Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
DescriptionMohammad Rizwan
2021-02-05 10:07:50 UTC
Description of problem:
AVC denial in multiple ipa-tests testsuite ran in FIPS mode. ipa-getcert and ipa-automember result are attached.
Version-Release number of selected component (if applicable):
rhel8.4
selinux-policy-3.14.3-62.el8.noarch
ipa-selinux-4.9.1-1.module+el8.4.0+9665+c9815399.noarch
How reproducible:
always
Steps to Reproduce:
1. run ipa-getcert or ipa-automember testsuite
Actual results:
AVC denial
Expected results:
no AVC denial
Additional info:
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: targeted
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33
selinux-policy-3.14.3-62.el8.noarch
----
time->Fri Feb 5 03:06:27 2021
type=PROCTITLE msg=audit(1612512387.256:1355): proctitle=2F7573722F6C6962657865632F706C6174666F726D2D707974686F6E002F7573722F6C6962657865632F7268736D63657274642D776F726B6572002D2D6175746F6865616C
type=SOCKADDR msg=audit(1612512387.256:1355): saddr=0A000000000000000000000000000000000000000000000100000000
type=SYSCALL msg=audit(1612512387.256:1355): arch=c000003e syscall=49 success=no exit=-13 a0=7 a1=7ffee79e97d0 a2=1c a3=31 items=0 ppid=1091 pid=39659 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="rhsmcertd-worke" exe="/usr/libexec/platform-python3.6" subj=system_u:system_r:rhsmcertd_t:s0 key=(null)
type=AVC msg=audit(1612512387.256:1355): avc: denied { node_bind } for pid=39659 comm="rhsmcertd-worke" saddr=::1 scontext=system_u:system_r:rhsmcertd_t:s0 tcontext=system_u:object_r:node_t:s0 tclass=tcp_socket permissive=0
Comment 3Alexander Bokovoy
2021-02-05 10:57:21 UTC
Moving to selinux-policy to investigate.
# rpm -qf /usr/share/selinux/targeted/default/active/modules/100/rhsmcertd
selinux-policy-targeted-3.14.3-62.el8.noarch
Description of problem: AVC denial in multiple ipa-tests testsuite ran in FIPS mode. ipa-getcert and ipa-automember result are attached. Version-Release number of selected component (if applicable): rhel8.4 selinux-policy-3.14.3-62.el8.noarch ipa-selinux-4.9.1-1.module+el8.4.0+9665+c9815399.noarch How reproducible: always Steps to Reproduce: 1. run ipa-getcert or ipa-automember testsuite Actual results: AVC denial Expected results: no AVC denial Additional info: SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: enforcing Mode from config file: enforcing Policy MLS status: enabled Policy deny_unknown status: allowed Memory protection checking: actual (secure) Max kernel policy version: 33 selinux-policy-3.14.3-62.el8.noarch ---- time->Fri Feb 5 03:06:27 2021 type=PROCTITLE msg=audit(1612512387.256:1355): proctitle=2F7573722F6C6962657865632F706C6174666F726D2D707974686F6E002F7573722F6C6962657865632F7268736D63657274642D776F726B6572002D2D6175746F6865616C type=SOCKADDR msg=audit(1612512387.256:1355): saddr=0A000000000000000000000000000000000000000000000100000000 type=SYSCALL msg=audit(1612512387.256:1355): arch=c000003e syscall=49 success=no exit=-13 a0=7 a1=7ffee79e97d0 a2=1c a3=31 items=0 ppid=1091 pid=39659 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="rhsmcertd-worke" exe="/usr/libexec/platform-python3.6" subj=system_u:system_r:rhsmcertd_t:s0 key=(null) type=AVC msg=audit(1612512387.256:1355): avc: denied { node_bind } for pid=39659 comm="rhsmcertd-worke" saddr=::1 scontext=system_u:system_r:rhsmcertd_t:s0 tcontext=system_u:object_r:node_t:s0 tclass=tcp_socket permissive=0