Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
pmlogger_daily.service generates an selinux AVC on daily basic. The AVC is generated approx. 10 minutes after midnight, as pmlogger_daily.timer triggers the pmlogger_daily.service at 00:10:00.
Version-Release number of selected component (if applicable):
* pcp-6.0.4-1.el9
How reproducible:
Always, once a day. When an old (from yesterday or older) archive is compressed and/or merged.
Steps to Reproduce:
You can wait every day till 00:10:00 and then check for new selinux AVCs or here is a reproduction scenario which can "simulate" the 00:10:00 time:
### Save the current system time to RTC
hwclock --systohc
### Switch off NTP
timedatectl set-ntp no
### Set system time to a few seconds before the timer triggers pmlogger_daily.service
date -s "tomorrow 00:09:30"
### Make systemd aware of the time change
systemctl daemon-reload
### Wait for the timer
sleep 60
### Fix back the system time
hwclock --hctosys
### Make systemd aware of the time change
systemctl daemon-reload
### Switch on NTP
timedatectl set-ntp yes
### Check for the AVC
audit2allow -a
ausearch -m AVC
Actual results:
# ausearch -m AVC
----
time->Thu May 18 00:10:03 2023
type=PROCTITLE msg=audit(1684397403.813:617): proctitle=707974686F6E33002F7573722F62696E2F706D726570002D61002F7661722F6C6F672F7063702F706D6C6F676765722F63692D766D2D31302D302D3133372D382E686F737465642E757073686966742E726475322E7265646861742E636F6D2F3230323330353137002D7A002D450030002D70002D6625483A254D3A2553002D
type=SYSCALL msg=audit(1684397403.813:617): arch=c000003e syscall=59 success=no exit=-13 a0=7f16815c9930 a1=7f16802d5f90 a2=7f16802d5f70 a3=0 items=0 ppid=21118 pid=21124 auid=4294967295 uid=991 gid=991 euid=991 suid=991 fsuid=991 egid=991 sgid=991 fsgid=991 tty=(none) ses=4294967295 comm="python3" exe="/usr/bin/python3.9" subj=system_u:system_r:pcp_pmlogger_t:s0 key=(null)
type=AVC msg=audit(1684397403.813:617): avc: denied { execute } for pid=21124 comm="python3" name="ldconfig" dev="vda1" ino=6346288 scontext=system_u:system_r:pcp_pmlogger_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file permissive=0
# audit2allow -a
#============= pcp_pmlogger_t ==============
allow pcp_pmlogger_t ldconfig_exec_t:file execute;
Expected results:
No AVCs are generated.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (pcp bug fix and enhancement update), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2023:6406
Description of problem: pmlogger_daily.service generates an selinux AVC on daily basic. The AVC is generated approx. 10 minutes after midnight, as pmlogger_daily.timer triggers the pmlogger_daily.service at 00:10:00. Version-Release number of selected component (if applicable): * pcp-6.0.4-1.el9 How reproducible: Always, once a day. When an old (from yesterday or older) archive is compressed and/or merged. Steps to Reproduce: You can wait every day till 00:10:00 and then check for new selinux AVCs or here is a reproduction scenario which can "simulate" the 00:10:00 time: ### Save the current system time to RTC hwclock --systohc ### Switch off NTP timedatectl set-ntp no ### Set system time to a few seconds before the timer triggers pmlogger_daily.service date -s "tomorrow 00:09:30" ### Make systemd aware of the time change systemctl daemon-reload ### Wait for the timer sleep 60 ### Fix back the system time hwclock --hctosys ### Make systemd aware of the time change systemctl daemon-reload ### Switch on NTP timedatectl set-ntp yes ### Check for the AVC audit2allow -a ausearch -m AVC Actual results: # ausearch -m AVC ---- time->Thu May 18 00:10:03 2023 type=PROCTITLE msg=audit(1684397403.813:617): proctitle=707974686F6E33002F7573722F62696E2F706D726570002D61002F7661722F6C6F672F7063702F706D6C6F676765722F63692D766D2D31302D302D3133372D382E686F737465642E757073686966742E726475322E7265646861742E636F6D2F3230323330353137002D7A002D450030002D70002D6625483A254D3A2553002D type=SYSCALL msg=audit(1684397403.813:617): arch=c000003e syscall=59 success=no exit=-13 a0=7f16815c9930 a1=7f16802d5f90 a2=7f16802d5f70 a3=0 items=0 ppid=21118 pid=21124 auid=4294967295 uid=991 gid=991 euid=991 suid=991 fsuid=991 egid=991 sgid=991 fsgid=991 tty=(none) ses=4294967295 comm="python3" exe="/usr/bin/python3.9" subj=system_u:system_r:pcp_pmlogger_t:s0 key=(null) type=AVC msg=audit(1684397403.813:617): avc: denied { execute } for pid=21124 comm="python3" name="ldconfig" dev="vda1" ino=6346288 scontext=system_u:system_r:pcp_pmlogger_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file permissive=0 # audit2allow -a #============= pcp_pmlogger_t ============== allow pcp_pmlogger_t ldconfig_exec_t:file execute; Expected results: No AVCs are generated.