Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1804773

Summary:	SELinux prevents systemd-journal-upload from stat()-ing POSIX shared memory segments
Product:	Red Hat Enterprise Linux 8	Reporter:	Milos Malik <mmalik>
Component:	selinux-policy	Assignee:	Zdenek Pytela <zpytela>
Status:	CLOSED DUPLICATE	QA Contact:	Milos Malik <mmalik>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	8.2	CC:	lvrabec, mmalik, plautrba, rfilo, ssekidde
Target Milestone:	rc	Keywords:	Triaged
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-06-09 14:39:16 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Milos Malik 2020-02-19 15:36:07 UTC

Description of problem:

Version-Release number of selected component (if applicable):
lldpad-1.0.1-13.git036e314.el8.x86_64
sanlock-3.8.0-2.el8.x86_64
sanlock-lib-3.8.0-2.el8.x86_64
selinux-policy-3.14.3-40.el8.noarch
selinux-policy-devel-3.14.3-40.el8.noarch
selinux-policy-doc-3.14.3-40.el8.noarch
selinux-policy-minimum-3.14.3-40.el8.noarch
selinux-policy-mls-3.14.3-40.el8.noarch
selinux-policy-sandbox-3.14.3-40.el8.noarch
selinux-policy-targeted-3.14.3-40.el8.noarch
squid-4.4-8.module+el8.1.0+4044+36416a77.x86_64
systemd-239-25.el8.x86_64
systemd-container-239-25.el8.x86_64
systemd-devel-239-25.el8.x86_64
systemd-journal-remote-239-25.el8.x86_64
systemd-libs-239-25.el8.x86_64
systemd-pam-239-25.el8.x86_64
systemd-tests-239-25.el8.x86_64
systemd-udev-239-25.el8.x86_64
vhostmd-1.1-4.el8.x86_64

How reproducible:
 * always

Steps to Reproduce:
1. get a RHEL-8.2 machine (targeted policy is active)
2. start some service which provides a POSIX shared memory segment (for exmaple: lldpad, squid, vhostmd, wdmd)
3. start the systemd-journal-upload service
4. search for SELinux denials

Actual results (ausearch -m avc -i -ts recent | audit2allow):
allow init_t lldpad_tmpfs_t:file getattr;
allow init_t squid_tmpfs_t:file getattr;
allow init_t vhostmd_tmpfs_t:file getattr;
allow init_t wdmd_tmpfs_t:file getattr;

Detailed SELinux denials will be attached.

Expected results:
 * no SELinux denials

Additional info:
# ls -1Z /dev/shm/
 system_u:object_r:lldpad_tmpfs_t:s0 lldpad.state
        system_u:object_r:tmpfs_t:s0 multipath
  system_u:object_r:squid_tmpfs_t:s0 squid-cf__metadata.shm
  system_u:object_r:squid_tmpfs_t:s0 squid-cf__queues.shm
  system_u:object_r:squid_tmpfs_t:s0 squid-cf__readers.shm
system_u:object_r:vhostmd_tmpfs_t:s0 vhostmd0
   system_u:object_r:wdmd_tmpfs_t:s0 wdmd
#

Relevant part of the journal:
systemd[19496]: Failed to stat() POSIX shared memory segment vhostmd0: Permission denied
systemd[19496]: Failed to stat() POSIX shared memory segment squid-cf__readers.shm: Permission denied
systemd[19496]: Failed to stat() POSIX shared memory segment squid-cf__queues.shm: Permission denied
systemd[19496]: Failed to stat() POSIX shared memory segment squid-cf__metadata.shm: Permission denied
systemd[19496]: Failed to stat() POSIX shared memory segment lldpad.state: Permission denied
systemd[19496]: Failed to stat() POSIX shared memory segment wdmd: Permission denied

