Description of problem: Misconfigured selinux policy for keepalived triggers AVC denial when using MISC_CHECK in keepalived.conf Version-Release number of selected component (if applicable): keepalived-2.2.4-6.el9.x86_64 selinux-policy-38.1.14-1.el9.noarch How reproducible: always Steps to Reproduce: 1.Find location for keepalived scripts: $ semanage fcontext -l | grep keepalived_unconfined_script /usr/libexec/keepalived(/.*)? all files system_u:object_r:keepalived_unconfined_script_exec_t:s0 2.Create a script in this location: $ cat /usr/libexec/keepalived/misc_checker #!/usr/bin/bash true 3.Create a keepalived.conf file with MISC_CHECK: $ cat /etc/keepalived/keepalived.conf vrrp_instance VRRP_INSTANCE { state MASTER priority 128 advert_int 1 virtual_router_id 1 interface ens3 virtual_ipaddress {10.37.165.105} } virtual_server 10.37.165.105 80 { real_server 10.37.167.2 80 { weight 1 MISC_CHECK { misc_path /usr/libexec/keepalived/misc_checker retry 1 } } } 4.Start keepalived Actual results: Keepalived works but a selinux denial appears $ ausearch -m AVC,USER_AVC ---- time->Wed Jun 7 16:56:46 2023 type=PROCTITLE msg=audit(1686149806.955:980): proctitle=2F7573722F7362696E2F6B656570616C69766564002D2D646F6E742D666F726B002D44002D2D636F6E6669672D6964006D61696E type=SYSCALL msg=audit(1686149806.955:980): arch=c000003e syscall=280 success=no exit=-13 a0=ffffff9c a1=55df7dcb4c30 a2=7ffff3502c80 a3=0 items=0 ppid=63215 pid=63216 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="keepalived" exe="/usr/sbin/keepalived" subj=system_u:system_r:keepalived_t:s0 key=(null) type=AVC msg=audit(1686149806.955:980): avc: denied { setattr } for pid=63216 comm="keepalived" name="misc_checker" dev="dm-0" ino=9451029 scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:object_r:keepalived_unconfined_script_exec_t:s0 tclass=file permissive=0 Expected results: No denial
# cp `which id` /usr/libexec/keepalived/misc_checker # ls -lZ /usr/libexec/keepalived/misc_checker -rwxr-xr-x. 1 root root unconfined_u:object_r:keepalived_unconfined_script_exec_t:s0 40472 Jun 7 12:42 /usr/libexec/keepalived/misc_checker # Caught in enforcing mode: ---- type=PROCTITLE msg=audit(06/07/2023 12:39:43.749:323) : proctitle=/usr/sbin/keepalived --dont-fork -D type=PATH msg=audit(06/07/2023 12:39:43.749:323) : item=0 name=/usr/libexec/keepalived/misc_checker inode=8388737 dev=fd:01 mode=file,755 ouid=root ogid=root rdev=00:00 obj=unconfined_u:object_r:keepalived_unconfined_script_exec_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(06/07/2023 12:39:43.749:323) : cwd=/ type=SYSCALL msg=audit(06/07/2023 12:39:43.749:323) : arch=x86_64 syscall=utimensat success=no exit=EACCES(Permission denied) a0=AT_FDCWD a1=0x5626ec7f7590 a2=0x7ffee2a57340 a3=0x0 items=1 ppid=4620 pid=4621 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=keepalived exe=/usr/sbin/keepalived subj=system_u:system_r:keepalived_t:s0 key=(null) type=AVC msg=audit(06/07/2023 12:39:43.749:323) : avc: denied { setattr } for pid=4621 comm=keepalived name=misc_checker dev="vda1" ino=8388737 scontext=system_u:system_r:keepalived_t:s0 tcontext=unconfined_u:object_r:keepalived_unconfined_script_exec_t:s0 tclass=file permissive=0 ---- Caught in permissive mode: ---- type=PROCTITLE msg=audit(06/07/2023 12:40:36.993:330) : proctitle=/usr/sbin/keepalived --dont-fork -D type=PATH msg=audit(06/07/2023 12:40:36.993:330) : item=0 name=/usr/libexec/keepalived/misc_checker inode=8388737 dev=fd:01 mode=file,755 ouid=root ogid=root rdev=00:00 obj=unconfined_u:object_r:keepalived_unconfined_script_exec_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(06/07/2023 12:40:36.993:330) : cwd=/ type=SYSCALL msg=audit(06/07/2023 12:40:36.993:330) : arch=x86_64 syscall=utimensat success=yes exit=0 a0=AT_FDCWD a1=0x56010a323590 a2=0x7ffe6f0629c0 a3=0x0 items=1 ppid=4659 pid=4660 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=keepalived exe=/usr/sbin/keepalived subj=system_u:system_r:keepalived_t:s0 key=(null) type=AVC msg=audit(06/07/2023 12:40:36.993:330) : avc: denied { setattr } for pid=4660 comm=keepalived name=misc_checker dev="vda1" ino=8388737 scontext=system_u:system_r:keepalived_t:s0 tcontext=unconfined_u:object_r:keepalived_unconfined_script_exec_t:s0 tclass=file permissive=1 ----
This looks like a RHEL 9 clone of bz#1997148. Juraj, do you happen to know why would keepalived want to run utimensat() on executed files?
I do not know and have not found direct mentions of it the source code either. And it indeed seems to be the same issue as the bug you linked. Maybe Ryan has found out more since?