Description of problem:

After our unit test suite is run we have seen an SELinux AVC of the PCP process when the PMDA bcc is enabled.

The AVC is seen every time the pmcd process is restarted

We have seen the issue only on AWS (using a t3.small instance type), but not yet Azure or VMWare, but that might be just luck.


Steps to Reproduce:

[cb/AWS] hoici@ip-10-215-229-191:~$ sudo  sealert -l 06b9a194-0d5e-4863-9dc7-3363357439a7

SELinux is preventing /usr/libexec/platform-python3.6 from execute access on the file /memfd:libffi (deleted).

*****  Plugin restorecon (99.5 confidence) suggests   ************************

If you want to fix the label.
/memfd:libffi (deleted) default label should be etc_runtime_t.
Then you can run restorecon. The access attempt may have been stopped due to insufficient permissions to access a parent directory in which case try to change the following command accordingly.
Do
# /sbin/restorecon -v /memfd:libffi (deleted)

*****  Plugin catchall (1.49 confidence) suggests   **************************

If you believe that platform-python3.6 should be allowed execute access on the memfd:libffi (deleted) file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'python3' --raw | audit2allow -M my-python3
# semodule -X 300 -i my-python3.pp


Additional Information:
Source Context                system_u:system_r:pcp_pmcd_t:s0
Target Context                system_u:object_r:pcp_tmpfs_t:s0
Target Objects                /memfd:libffi (deleted) [ file ]
Source                        python3
Source Path                   /usr/libexec/platform-python3.6
Port                          <Unknown>
Host                          ip-10-215-229-191.eu-west-1.compute.internal
Source RPM Packages           platform-python-3.6.8-45.el8.x86_64
Target RPM Packages
SELinux Policy RPM            selinux-policy-targeted-3.14.3-95.el8.noarch
Local Policy RPM              selinux-policy-targeted-3.14.3-95.el8.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     ip-10-215-229-191.eu-west-1.compute.internal
Platform                      Linux ip-10-215-229-191.eu-west-1.compute.internal
                              4.18.0-372.9.1.el8.x86_64 #1 SMP Fri Apr 15
                              22:12:19 EDT 2022 x86_64 x86_64
Alert Count                   4
First Seen                    2022-05-20 11:51:41 UTC
Last Seen                     2022-05-20 12:51:14 UTC
Local ID                      06b9a194-0d5e-4863-9dc7-3363357439a7

Raw Audit Messages
type=AVC msg=audit(1653051074.880:2331328): avc:  denied  { execute } for  pid=2067963 comm="python3" path=2F6D656D66643A6C6962666669202864656C6574656429 dev="tmpfs" ino=13527843 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:pcp_tmpfs_t:s0 tclass=file permissive=0

type=SYSCALL msg=audit(1653051074.880:2331328): arch=x86_64 syscall=mmap success=no exit=EACCES a0=0 a1=1000 a2=5 a3=1 items=0 ppid=2067954 pid=2067963 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=python3 exe=/usr/libexec/platform-python3.6 subj=system_u:system_r:pcp_pmcd_t:s0 key=(null)

Hash: python3,pcp_pmcd_t,pcp_tmpfs_t,file,execute

[cb/AWS] hoici@ip-10-215-229-191:~$


Actual results:

~~~
PCP pmda bcc might not work
~~~

Expected results:

~~~
PCP pmda bcc should work
~~~