Comment 1 Milos Malik 2020-02-19 15:38:13 UTC

SELinux denials caught in enforcing mode:
----
type=PROCTITLE msg=audit(02/19/2020 16:09:53.856:1284) : proctitle=(l-upload) 
type=PATH msg=audit(02/19/2020 16:09:53.856:1284) : item=0 name=vhostmd0 inode=70576 dev=00:15 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:vhostmd_tmpfs_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(02/19/2020 16:09:53.856:1284) : cwd=/ 
type=SYSCALL msg=audit(02/19/2020 16:09:53.856:1284) : arch=x86_64 syscall=newfstatat success=no exit=EACCES(Permission denied) a0=0x8 a1=0x5557b29e8273 a2=0x7ffee1479e00 a3=0x100 items=1 ppid=1 pid=19496 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=(l-upload) exe=/usr/lib/systemd/systemd subj=system_u:system_r:init_t:s0 key=(null) 
type=AVC msg=audit(02/19/2020 16:09:53.856:1284) : avc:  denied  { getattr } for  pid=19496 comm=(l-upload) path=/dev/shm/vhostmd0 dev="tmpfs" ino=70576 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:vhostmd_tmpfs_t:s0 tclass=file permissive=0 
----
type=PROCTITLE msg=audit(02/19/2020 16:09:53.856:1285) : proctitle=(l-upload) 
type=PATH msg=audit(02/19/2020 16:09:53.856:1285) : item=0 name=squid-cf__readers.shm inode=69285 dev=00:15 mode=file,600 ouid=squid ogid=squid rdev=00:00 obj=system_u:object_r:squid_tmpfs_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(02/19/2020 16:09:53.856:1285) : cwd=/ 
type=SYSCALL msg=audit(02/19/2020 16:09:53.856:1285) : arch=x86_64 syscall=newfstatat success=no exit=EACCES(Permission denied) a0=0x8 a1=0x5557b29e8293 a2=0x7ffee1479e00 a3=0x100 items=1 ppid=1 pid=19496 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=(l-upload) exe=/usr/lib/systemd/systemd subj=system_u:system_r:init_t:s0 key=(null) 
type=AVC msg=audit(02/19/2020 16:09:53.856:1285) : avc:  denied  { getattr } for  pid=19496 comm=(l-upload) path=/dev/shm/squid-cf__readers.shm dev="tmpfs" ino=69285 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:squid_tmpfs_t:s0 tclass=file permissive=0 
----
type=PROCTITLE msg=audit(02/19/2020 16:09:53.856:1286) : proctitle=(l-upload) 
type=PATH msg=audit(02/19/2020 16:09:53.856:1286) : item=0 name=squid-cf__queues.shm inode=69284 dev=00:15 mode=file,600 ouid=squid ogid=squid rdev=00:00 obj=system_u:object_r:squid_tmpfs_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(02/19/2020 16:09:53.856:1286) : cwd=/ 
type=SYSCALL msg=audit(02/19/2020 16:09:53.856:1286) : arch=x86_64 syscall=newfstatat success=no exit=EACCES(Permission denied) a0=0x8 a1=0x5557b29e82c3 a2=0x7ffee1479e00 a3=0x100 items=1 ppid=1 pid=19496 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=(l-upload) exe=/usr/lib/systemd/systemd subj=system_u:system_r:init_t:s0 key=(null) 
type=AVC msg=audit(02/19/2020 16:09:53.856:1286) : avc:  denied  { getattr } for  pid=19496 comm=(l-upload) path=/dev/shm/squid-cf__queues.shm dev="tmpfs" ino=69284 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:squid_tmpfs_t:s0 tclass=file permissive=0 
