RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 2208154 - pmlogger_daily generates an selinux AVC
Summary: pmlogger_daily generates an selinux AVC
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 9
Classification: Red Hat
Component: pcp
Version: 9.3
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: 9.3
Assignee: Nathan Scott
QA Contact: Jan Kurik
Jacob Taylor Valdez
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-05-18 06:53 UTC by Jan Kurik
Modified: 2023-11-07 09:36 UTC (History)
3 users (show)

Fixed In Version: pcp-6.0.4-2.el9
Doc Type: No Doc Update
Doc Text:
Clone Of:
Environment:
Last Closed: 2023-11-07 08:30:40 UTC
Type: Bug
Target Upstream Version:
Embargoed:
pm-rhel: mirror+


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker RHELPLAN-157563 0 None None None 2023-05-18 06:54:30 UTC
Red Hat Product Errata RHBA-2023:6406 0 None None None 2023-11-07 08:30:52 UTC

Description Jan Kurik 2023-05-18 06:53:16 UTC
Description of problem:
pmlogger_daily.service generates an selinux AVC on daily basic. The AVC is generated approx. 10 minutes after midnight, as pmlogger_daily.timer triggers the pmlogger_daily.service at 00:10:00.

Version-Release number of selected component (if applicable):
* pcp-6.0.4-1.el9

How reproducible:
Always, once a day. When an old (from yesterday or older) archive is compressed and/or merged.

Steps to Reproduce:
You can wait every day till 00:10:00 and then check for new selinux AVCs or here is a reproduction scenario which can "simulate" the 00:10:00 time:

### Save the current system time to RTC
hwclock --systohc
### Switch off NTP
timedatectl set-ntp no
### Set system time to a few seconds before the timer triggers pmlogger_daily.service
date -s "tomorrow 00:09:30"
### Make systemd aware of the time change
systemctl daemon-reload
### Wait for the timer
sleep 60
### Fix back the system time
hwclock --hctosys
### Make systemd aware of the time change
systemctl daemon-reload
### Switch on NTP
timedatectl set-ntp yes
### Check for the AVC
audit2allow -a
ausearch -m AVC

Actual results:
# ausearch -m AVC
----
time->Thu May 18 00:10:03 2023
type=PROCTITLE msg=audit(1684397403.813:617): proctitle=707974686F6E33002F7573722F62696E2F706D726570002D61002F7661722F6C6F672F7063702F706D6C6F676765722F63692D766D2D31302D302D3133372D382E686F737465642E757073686966742E726475322E7265646861742E636F6D2F3230323330353137002D7A002D450030002D70002D6625483A254D3A2553002D
type=SYSCALL msg=audit(1684397403.813:617): arch=c000003e syscall=59 success=no exit=-13 a0=7f16815c9930 a1=7f16802d5f90 a2=7f16802d5f70 a3=0 items=0 ppid=21118 pid=21124 auid=4294967295 uid=991 gid=991 euid=991 suid=991 fsuid=991 egid=991 sgid=991 fsgid=991 tty=(none) ses=4294967295 comm="python3" exe="/usr/bin/python3.9" subj=system_u:system_r:pcp_pmlogger_t:s0 key=(null)
type=AVC msg=audit(1684397403.813:617): avc:  denied  { execute } for  pid=21124 comm="python3" name="ldconfig" dev="vda1" ino=6346288 scontext=system_u:system_r:pcp_pmlogger_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file permissive=0


# audit2allow -a
#============= pcp_pmlogger_t ==============
allow pcp_pmlogger_t ldconfig_exec_t:file execute;

Expected results:
No AVCs are generated.

Comment 4 errata-xmlrpc 2023-11-07 08:30:40 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (pcp bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:6406


Note You need to log in before you can comment on or make changes to this bug.