Bug 2009328
| Summary: | IPA: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock [rhel-8.5.0.z] | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | RHEL Program Management Team <pgm-rhel-tools> |
| Component: | opencryptoki | Assignee: | Than Ngo <than> |
| Status: | CLOSED ERRATA | QA Contact: | Karel Srot <ksrot> |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 8.4 | CC: | fkrska, frenaud, lmiksik, ovasik, rcritten, than, tscherf |
| Target Milestone: | rc | Keywords: | Reopened, Triaged, ZStream |
| Target Release: | 8.5 | Flags: | pm-rhel:
mirror+
|
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | opencryptoki-3.16.0-7.el8_5 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | 1991840 | Environment: | |
| Last Closed: | 2021-12-21 09:41:30 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1991840 | ||
| Bug Blocks: | |||
|
Comment 6
Than Ngo
2021-10-18 12:28:22 UTC
On s390x I have noticed new AVC denial in one of the tests. I have reported it as https://bugzilla.redhat.com/show_bug.cgi?id=2021887 type=PROCTITLE msg=audit(11/10/2021 06:08:52.730:525) : proctitle=/usr/sbin/pkcsslotd type=SOCKETCALL msg=audit(11/10/2021 06:08:52.730:525) : nargs=5 a0=0x9 a1=0x1 a2=0x1a a3=0x3fff6b7dfc0 a4=10 type=SYSCALL msg=audit(11/10/2021 06:08:52.730:525) : arch=s390x syscall=socketcall(setsockopt) success=yes exit=0 a0=setsockopt a1=0x3fff6b7def0 a2=0x1a a3=0x3fff6b7dfc0 items=0 ppid=1 pid=48791 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=pkcsslotd exe=/usr/sbin/pkcsslotd subj=system_u:system_r:pkcs_slotd_t:s0 key=(null) type=AVC msg=audit(11/10/2021 06:08:52.730:525) : avc: denied { sys_admin } for pid=48791 comm=pkcsslotd capability=sys_admin scontext=system_u:system_r:pkcs_slotd_t:s0 tcontext=system_u:system_r:pkcs_slotd_t:s0 tclass=capability permissive=0 ---- Than, would you have any idea why the new capability is being present there? I think it may be due to package rebuild using packages from RHEL-8.5. (In reply to Karel Srot from comment #12) > On s390x I have noticed new AVC denial in one of the tests. I have reported > it as > https://bugzilla.redhat.com/show_bug.cgi?id=2021887 > > type=PROCTITLE msg=audit(11/10/2021 06:08:52.730:525) : > proctitle=/usr/sbin/pkcsslotd > type=SOCKETCALL msg=audit(11/10/2021 06:08:52.730:525) : nargs=5 a0=0x9 > a1=0x1 a2=0x1a a3=0x3fff6b7dfc0 a4=10 > type=SYSCALL msg=audit(11/10/2021 06:08:52.730:525) : arch=s390x > syscall=socketcall(setsockopt) success=yes exit=0 a0=setsockopt > a1=0x3fff6b7def0 a2=0x1a a3=0x3fff6b7dfc0 items=0 ppid=1 pid=48791 > auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root > sgid=root fsgid=root tty=(none) ses=unset comm=pkcsslotd > exe=/usr/sbin/pkcsslotd subj=system_u:system_r:pkcs_slotd_t:s0 key=(null) > type=AVC msg=audit(11/10/2021 06:08:52.730:525) : avc: denied { sys_admin > } for pid=48791 comm=pkcsslotd capability=sys_admin > scontext=system_u:system_r:pkcs_slotd_t:s0 > tcontext=system_u:system_r:pkcs_slotd_t:s0 tclass=capability permissive=0 > ---- > > Than > would you have any idea why the new capability is being present there? I > think it may be due to package rebuild using packages from RHEL-8.5. there was no change in the code with the 3.16.0-7 build, only the file opencryptoki.module was dropped. I don't think this change causes such problem. It should be due to package rebuild using packages from RHEL-8.5. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (opencryptoki bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2021:5224 |