----
type=PROCTITLE msg=audit(02/19/2020 16:09:53.856:1287) : proctitle=(l-upload) 
type=PATH msg=audit(02/19/2020 16:09:53.856:1287) : item=0 name=squid-cf__metadata.shm inode=69283 dev=00:15 mode=file,600 ouid=squid ogid=squid rdev=00:00 obj=system_u:object_r:squid_tmpfs_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(02/19/2020 16:09:53.856:1287) : cwd=/ 
type=SYSCALL msg=audit(02/19/2020 16:09:53.856:1287) : arch=x86_64 syscall=newfstatat success=no exit=EACCES(Permission denied) a0=0x8 a1=0x5557b29e82eb a2=0x7ffee1479e00 a3=0x100 items=1 ppid=1 pid=19496 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=(l-upload) exe=/usr/lib/systemd/systemd subj=system_u:system_r:init_t:s0 key=(null) 
type=AVC msg=audit(02/19/2020 16:09:53.856:1287) : avc:  denied  { getattr } for  pid=19496 comm=(l-upload) path=/dev/shm/squid-cf__metadata.shm dev="tmpfs" ino=69283 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:squid_tmpfs_t:s0 tclass=file permissive=0 
----
type=PROCTITLE msg=audit(02/19/2020 16:09:53.856:1288) : proctitle=(l-upload) 
type=PATH msg=audit(02/19/2020 16:09:53.856:1288) : item=0 name=lldpad.state inode=52563 dev=00:15 mode=file,600 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:lldpad_tmpfs_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(02/19/2020 16:09:53.856:1288) : cwd=/ 
type=SYSCALL msg=audit(02/19/2020 16:09:53.856:1288) : arch=x86_64 syscall=newfstatat success=no exit=EACCES(Permission denied) a0=0x8 a1=0x5557b29e831b a2=0x7ffee1479e00 a3=0x100 items=1 ppid=1 pid=19496 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=(l-upload) exe=/usr/lib/systemd/systemd subj=system_u:system_r:init_t:s0 key=(null) 
type=AVC msg=audit(02/19/2020 16:09:53.856:1288) : avc:  denied  { getattr } for  pid=19496 comm=(l-upload) path=/dev/shm/lldpad.state dev="tmpfs" ino=52563 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:lldpad_tmpfs_t:s0 tclass=file permissive=0 
----
type=PROCTITLE msg=audit(02/19/2020 16:09:53.856:1289) : proctitle=(l-upload) 
type=PATH msg=audit(02/19/2020 16:09:53.856:1289) : item=0 name=wdmd inode=47384 dev=00:15 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:wdmd_tmpfs_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(02/19/2020 16:09:53.856:1289) : cwd=/ 
type=SYSCALL msg=audit(02/19/2020 16:09:53.856:1289) : arch=x86_64 syscall=newfstatat success=no exit=EACCES(Permission denied) a0=0x8 a1=0x5557b29e833b a2=0x7ffee1479e00 a3=0x100 items=1 ppid=1 pid=19496 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=(l-upload) exe=/usr/lib/systemd/systemd subj=system_u:system_r:init_t:s0 key=(null) 
type=AVC msg=audit(02/19/2020 16:09:53.856:1289) : avc:  denied  { getattr } for  pid=19496 comm=(l-upload) path=/dev/shm/wdmd dev="tmpfs" ino=47384 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:wdmd_tmpfs_t:s0 tclass=file permissive=0
----

