid=1 pid=8976 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.232.b09-3.el8.x86_64/jre/bin/java" subj=system_u:system_r:tomcat_t:s0 key=(null)
type=AVC msg=audit(1576143861.103:583): avc:  denied  { read } for  pid=8976 comm="java" name="hsperfdata_pkiuser" dev="vda1" ino=485563 scontext=system_u:system_r:tomcat_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=dir permissive=0
----
time->Thu Dec 12 04:44:56 2019
type=PROCTITLE msg=audit(1576143896.014:586): proctitle=2F7573722F6C69622F6A766D2F6A72652D312E382E302D6F70656E6A646B2F62696E2F6A617661002D636C61737370617468002F7573722F73686172652F746F6D6361742F62696E2F626F6F7473747261702E6A61723A2F7573722F73686172652F746F6D6361742F62696E2F746F6D6361742D6A756C692E6A61723A2F7573
type=SYSCALL msg=audit(1576143896.014:586): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7f1f1404b720 a2=20000 a3=0 items=0 ppid=1 pid=9290 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.232.b09-3.el8.x86_64/jre/bin/java" subj=system_u:system_r:tomcat_t:s0 key=(null)
type=AVC msg=audit(1576143896.014:586): avc:  denied  { read } for  pid=9290 comm="java" name="hsperfdata_pkiuser" dev="vda1" ino=485563 scontext=system_u:system_r:tomcat_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=dir permissive=0
----
time->Thu Dec 12 04:45:03 2019
type=PROCTITLE msg=audit(1576143903.391:589): proctitle=2F7573722F6C69622F6A766D2F6A72652D312E382E302D6F70656E6A646B2F62696E2F6A617661002D636C61737370617468002F7573722F73686172652F746F6D6361742F62696E2F626F6F7473747261702E6A61723A2F7573722F73686172652F746F6D6361742F62696E2F746F6D6361742D6A756C692E6A61723A2F7573
type=SYSCALL msg=audit(1576143903.391:589): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7f4e0804b920 a2=20000 a3=0 items=0 ppid=1 pid=9442 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.232.b09-3.el8.x86_64/jre/bin/java" subj=system_u:system_r:tomcat_t:s0 key=(null)
type=AVC msg=audit(1576143903.391:589): avc:  denied  { read } for  pid=9442 comm="java" name="hsperfdata_pkiuser" dev="vda1" ino=485563 scontext=system_u:system_r:tomcat_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=dir permissive=0
----
time->Thu Dec 12 04:45:21 2019
type=PROCTITLE msg=audit(1576143921.194:591): proctitle=2F7573722F6C69622F6A766D2F6A72652D312E382E302D6F70656E6A646B2F62696E2F6A617661002D636C61737370617468002F7573722F73686172652F746F6D6361742F62696E2F626F6F7473747261702E6A61723A2F7573722F73686172652F746F6D6361742F62696E2F746F6D6361742D6A756C692E6A61723A2F7573
type=SYSCALL msg=audit(1576143921.194:591): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7fb78004b720 a2=20000 a3=0 items=0 ppid=1 pid=9602 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.232.b09-3.el8.x86_64/jre/bin/java" subj=system_u:system_r:tomcat_t:s0 key=(null)
type=AVC msg=audit(1576143921.194:591): avc:  denied  { read } for  pid=9602 comm="java" name="hsperfdata_pkiuser" dev="vda1" ino=485563 scontext=system_u:system_r:tomcat_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=dir permissive=0
----
time->Thu Dec 12 04:45:23 2019
type=PROCTITLE msg=audit(1576143923.599:593): proctitle=2F7573722F6C69622F6A766D2F6A72652D312E382E302D6F70656E6A646B2F62696E2F6A617661002D636C61737370617468002F7573722F73686172652F746F6D6361742F62696E2F626F6F7473747261702E6A61723A2F7573722F73686172652F746F6D6361742F62696E2F746F6D6361742D6A756C692E6A61723A2F7573
type=SYSCALL msg=audit(1576143923.599:593): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7f425404b920 a2=20000 a3=0 items=0 ppid=1 pid=9731 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.232.b09-3.el8.x86_64/jre/bin/java" subj=system_u:system_r:tomcat_t:s0 key=(null)
type=AVC msg=audit(1576143923.599:593): avc:  denied  { read } for  pid=9731 comm="java" name="hsperfdata_pkiuser" dev="vda1" ino=485563 scontext=system_u:system_r:tomcat_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=dir permissive=0
----
time->Thu Dec 12 04:46:10 2019
type=PROCTITLE msg=audit(1576143970.876:603): proctitle=2F7573722F6C69622F6A766D2F6A72652D312E382E302D6F70656E6A646B2F62696E2F6A617661002D636C61737370617468002F7573722F73686172652F746F6D6361742F62696E2F626F6F7473747261702E6A61723A2F7573722F73686172652F746F6D6361742F62696E2F746F6D6361742D6A756C692E6A61723A2F7573
type=SYSCALL msg=audit(1576143970.876:603): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7f55bc04b720 a2=20000 a3=0 items=0 ppid=1 pid=10080 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.232.b09-3.el8.x86_64/jre/bin/java" subj=system_u:system_r:tomcat_t:s0 key=(null)
type=AVC msg=audit(1576143970.876:603): avc:  denied  { read } for  pid=10080 comm="java" name="hsperfdata_pkiuser" dev="vda1" ino=485563 scontext=system_u:system_r:tomcat_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=dir permissive=0
----
time->Thu Dec 12 04:46:18 2019
type=PROCTITLE msg=audit(1576143978.795:608): proctitle=2F7573722F6C69622F6A766D2F6A72652D312E382E302D6F70656E6A646B2F62696E2F6A617661002D636C61737370617468002F7573722F73686172652F746F6D6361742F62696E2F626F6F7473747261702E6A61723A2F7573722F73686172652F746F6D6361742F62696E2F746F6D6361742D6A756C692E6A61723A2F7573
type=SYSCALL msg=audit(1576143978.795:608): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7f8ed404b920 a2=20000 a3=0 items=0 ppid=1 pid=10260 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.232.b09-3.el8.x86_64/jre/bin/java" subj=system_u:system_r:tomcat_t:s0 key=(null)
type=AVC msg=audit(1576143978.795:608): avc:  denied  { read } for  pid=10260 comm="java" name="hsperfdata_pkiuser" dev="vda1" ino=485563 scontext=system_u:system_r:tomcat_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=dir permissive=0


