Hide Forgot
+++ This bug was initially created as a clone of Bug #1892401 +++ Description of problem: SELinux is preventing libcap-ng from 'getattr' accesses on the filesystem /proc. After building libcap-ng the following test fails: /libcap-ng/Regression/compare-capabilities-from-captest-and-capsh/10_avc_check with the following avc.log: SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: enforcing Mode from config file: enforcing Policy MLS status: enabled Policy deny_unknown status: allowed Memory protection checking: actual (secure) Max kernel policy version: 33 selinux-policy-3.14.3-68.el8.noarch ---- time->Wed Jun 2 09:35:02 2021 type=PROCTITLE msg=audit(1622626502.227:1163): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F740063686B657870697279 type=SYSCALL msg=audit(1622626502.227:1163): arch=c000003e syscall=138 success=no exit=-13 a0=3 a1=7ffec4a7d910 a2=0 a3=0 items=0 ppid=17071 pid=17073 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="unix_chkpwd" exe="/usr/sbin/unix_chkpwd" subj=system_u:system_r:chkpwd_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1622626502.227:1163): avc: denied { getattr } for pid=17073 comm="unix_chkpwd" name="/" dev="proc" ino=1 scontext=system_u:system_r:chkpwd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem permissive=0 ---- time->Wed Jun 2 09:35:38 2021 type=PROCTITLE msg=audit(1622626538.802:1251): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F740063686B657870697279 type=SYSCALL msg=audit(1622626538.802:1251): arch=c000003e syscall=138 success=no exit=-13 a0=3 a1=7ffc09c99620 a2=0 a3=0 items=0 ppid=17427 pid=17429 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="unix_chkpwd" exe="/usr/sbin/unix_chkpwd" subj=system_u:system_r:chkpwd_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1622626538.802:1251): avc: denied { getattr } for pid=17429 comm="unix_chkpwd" name="/" dev="proc" ino=1 scontext=system_u:system_r:chkpwd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem permissive=0
These commits need to be backported: commit 0b26432144f0b6f2140b974b9c508d991286bfa4 Author: Zdenek Pytela <zpytela> Date: Mon Jan 4 19:50:49 2021 +0100 Allow domain stat /proc filesystem Resolves: rhbz#1892401 commit d190cec28e8a29db86ad3b0bc57a66107e781d42 Author: Zdenek Pytela <zpytela> Date: Mon Jan 4 19:48:17 2021 +0100 Remove all kernel_getattr_proc() interface calls All individual permissions to allow stat the /proc filesystem will be replaced by allowing it for all types in the domain attribute. commit 4ff1ffe65c898aa4707f9fca5324b83613a1ae5f Author: Zdenek Pytela <zpytela> Date: Mon Jan 4 19:41:19 2021 +0100 Revert "Allow passwd to get attributes in proc_t" This reverts commit 44a5636ce1fb9d8d306fe49b821b84114ab28746. The permission to stat the /proc filesystem rather needs to be allowed for all types in the domain attribute. commit f01b1545610dcf9c6af470b5a15538d089df9cb6 Author: Zdenek Pytela <zpytela> Date: Mon Jan 4 19:35:47 2021 +0100 Revert "Allow dovecot_auth_t stat /proc filesystem" This reverts commit 757eb7fb51305e86a1ae296f7c69d694e0177749. The permission to stat the /proc filesystem rather needs to be allowed for all types in the domain attribute. commit 125d471b67a4c80dd0f33d82f361e7f12a258de9 Author: Zdenek Pytela <zpytela> Date: Mon Jan 4 19:34:21 2021 +0100 Revert "Allow sssd, unix_chkpwd, groupadd stat /proc filesystem" This reverts commit 785340ee2d313990024653ce2dd028d34bdeecd9. The permission to stat the /proc filesystem rather needs to be allowed for all types in the domain attribute.
*** Bug 1968371 has been marked as a duplicate of this bug. ***
*** Bug 1968338 has been marked as a duplicate of this bug. ***
*** Bug 1969747 has been marked as a duplicate of this bug. ***
*** Bug 1969740 has been marked as a duplicate of this bug. ***
*** Bug 1969688 has been marked as a duplicate of this bug. ***
*** Bug 1892401 has been marked as a duplicate of this bug. ***
*** Bug 1970256 has been marked as a duplicate of this bug. ***
*** Bug 1971688 has been marked as a duplicate of this bug. ***
*** Bug 1971228 has been marked as a duplicate of this bug. ***
For CentOS Stream 8 users, take note this was fixed in selinux-policy-3.14.3-70.el8, and we shipped selinux-policy-3.14.3-71.el8 (the next higher release which also contained the fix) on 2021-06-17.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2021:4420