Comment 2 Milos Malik 2020-02-19 15:41:15 UTC

SELinux denials caught in permissive mode:
----
type=PROCTITLE msg=audit(02/19/2020 16:39:35.088:1411) : proctitle=(l-upload) 
type=PATH msg=audit(02/19/2020 16:39:35.088:1411) : item=0 name=vhostmd0 inode=70576 dev=00:15 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:vhostmd_tmpfs_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(02/19/2020 16:39:35.088:1411) : cwd=/ 
type=SYSCALL msg=audit(02/19/2020 16:39:35.088:1411) : arch=x86_64 syscall=newfstatat success=yes exit=0 a0=0x8 a1=0x5557b29e8273 a2=0x7ffee1479e00 a3=0x100 items=1 ppid=1 pid=31623 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=(l-upload) exe=/usr/lib/systemd/systemd subj=system_u:system_r:init_t:s0 key=(null) 
type=AVC msg=audit(02/19/2020 16:39:35.088:1411) : avc:  denied  { getattr } for  pid=31623 comm=(l-upload) path=/dev/shm/vhostmd0 dev="tmpfs" ino=70576 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:vhostmd_tmpfs_t:s0 tclass=file permissive=1 
----
type=PROCTITLE msg=audit(02/19/2020 16:39:35.088:1412) : proctitle=(l-upload) 
type=PATH msg=audit(02/19/2020 16:39:35.088:1412) : item=0 name=squid-cf__readers.shm inode=69285 dev=00:15 mode=file,600 ouid=squid ogid=squid rdev=00:00 obj=system_u:object_r:squid_tmpfs_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(02/19/2020 16:39:35.088:1412) : cwd=/ 
type=SYSCALL msg=audit(02/19/2020 16:39:35.088:1412) : arch=x86_64 syscall=newfstatat success=yes exit=0 a0=0x8 a1=0x5557b29e8293 a2=0x7ffee1479e00 a3=0x100 items=1 ppid=1 pid=31623 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=(l-upload) exe=/usr/lib/systemd/systemd subj=system_u:system_r:init_t:s0 key=(null) 
type=AVC msg=audit(02/19/2020 16:39:35.088:1412) : avc:  denied  { getattr } for  pid=31623 comm=(l-upload) path=/dev/shm/squid-cf__readers.shm dev="tmpfs" ino=69285 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:squid_tmpfs_t:s0 tclass=file permissive=1 
----
type=PROCTITLE msg=audit(02/19/2020 16:39:35.088:1413) : proctitle=(l-upload) 
type=PATH msg=audit(02/19/2020 16:39:35.088:1413) : item=0 name=lldpad.state inode=52563 dev=00:15 mode=file,600 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:lldpad_tmpfs_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(02/19/2020 16:39:35.088:1413) : cwd=/ 
type=SYSCALL msg=audit(02/19/2020 16:39:35.088:1413) : arch=x86_64 syscall=newfstatat success=yes exit=0 a0=0x8 a1=0x5557b29e831b a2=0x7ffee1479e00 a3=0x100 items=1 ppid=1 pid=31623 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=(l-upload) exe=/usr/lib/systemd/systemd subj=system_u:system_r:init_t:s0 key=(null) 
type=AVC msg=audit(02/19/2020 16:39:35.088:1413) : avc:  denied  { getattr } for  pid=31623 comm=(l-upload) path=/dev/shm/lldpad.state dev="tmpfs" ino=52563 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:lldpad_tmpfs_t:s0 tclass=file permissive=1 
----
type=PROCTITLE msg=audit(02/19/2020 16:39:35.088:1414) : proctitle=(l-upload) 
type=PATH msg=audit(02/19/2020 16:39:35.088:1414) : item=0 name=wdmd inode=47384 dev=00:15 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:wdmd_tmpfs_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(02/19/2020 16:39:35.088:1414) : cwd=/ 
type=SYSCALL msg=audit(02/19/2020 16:39:35.088:1414) : arch=x86_64 syscall=newfstatat success=yes exit=0 a0=0x8 a1=0x5557b29e833b a2=0x7ffee1479e00 a3=0x100 items=1 ppid=1 pid=31623 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=(l-upload) exe=/usr/lib/systemd/systemd subj=system_u:system_r:init_t:s0 key=(null) 
type=AVC msg=audit(02/19/2020 16:39:35.088:1414) : avc:  denied  { getattr } for  pid=31623 comm=(l-upload) path=/dev/shm/wdmd dev="tmpfs" ino=47384 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:wdmd_tmpfs_t:s0 tclass=file permissive=1 
----

Comment 4 Richard Fiľo 2020-03-06 10:01:02 UTC

In Fedora that bug is not reproducible because an allow rule exists:
# sesearch -A --dontaudit -s init_t -t squid_tmpfs_t -c file
allow domain file_type:file map; [ domain_can_mmap_files ]:True
allow init_t file_type:file { getattr relabelfrom relabelto };
allow init_t non_security_file_type:file mounton; [ init_create_dirs ]:True
#

Comment 5 Zdenek Pytela 2020-06-05 16:48:38 UTC

Added with the following commit:

commit b313a79dbfd2fba545e00f31aa53d29c6f2b2722
Author: Lukas Vrabec <lvrabec>
Date:   Tue Aug 13 17:36:11 2019 +0200

    Allow systemd to relabel all files on system.
    
    Resolves: #270

diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index 1f39ee086..aa02c7d79 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -580,9 +580,7 @@ files_setattr_var_dirs(init_t)
 files_list_boot(init_t)
 files_list_home(init_t)
 files_create_lock_dirs(init_t)
-files_relabel_all_lock_dirs(init_t)
-files_relabel_var_dirs(init_t)
-files_relabel_var_lib_dirs(init_t)
+files_relabel_all_files(init_t)
 files_read_kernel_modules(init_t)
 files_map_kernel_modules(init_t)
 files_dontaudit_mounton_isid(init_t)

Comment 6 Zdenek Pytela 2020-06-05 17:34:15 UTC

Note to clarify: the commit in the previous comment refers to a fix in Fedora. In RHEL such a change has not been implemented yet.

Comment 7 Zdenek Pytela 2020-06-09 14:39:16 UTC


*** This bug has been marked as a duplicate of bug 1818981 ***