Bug 1979182
| Summary: | avc: denied { getattr } for comm="systemctl" name="/" on systemctl start cockpit.socket | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Martin Pitt <mpitt> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 8.5 | CC: | baker1tex, lvrabec, mmalik, plautrba, ssekidde |
| Target Milestone: | beta | Keywords: | Triaged |
| Target Release: | 8.5 | Flags: | pm-rhel:
mirror+
|
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-3.14.3-76.el8 | Doc Type: | No Doc Update |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-11-09 19:43:34 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Following SELinux denial appears in enforcing mode:
----
type=PROCTITLE msg=audit(07/13/2021 10:48:15.711:195) : proctitle=systemctl show --property Listen cockpit.socket
type=SYSCALL msg=audit(07/13/2021 10:48:15.711:195) : arch=x86_64 syscall=fstatfs success=no exit=EACCES(Permission denied) a0=0x3 a1=0x7fffc8eea410 a2=0x280100 a3=0x0 items=0 ppid=1920 pid=1921 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=systemctl exe=/usr/bin/systemctl subj=system_u:system_r:cockpit_ws_t:s0 key=(null)
type=AVC msg=audit(07/13/2021 10:48:15.711:195) : avc: denied { getattr } for pid=1921 comm=systemctl name=/ dev="vda2" ino=96 scontext=system_u:system_r:cockpit_ws_t:s0 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem permissive=0
----
The same SELinux denial appears in permissive mode:
----
type=PROCTITLE msg=audit(07/13/2021 12:48:49.975:894) : proctitle=systemctl show --property Listen cockpit.socket
type=SYSCALL msg=audit(07/13/2021 12:48:49.975:894) : arch=x86_64 syscall=fstatfs success=yes exit=0 a0=0x3 a1=0x7fff5a78b180 a2=0x280100 a3=0x0 items=0 ppid=45933 pid=45934 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=systemctl exe=/usr/bin/systemctl subj=system_u:system_r:cockpit_ws_t:s0 key=(null)
type=AVC msg=audit(07/13/2021 12:48:49.975:894) : avc: denied { getattr } for pid=45934 comm=systemctl name=/ dev="vda2" ino=96 scontext=system_u:system_r:cockpit_ws_t:s0 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem permissive=1
----
# find / -xdev -inum 96
/
/boot
# df | grep vda
/dev/vda2 8901632 8259664 641968 93% /
/dev/vda1 520868 261396 259472 51% /boot
#
# rpm -qa selinux-policy\* cockpit\* | sort
cockpit-248-1.el8.x86_64
cockpit-bridge-248-1.el8.x86_64
cockpit-packagekit-248-1.el8.noarch
cockpit-storaged-248-1.el8.noarch
cockpit-system-248-1.el8.noarch
cockpit-ws-248-1.el8.x86_64
selinux-policy-3.14.3-72.el8.noarch
selinux-policy-devel-3.14.3-72.el8.noarch
selinux-policy-doc-3.14.3-72.el8.noarch
selinux-policy-minimum-3.14.3-72.el8.noarch
selinux-policy-mls-3.14.3-72.el8.noarch
selinux-policy-sandbox-3.14.3-72.el8.noarch
selinux-policy-targeted-3.14.3-72.el8.noarch
#
*** Bug 1983268 has been marked as a duplicate of this bug. *** selinux-policy-3.14.3-74.el8.noarch
My output of # ausearch -m avc -m user_avc -m selinux_err -i -ts today
----
type=PROCTITLE msg=audit(07/30/2021 13:59:51.174:11) : proctitle=systemctl show --property Listen cockpit.socket
type=SYSCALL msg=audit(07/30/2021 13:59:51.174:11) : arch=x86_64 syscall=fstatfs success=no exit=EACCES(Permission denied) a0=0x3 a1=0x7ffc9b0e1c10 a2=0x280100 a3=0x0 items=0 ppid=888 pid=889 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=systemctl exe=/usr/bin/systemctl subj=system_u:system_r:cockpit_ws_t:s0 key=(null)
type=AVC msg=audit(07/30/2021 13:59:51.174:11) : avc: denied { getattr } for pid=889 comm=systemctl name=/ dev="dm-0" ino=128 scontext=system_u:system_r:cockpit_ws_t:s0 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem permissive=0
----
type=PROCTITLE msg=audit(07/30/2021 13:59:51.562:31) : proctitle=systemctl show --property Listen cockpit.socket
type=SYSCALL msg=audit(07/30/2021 13:59:51.562:31) : arch=x86_64 syscall=fstatfs success=no exit=EACCES(Permission denied) a0=0x3 a1=0x7ffd2b79cdf0 a2=0x280100 a3=0x0 items=0 ppid=1177 pid=1180 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=systemctl exe=/usr/bin/systemctl subj=system_u:system_r:cockpit_ws_t:s0 key=(null)
type=AVC msg=audit(07/30/2021 13:59:51.562:31) : avc: denied { getattr } for pid=1180 comm=systemctl name=/ dev="dm-0" ino=128 scontext=system_u:system_r:cockpit_ws_t:s0 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem permissive=0
I've submitted a Fedora PR to address the issue: https://github.com/fedora-selinux/selinux-policy/pull/819 Commit to backport:
commit 95b6d266399a0c0484cfba33fdf24f5d0ec1759e (HEAD -> rawhide, upstream/rawhide)
Author: Zdenek Pytela <zpytela>
Date: Fri Jul 30 18:14:34 2021 +0200
Allow cockpit_ws_t get attributes of fs_t filesystems
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2021:4420 |
Description of problem: Most recent RHEL 8.5 nightlies [1] introduced a new SELinux rejection related to starting cockpit.socket. Version-Release number of selected component (if applicable): cockpit-247-1.el8.x86_64 selinux-policy-3.14.3-71.el8.noarch systemd-239-48.el8.x86_64 The image build log has a comprehensive version diff, but the only relevant ones seem to be: glibc (2.28-158.el8 -> 2.28-161.el8) kernel (4.18.0-314.el8 -> 4.18.0-318.el8) systemd (239-45.el8_4.1 -> 239-48.el8) How reproducible: Always Steps to Reproduce: 1. systemctl start cockpit.socket I tried a few other units like rpcbind.socket, but curiously they don't seem to trigger the bug. Actual results: SELinux violation: avc: denied { getattr } for pid=2005 comm="systemctl" name="/" dev="vda3" ino=128 scontext=system_u:system_r:cockpit_ws_t:s0 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem permissive=0 Expected results: No violation. Additional info: [1] https://github.com/cockpit-project/bots/pull/2156 [2] https://logs.cockpit-project.org/logs/image-refresh-2156-20210630-112020/log