Bug 2159599 - SELinux is preventing mongod from 'search' accesses on the directory net.
Summary: SELinux is preventing mongod from 'search' accesses on the directory net.
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 37
Hardware: x86_64
OS: Unspecified
low
unspecified
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:63437228fed533d6048a33c87ee...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-01-10 05:24 UTC by venutonh
Modified: 2023-09-19 04:32 UTC (History)
7 users (show)

Fixed In Version: selinux-policy-37.20-1.fc37
Clone Of:
Environment:
Last Closed: 2023-05-10 01:40:20 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github fedora-selinux selinux-policy pull 1635 0 None open Allow mongodb read network sysctls 2023-04-05 12:54:34 UTC

Description venutonh 2023-01-10 05:24:29 UTC
Description of problem:
SELinux is preventing mongod from 'search' accesses on the directory net.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that mongod should be allowed search access on the net directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'mongod' --raw | audit2allow -M my-mongod
# semodule -X 300 -i my-mongod.pp

Additional Information:
Source Context                system_u:system_r:mongod_t:s0
Target Context                system_u:object_r:sysctl_net_t:s0
Target Objects                net [ dir ]
Source                        mongod
Source Path                   mongod
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-37.17-1.fc37.noarch
Local Policy RPM              selinux-policy-targeted-37.17-1.fc37.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 6.0.18-300.fc37.x86_64 #1 SMP
                              PREEMPT_DYNAMIC Sat Jan 7 17:10:00 UTC 2023 x86_64
                              x86_64
Alert Count                   4
First Seen                    2023-01-09 22:25:13 EST
Last Seen                     2023-01-09 23:16:59 EST
Local ID                      45aab1c3-9c45-4450-9f7e-5fabbc772f1a

Raw Audit Messages
type=AVC msg=audit(1673324219.586:214): avc:  denied  { search } for  pid=930 comm="mongod" name="net" dev="proc" ino=15624 scontext=system_u:system_r:mongod_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=dir permissive=0


Hash: mongod,mongod_t,sysctl_net_t,dir,search

Version-Release number of selected component:
selinux-policy-targeted-37.17-1.fc37.noarch

Additional info:
component:      selinux-policy
reporter:       libreport-2.17.4
hashmarkername: setroubleshoot
kernel:         6.0.18-300.fc37.x86_64
type:           libreport

Potential duplicate: bug 1884810

Comment 1 Zdenek Pytela 2023-01-10 10:27:26 UTC
Hi,

I cannot reproduce a problem like this, can you gather all denials with full auditing enabled?

0) Set SELinux to permissive
  # setenforce 0
1) Open the /etc/audit/rules.d/audit.rules file in an editor.
2) Remove the following line if it exists:
-a task,never
3) Add the following line to the end of the file:
-w /etc/shadow -p w
4) Restart the audit daemon:
  # service auditd restart
5) Re-run your scenario.
6) Collect AVC denials:
  # ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts today
0) Set SELinux to enforcing
  # setenforce 1

Comment 2 Fedora Update System 2023-04-26 19:54:55 UTC
FEDORA-2023-13093d1386 has been submitted as an update to Fedora 37. https://bodhi.fedoraproject.org/updates/FEDORA-2023-13093d1386

Comment 3 Fedora Update System 2023-04-27 01:40:02 UTC
FEDORA-2023-13093d1386 has been pushed to the Fedora 37 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2023-13093d1386`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-13093d1386

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 4 Fedora Update System 2023-05-10 01:40:20 UTC
FEDORA-2023-13093d1386 has been pushed to the Fedora 37 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 5 Red Hat Bugzilla 2023-09-19 04:32:22 UTC
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days


Note You need to log in before you can comment on or make changes to this bug.