Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
selinux denials are logged on an IDM server on RHEL 8.3
Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.14.3-54.el8.noarch
ipa-server-4.8.7-13.module+el8.3.0+8376+0bba7131.x86_64
How reproducible:
Not sure. Probably triggered on CA renewal or server upgrade.
Steps to Reproduce:
1.
2.
3.
Actual results:
SELinux is preventing /usr/libexec/platform-python3.6 from using the fsetid capability.
***** Plugin catchall (100. confidence) suggests **************************
If you believe that platform-python3.6 should have the fsetid capability by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'renew_ca_cert' --raw | audit2allow -M my-renewcacert
# semodule -X 300 -i my-renewcacert.pp
Additional Information:
Source Context system_u:system_r:certmonger_t:s0
Target Context system_u:system_r:certmonger_t:s0
Target Objects Unknown [ capability ]
Source renew_ca_cert
Source Path /usr/libexec/platform-python3.6
Port <Unknown>
Host <Unknown>
Source RPM Packages platform-python-3.6.8-31.el8.x86_64
Target RPM Packages
SELinux Policy RPM selinux-policy-targeted-3.14.3-54.el8.noarch
Local Policy RPM selinux-policy-targeted-3.14.3-54.el8.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Permissive
Host Name example.com
Platform Linux example.com
4.18.0-240.8.1.el8_3.x86_64 #1 SMP Fri Dec 4
12:24:03 EST 2020 x86_64 x86_64
Alert Count 7
First Seen 2020-12-20 04:09:07 EST
Last Seen 2020-12-20 05:19:40 EST
Local ID 0c2c4908-9fa3-4d61-bd94-b033bd0f7c1d
Raw Audit Messages
type=AVC msg=audit(1608459580.283:130): avc: denied { fsetid } for pid=4110 comm="renew_ca_cert" capability=4 scontext=system_u:system_r:certmonger_t:s0 tcontext=system_u:system_r:certmonger_t:s0 tclass=capability permissive=1
type=SYSCALL msg=audit(1608459580.283:130): arch=x86_64 syscall=chmod success=yes exit=0 a0=7fe2dc910aa0 a1=1b0 a2=0 a3=2 items=0 ppid=835 pid=4110 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=renew_ca_cert exe=/usr/libexec/platform-python3.6 subj=system_u:system_r:certmonger_t:s0 key=(null)ARCH=x86_64 SYSCALL=chmod AUID=unset UID=root GID=root EUID=root SUID=root FSUID=root EGID=root SGID=root FSGID=root
Hash: renew_ca_cert,certmonger_t,certmonger_t,capability,fsetid
Expected results:
Additional info:
Hi,
This seems to be a duplicate of bz#1873211, but the audit records are not the same. Will you be able to get the reproducer to trigget the issue? Full auditing can help to gather additional information:
1) Open the /etc/audit/rules.d/audit.rules file in an editor.
2) Add the following line to the end of the file:
-w /etc/shadow -p w
3) Restart the audit daemon:
# service auditd restart
4) Re-run your scenario.
5) Collect AVC denials:
# ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts today
I haven't seen the same denials since then. I suspect that it was triggered by CA renewal (ipa-cacert-manage renew). I do not want to do a CA renewal again since I only have the production system, and it ended up triggering some other issues with IPA as well which I had to recover from.
Thank you for the response. Since the working theory is this bz is a dup of bz#1873211, we can continue discussion there. I will close this bz, but feel free to reopen it or create another one in case of outstanding issue after fixing bz#1873211.
*** This bug has been marked as a duplicate of bug 1873211 ***
Description of problem: selinux denials are logged on an IDM server on RHEL 8.3 Version-Release number of selected component (if applicable): selinux-policy-targeted-3.14.3-54.el8.noarch ipa-server-4.8.7-13.module+el8.3.0+8376+0bba7131.x86_64 How reproducible: Not sure. Probably triggered on CA renewal or server upgrade. Steps to Reproduce: 1. 2. 3. Actual results: SELinux is preventing /usr/libexec/platform-python3.6 from using the fsetid capability. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that platform-python3.6 should have the fsetid capability by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'renew_ca_cert' --raw | audit2allow -M my-renewcacert # semodule -X 300 -i my-renewcacert.pp Additional Information: Source Context system_u:system_r:certmonger_t:s0 Target Context system_u:system_r:certmonger_t:s0 Target Objects Unknown [ capability ] Source renew_ca_cert Source Path /usr/libexec/platform-python3.6 Port <Unknown> Host <Unknown> Source RPM Packages platform-python-3.6.8-31.el8.x86_64 Target RPM Packages SELinux Policy RPM selinux-policy-targeted-3.14.3-54.el8.noarch Local Policy RPM selinux-policy-targeted-3.14.3-54.el8.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name example.com Platform Linux example.com 4.18.0-240.8.1.el8_3.x86_64 #1 SMP Fri Dec 4 12:24:03 EST 2020 x86_64 x86_64 Alert Count 7 First Seen 2020-12-20 04:09:07 EST Last Seen 2020-12-20 05:19:40 EST Local ID 0c2c4908-9fa3-4d61-bd94-b033bd0f7c1d Raw Audit Messages type=AVC msg=audit(1608459580.283:130): avc: denied { fsetid } for pid=4110 comm="renew_ca_cert" capability=4 scontext=system_u:system_r:certmonger_t:s0 tcontext=system_u:system_r:certmonger_t:s0 tclass=capability permissive=1 type=SYSCALL msg=audit(1608459580.283:130): arch=x86_64 syscall=chmod success=yes exit=0 a0=7fe2dc910aa0 a1=1b0 a2=0 a3=2 items=0 ppid=835 pid=4110 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=renew_ca_cert exe=/usr/libexec/platform-python3.6 subj=system_u:system_r:certmonger_t:s0 key=(null)ARCH=x86_64 SYSCALL=chmod AUID=unset UID=root GID=root EUID=root SUID=root FSUID=root EGID=root SGID=root FSGID=root Hash: renew_ca_cert,certmonger_t,certmonger_t,capability,fsetid Expected results: Additional info: