Description of problem:
The default RHEL 8.4 CSB configuration disables IPv6. An SELinux error message about "blocked module_request access" (pasted below) appears in journal logs for various applications, including the Red Hat Subscription Manager.

Version-Release number of selected component (if applicable):
RHEL 8.4 CSB, subscription-manager==1.28.13

How reproducible:
Error message appears in logs every day without making any config changes.

Steps to Reproduce:
1. Boot with "ipv6.disable=1" added to the kernel command line.
2. Wait for RHSM to run automatically, or run it manually.
3. Check "journalctl -b -p 3" for setroubleshoot messages.

Actual results:
Error message appears in logs, subscription manager tries to load IPv6 module and is blocked by SELinux policy.

Expected results:
No error message appears in logs, subscription manager either does not try to make IPv6 calls / load the IPv6 module when it is disabled, or the SELinux policy allows this access and does not flag it.

Additional info:
The error message for RHSM mentions "/usr/libexec/platform-python3.6", which is invoked by "/usr/libexec/rhsmcertd-worker" to run the "/usr/lib64/python3.6/site-packages/subscription_manager/scripts/rhsmcertd_worker.py" script.

The error message is fixed (at least for other applications) by passing config options that disable IPv6 usage, so the applicaton does not try and fail to call module_request for the disabled IPv6 module. For example, chronyd can be run with the "-4" command-line option, and postfix / cups can be configured to bind to "127.0.0.1" (only IPv4) instead of "localhost" (both IPv4 and IPv6).

RHSM scripts should probably be updated to not use IPv6 when it is disabled, or the RHSM SELinux policies should be updated to allow requesting the IPv6 module.


Contents of rhsmcertd-worker script that invokes platform-python:
[user@localhost ~]$ cat /usr/libexec/rhsmcertd-worker
#!/usr/libexec/platform-python

    EASY-INSTALL-ENTRY-SCRIPT: 'subscription-manager==1.28.13','console_scripts','rhsmcertd-worker'
    _requires_ = 'subscription-manager==1.28.13'
    import re
    import sys
    from pkg_resources import load_entry_point

if _name_ == '_main_':
sys.argv[0] = re.sub(r'(-script\.pyw?|\.exe)?$', '', sys.argv[0])
sys.exit(
load_entry_point('subscription-manager==1.28.13', 'console_scripts', 'rhsmcertd-worker')()
)


Error message about SELinux blocking module_request access for platform-python:
[user@localhost ~]$ journalctl -b -p 3 | grep sealert
Sep 12 12:53:06 localhost setroubleshoot[9359]: SELinux is preventing /usr/libexec/platform-python3.6 from module_request access on the system labeled kernel_t. For complete SELinux messages run: sealert -l b4d2c94d-b749-47e8-90c3-21933bd3eaea

 

Verbose error message that shows platform-python is being invoked by rhsmcertd-worker, using the rhsmcertd_t SELinux context:
[user@localhost ~]$ sealert -l b4d2c94d-b749-47e8-90c3-21933bd3eaea
SELinux is preventing /usr/libexec/platform-python3.6 from module_request access on the system labeled kernel_t.

                    Plugin catchall (5.76 confidence) suggests **************************

If you believe that platform-python3.6 should be allowed module_request access on system labeled kernel_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:

    ausearch -c 'rhsmcertd-worke' --raw | audit2allow -M my-rhsmcertdworke
    semodule -X 300 -i my-rhsmcertdworke.pp

Additional Information:
Source Context system_u:system_r:rhsmcertd_t:s0
Target Context system_u:system_r:kernel_t:s0
Target Objects Unknown [ system ]
Source rhsmcertd-worke
Source Path /usr/libexec/platform-python3.6
Port <Unknown>
Host localhost
Source RPM Packages
Target RPM Packages
SELinux Policy RPM selinux-policy-targeted-3.14.3-67.el8_4.1.noarch
Local Policy RPM selinux-policy-targeted-3.14.3-67.el8_4.1.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name localhost
Platform Linux localhost 4.18.0-305.12.1.el8_4.x86_64 #1
SMP Mon Jul 26 08:06:24 EDT 2021 x86_64 x86_64
Alert Count 33
First Seen 2021-08-30 09:48:18 EDT
Last Seen 2021-09-12 12:53:00 EDT
Local ID b4d2c94d-b749-47e8-90c3-21933bd3eaea

Raw Audit Messages
type=AVC msg=audit(1631465580.767:256): avc: denied { module_request } for pid=9356 comm="rhsmcertd-worke" kmod="net-pf-10" scontext=system_u:system_r:rhsmcertd_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system permissive=0
Hash: rhsmcertd-worke,rhsmcertd_t,kernel_t,system,module_request