# find /tmp/ -name hsperfdata_pkiuser
/tmp/hsperfdata_pkiuser

# ls -dZ /tmp/hsperfdata_pkiuser
unconfined_u:object_r:user_tmp_t:s0 /tmp/hsperfdata_pkiuser

# grep -r hsperfdata_pkiuser /var/log -l
/var/log/audit/audit.log

I have attached the contents of /var/log/pki, /etc/tomcat, full audit.log and output of journalctl
Comment 9 Alex Scheel 2019-12-12 13:48:28 UTC 
Per https://docs.oracle.com/javase/8/docs/technotes/tools/unix/java.html this is a Java Hot Spot Profiler data directory, created on exit.

If its getting created with the wrong permissions/SELinux label, this should be a JDK bug.

Endi, I'm inclined to reassign. Thoughts?
Comment 10 Endi Sukma Dewata 2019-12-12 14:36:18 UTC 
Agreed. Please reassign. Thanks!
Comment 11 Alex Scheel 2019-12-12 15:23:29 UTC 
Per discussion with Lukas via mail, this actually belong in the selinux-policy component. Moving there... :-)
Comment 12 Zdenek Pytela 2019-12-12 17:12:43 UTC 
*** Bug 1781590 has been marked as a duplicate of this bug. ***
Comment 23 Zdenek Pytela 2020-07-29 13:44:50 UTC 

*** This bug has been marked as a duplicate of bug 1857675 ***