Bug 1826047

Created attachment 1680350 [details]
Output of "grep '^type=AVC.*pcp' /var/log/audit/audit.log | audit2allow -w"

Description of problem:

Customer configured pmdc to accept secure connections as described in

    https://pcp.io/docs/lab.secureclient.html

After that it was possible to fetch data interactively, e.g. with

    $ pminfo -h remote.host -f kernel.uname.nodename

but it was not possible to establish a secure connection between pmlogger and
the remote pmdc due to AVC denials (see attached audit2allow.txt).

Version-Release number of selected component (if applicable):

    # cat /etc/redhat-release 
    Red Hat Enterprise Linux Server release 7.8 (Maipo)

    # rpm -q pcp
    pcp-4.3.2-6.el7.x86_64

How reproducible:

Always

Steps to Reproduce:

1. Generate the CA, server and client certificates, as shown in the CA Setup
   session of 

   https://pcp.io/docs/lab.secureclient.html

2. Copy the CA and server certificates to the server machine and configure
   pmcd as described in the Collector Setup session of the same document.
   Enable and start the pmcd service with

     # systemctl enable --now pmcd
   
2. Copy the CA and server certificates to the server machine and create the
   pcp-specific certficate database path:

     # echo > /tmp/empty
     # certutil -d sql:/etc/pcp/nssdb -N -f /tmp/empty 
     # certutil -d sql:/etc/pcp/nssdb -A -t "CT,," -n "Root CA" \
        -i ./rootCA.crt
     # certutil -d sql:/etc/pcp/nssdb -A -t "P,," -n "pmclient_cert" \
       -i pmclient.crt
     # pk12util -i pmclient_pkcs12.key -d sql:/etc/pcp/nssdb

   Ensure that /etc/pcp/nssdb has the same SELinux context as /etc/pki/nssdb

     # semanage fcontext -a -e /etc/pki/nssdb '/etc/pcp/nssdb(/.*)?'
     # restorecon -R -F -vv /etc/pcp/nssdb
     # ls -lZ /etc/pcp/nssdb
    -rw-------. pcp pcp unconfined_u:object_r:cert_t:s0  cert9.db
    -rw-------. pcp pcp unconfined_u:object_r:cert_t:s0  key4.db
    -rw-------. pcp pcp unconfined_u:object_r:cert_t:s0  pkcs11.txt

3. Test if the secure communication works

     # export PCP_SECURE_SOCKETS=enforce
     # export PCP_ALLOW_BAD_CERT_DOMAIN=1
     # export PCP_ALLOW_SERVER_SELF_CERT=1
     # export PCP_SECURE_DB_PATH=/etc/pcp/nssdb
     # pminfo -h rhel-7-2 -f kernel.uname.nodename

     kernel.uname.nodename
         value "rhel-7-2.example.com"

4. Configure pmlogger to fetch data from the remote pmcd

     # pmlogconf -c -r -h rhel-7-2.example.com \
       /var/lib/pcp/config/pmlogger/config.rhel-7-2

     Create /etc/pcp/pmlogger/control.d/rhel-7-2.example.com containing

     #--------------------------------------------------------------------------------------------------------------------
     $PCP_SECURE_SOCKETS=enforce;        export PCP_SECURE_SOCKETS
     $PCP_ALLOW_BAD_CERT_DOMAIN=1;       export PCP_ALLOW_BAD_CERT_DOMAIN
     $PCP_ALLOW_SERVER_SELF_CERT=1;      export PCP_ALLOW_SERVER_SELF_CERT
     $PCP_SECURE_DB_PATH=/etc/pcp/nssdb; export PCP_SECURE_DB_PATH

     rhel-7-2.example.com   n   n   PCP_LOG_DIR/pmlogger/rhel-7-2.example.com      -r -T24h10m -c config.rhel-7-2 -v 100Mb
     #--------------------------------------------------------------------------------------------------------------------

   Start pmlogger with

     # systemctl enable --now pmlogger
     # cat /var/log/pcp/pmlogger/rhel-7-2.example.com/pmlogger.log

Actual results:

The /var/log/pcp/pmlogger/rhel-7-2.example.com/pmlogger.log file contains

    pmlogger: Cannot connect to PMCD on host "rhel-7-2.example.com": No cipher suites are present and enabled in this program.

The /var/log/audit/audit.log file contains lots of AVC...denied messages (see
attached output of the command

    # grep '^type=AVC.*pcp' /var/log/audit/audit.log | audit2allow -w

Expected results:

pmlogger should be able to establish a secure connection.

Additional info:

Customer was instructed to temporarily flip SELinux to permissive.