Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: During CKI tests we hit these avc denials ---- time->Wed Mar 10 07:19:14 2021 type=PROCTITLE msg=audit(1615378754.488:128): proctitle=2F7573722F7362696E2F61766168692D6461656D6F6E002D73 type=PATH msg=audit(1615378754.488:128): item=0 name="/proc/1/environ" inode=14267 dev=00:16 mode=0100400 ouid=0 ogid=0 rdev=00:00 obj=system_u:system_r:init_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(1615378754.488:128): cwd="/" type=SYSCALL msg=audit(1615378754.488:128): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7ffe545b94a0 a2=80000 a3=0 items=1 ppid=1 pid=658 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="avahi-daemon" exe="/usr/sbin/avahi-daemon" subj=system_u:system_r:avahi_t:s0 key=(null) type=AVC msg=audit(1615378754.488:128): avc: denied { open } for pid=658 comm="avahi-daemon" path="/proc/1/environ" dev="proc" ino=14267 scontext=system_u:system_r:avahi_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=file permissive=1 type=AVC msg=audit(1615378754.488:128): avc: denied { read } for pid=658 comm="avahi-daemon" name="environ" dev="proc" ino=14267 scontext=system_u:system_r:avahi_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=file permissive=1 Version-Release number of selected component (if applicable): selinux-policy-3.14.8-4.fc35.noarch How reproducible: not sure yet Steps to Reproduce: 1. clone test repo git clone https://gitlab.com/cki-project/kernel-tests.git 2. go to test directory cd kernel-tests/packages/i2c-tools/sanity/i2cdetect-smoke 3. install test dependency dnf install -y i2c-tools beakerlib 4. run test bash ./runtest.sh Additional info: SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: permissive Mode from config file: permissive Policy MLS status: enabled Policy deny_unknown status: allowed Memory protection checking: actual (secure) Max kernel policy version: 33 selinux-policy-3.14.8-4.fc35.noarch
example of beaker tests that hit this: https://beaker.engineering.redhat.com/recipes/9688125#task123101257 https://beaker.engineering.redhat.com/recipes/9622238#task122488294
With the reproducing steps run in a clean VM, I don't see any related AVC denial. Can it be related to restraint or some other environment change, effecting the tests run? It does not reproduce in our tests-osci/selinux-policy/Regression/bz605621-avahi-and-similar test either.
I was not able to reproduce using 1minutetip. But I was able to reproduce it in beaker using Fedora-Rawhide-20210309.n.1 Server x86_64 on https://beaker.engineering.redhat.com/view/hpe-dl380pgen8-02-vm-7.hpe2.lab.eng.bos.redhat.com beaker job: https://beaker.engineering.redhat.com/jobs/5184105 The problem happened after I started avahi-daemon ** I've ran these command with selinux permissive ** # ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts today | grep avahi # # systemctl start avahi-daemon # # ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts today | grep avahi type=AVC msg=audit(03/12/2021 04:23:15.005:368) : avc: denied { read } for pid=3115 comm=avahi-daemon name=environ dev="proc" ino=13322 scontext=system_u:system_r:avahi_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=file permissive=1 type=AVC msg=audit(03/12/2021 04:23:15.005:369) : avc: denied { open } for pid=3115 comm=avahi-daemon path=/proc/1/environ dev="proc" ino=13322 scontext=system_u:system_r:avahi_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=file permissive=1 # ---- type=PROCTITLE msg=audit(03/12/2021 09:30:40.645:125) : proctitle=/usr/sbin/avahi-daemon -s type=PATH msg=audit(03/12/2021 09:30:40.645:125) : item=0 name=/proc/1/environ inode=13318 dev=00:16 mode=file,400 ouid=root ogid=root rdev=00:00 obj=system_u:system_r:init_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(03/12/2021 09:30:40.645:125) : cwd=/ type=SYSCALL msg=audit(03/12/2021 09:30:40.645:125) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=0xffffff9c a1=0x7fff076d6ae0 a2=O_RDONLY|O_CLOEXEC a3=0x0 items=1 ppid=1 pid=606 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=avahi-daemon exe=/usr/sbin/avahi-daemon subj=system_u:system_r:avahi_t:s0 key=(null) type=AVC msg=audit(03/12/2021 09:30:40.645:125) : avc: denied { open } for pid=606 comm=avahi-daemon path=/proc/1/environ dev="proc" ino=13318 scontext=system_u:system_r:avahi_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=file permissive=1 type=AVC msg=audit(03/12/2021 09:30:40.645:125) : avc: denied { read } for pid=606 comm=avahi-daemon name=environ dev="proc" ino=13318 scontext=system_u:system_r:avahi_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=file permissive=1
*** This bug has been marked as a duplicate of bug 1932689 ***