RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 2048592 - SELinux is preventing /usr/bin/dccproc from map access on the file /etc/dcc/map
Summary: SELinux is preventing /usr/bin/dccproc from map access on the file /etc/dcc/map
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: selinux-policy
Version: 8.5
Hardware: x86_64
OS: Linux
medium
urgent
Target Milestone: rc
: 8.6
Assignee: Zdenek Pytela
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-01-31 15:07 UTC by Brian J. Murrell
Modified: 2022-02-09 14:40 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2022-02-04 16:13:47 UTC
Type: Bug
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker RHELPLAN-110424 0 None None None 2022-01-31 15:14:00 UTC

Description Brian J. Murrell 2022-01-31 15:07:11 UTC 
SELinux is preventing /usr/bin/dccproc from map access on the file /etc/dcc/map.

*****  Plugin catchall_boolean (89.3 confidence) suggests   ******************

If you want to allow any process to mmap any file on system with attribute file_type.
Then you must tell SELinux about this by enabling the 'domain_can_mmap_files' boolean.

Do
setsebool -P domain_can_mmap_files 1

*****  Plugin catchall (11.6 confidence) suggests   **************************

If you believe that dccproc should be allowed map access on the map file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'dccproc' --raw | audit2allow -M my-dccproc
# semodule -X 300 -i my-dccproc.pp


Additional Information:
Source Context                system_u:system_r:dcc_client_t:s0
Target Context                system_u:object_r:dcc_client_map_t:s0
Target Objects                /etc/dcc/map [ file ]
Source                        dccproc
Source Path                   /usr/bin/dccproc
Port                          <Unknown>
Host                          server.interlinx.bc.ca
Source RPM Packages           DCC-1.3.145-25.el7.x86_64
Target RPM Packages           DCC-1.3.145-25.el7.x86_64
SELinux Policy RPM            selinux-policy-targeted-3.14.3-80.el8_5.2.noarch
Local Policy RPM              selinux-policy-targeted-3.14.3-80.el8_5.2.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     server.interlinx.bc.ca
Platform                      Linux server.interlinx.bc.ca
                              4.18.0-348.12.2.el8_5.x86_64 #1 SMP Wed Jan 19
                              14:35:04 EST 2022 x86_64 x86_64
Alert Count                   589
First Seen                    2022-01-23 22:09:12 EST
Last Seen                     2022-01-31 09:36:46 EST
Local ID                      0e3cf098-a95a-4264-9e97-4334ad887784

Raw Audit Messages
type=AVC msg=audit(1643639806.283:1581): avc:  denied  { map } for  pid=31008 comm="dccproc" path="/etc/dcc/map" dev="dm-4" ino=66731 scontext=system_u:system_r:dcc_client_t:s0 tcontext=system_u:object_r:dcc_client_map_t:s0 tclass=file permissive=0


type=SYSCALL msg=audit(1643639806.283:1581): arch=x86_64 syscall=mmap success=no exit=EACCES a0=0 a1=1e20 a2=3 a3=1 items=0 ppid=3923 pid=31008 auid=4294967295 uid=1001 gid=1001 euid=1001 suid=0 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=4294967295 comm=dccproc exe=/usr/bin/dccproc subj=system_u:system_r:dcc_client_t:s0 key=(null)

Hash: dccproc,dcc_client_t,dcc_client_map_t,file,map

This results in the following errors:

Jan 31 09:36:46 server dccproc[31008]: mmap(/etc/dcc/map): Permission denied
Jan 31 09:36:46 server dccproc[31008]: mmap(whiteclnt.dccx,42108): Permission denied
Jan 31 09:36:46 server spamd[3923]: dcc: instead of X-DCC header, dccproc returned 'mmap(/etc/dcc/map): Permission denied'

Per the above error messages, indeed, the following AVC is also exhibited:

type=AVC msg=audit(1643639806.283:1582): avc:  denied  { map } for  pid=31008 comm="dccproc" path="/etc/dcc/whiteclnt.dccx" dev="dm-4" ino=65043 scontext=system_u:system_r:dcc_client_t:s0 tcontext=system_u:object_r:dcc_var_t:s0 tclass=file permissive=0
Comment 1 Zdenek Pytela 2022-02-04 16:13:47 UTC 
I haven't managed to find dccproc in RHEL repositories. Please reach out to the package vendor to get support for your issue.

If map is the only missing permission, the following module can be used to work around:

  # cat local_dcc_var_map.cil
(allow dcc_client_t dcc_var_t (file (map)))
  # semodule -i local_dcc_var_map.cil
Comment 2 Brian J. Murrell 2022-02-04 16:28:25 UTC 
So what is the policy (NPI) about SELinux policy rules that are required for software that is not in RHEL/EPEL?

Does the selinux-policy package try to maintain policy for all known software no matter where it comes from (it seems not given the response on this ticket) or are third-party software distributions supposed to supply SELinux policy modules with their software package?

If the latter, is any documentation available on how a software packager supplies their own policy modules in their packages?
Comment 3 Zdenek Pytela 2022-02-09 14:40:09 UTC 
Packages provided by Red Hat are supported.

Packages in EPEL are considered high-quality add-on packages that complement the Red Hat Enterprise Linux. The EPEL project is led by community-led volunteers, packages from this project are not provided by Red Hat though and therefore they are not supported.

The selinux-policy package in RHEL is based off of the package from Fedora. It contains modules for software in RHEL as well as for software which is not a part of RHEL (i. e. 3rd party) for the users convenience. However, it does not mean the policy modules are supported by Red Hat.

Some custom policy hints can be found e. g. here:
https://fedoraproject.org/wiki/SELinux/IndependentPolicy
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/using_selinux/writing-a-custom-selinux-policy_using-selinux
Note You need to log in before you can comment on or make changes to this bug.