Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
Confined sysadm_u users trying to executing systemctl commands get a weird error:
~~~
$ sudo systemctl restart rsyslog
System has not been booted with systemd as init system (PID 1). Can't operate.
Failed to connect to bus: Host is down
~~~
The root cause is (again) having systemctl command execute in "sudo" context "sysadm_sudo_t" instead of "sysadm_t".
The policy has the rule to allow the execution, but the Transition rule is missing:
~~~
# sesearch -A -s sysadm_sudo_t -t systemd_systemctl_exec_t -c file -p execute
allow sudodomain exec_type:file { execute execute_no_trans getattr ioctl lock map open read };
# sesearch -T -s sysadm_sudo_t -t systemd_systemctl_exec_t
--> nothing
~~~
Again, fixing BZ #1910077 is the proper way, but this bug doesn't get traction at all.
Version-Release number of selected component (if applicable):
selinux-policy-3.14.3-67.el8_4.2.noarch
How reproducible:
Always
Steps to Reproduce:
1. sudo from sysadm_t user
$ sudo systemctl restart rsyslog
System has not been booted with systemd as init system (PID 1). Can't operate.
Failed to connect to bus: Host is down
2. Check the AVCs
# ausearch -m avc -ts boot
----
time->Wed Oct 13 16:14:00 2021
type=PROCTITLE msg=audit(1634134440.358:175): proctitle=73797374656D63746C007265737461727400727379736C6F67
type=SYSCALL msg=audit(1634134440.358:175): arch=c000003e syscall=262 success=no exit=-13 a0=ffffff9c a1=7fe283389b21 a2=7ffcadad02a0 a3=0 items=0 ppid=1836 pid=1838 auid=1002 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="systemctl" exe="/usr/bin/systemctl" subj=sysadm_u:sysadm_r:sysadm_sudo_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1634134440.358:175): avc: denied { search } for pid=1838 comm="systemctl" name="1" dev="proc" ino=11685 scontext=sysadm_u:sysadm_r:sysadm_sudo_t:s0-s0:c0.c1023 tcontext=system_u:system_r:init_t:s0 tclass=dir permissive=0
----
Additional info:
The AVC is due to running in inappropriate context "sysadm_sudo_t".
To backport:
commit 8879c209b0916931aab95d733fc7f4b52b99258b (HEAD -> rawhide, upstream/rawhide)
Author: Zdenek Pytela <zpytela>
Date: Wed Dec 22 13:06:33 2021 +0100
Allow sysadm execute sysadmctl in sysadm_t domain using sudo
When an unprivileged user in the sysadm_r role executes systemctl
through sudo, it transitions into sysadm_sudo_t domain by default.
With this commit, the process transitions back to sysadm_t.
The systemd_domtrans_systemctl() interface was added.
Resolves: rhbz#2013749
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2022:1995
Description of problem: Confined sysadm_u users trying to executing systemctl commands get a weird error: ~~~ $ sudo systemctl restart rsyslog System has not been booted with systemd as init system (PID 1). Can't operate. Failed to connect to bus: Host is down ~~~ The root cause is (again) having systemctl command execute in "sudo" context "sysadm_sudo_t" instead of "sysadm_t". The policy has the rule to allow the execution, but the Transition rule is missing: ~~~ # sesearch -A -s sysadm_sudo_t -t systemd_systemctl_exec_t -c file -p execute allow sudodomain exec_type:file { execute execute_no_trans getattr ioctl lock map open read }; # sesearch -T -s sysadm_sudo_t -t systemd_systemctl_exec_t --> nothing ~~~ Again, fixing BZ #1910077 is the proper way, but this bug doesn't get traction at all. Version-Release number of selected component (if applicable): selinux-policy-3.14.3-67.el8_4.2.noarch How reproducible: Always Steps to Reproduce: 1. sudo from sysadm_t user $ sudo systemctl restart rsyslog System has not been booted with systemd as init system (PID 1). Can't operate. Failed to connect to bus: Host is down 2. Check the AVCs # ausearch -m avc -ts boot ---- time->Wed Oct 13 16:14:00 2021 type=PROCTITLE msg=audit(1634134440.358:175): proctitle=73797374656D63746C007265737461727400727379736C6F67 type=SYSCALL msg=audit(1634134440.358:175): arch=c000003e syscall=262 success=no exit=-13 a0=ffffff9c a1=7fe283389b21 a2=7ffcadad02a0 a3=0 items=0 ppid=1836 pid=1838 auid=1002 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="systemctl" exe="/usr/bin/systemctl" subj=sysadm_u:sysadm_r:sysadm_sudo_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1634134440.358:175): avc: denied { search } for pid=1838 comm="systemctl" name="1" dev="proc" ino=11685 scontext=sysadm_u:sysadm_r:sysadm_sudo_t:s0-s0:c0.c1023 tcontext=system_u:system_r:init_t:s0 tclass=dir permissive=0 ---- Additional info: The AVC is due to running in inappropriate context "sysadm_sudo_t".