Description of problem: dhclient has avc denial Version-Release number of selected component (if applicable): dhcp-client-4.4.2-19.b1.el9.x86_64 selinux-policy-38.1.17-1.el9.noarch How reproducible: always Steps to Reproduce: 1. just run dhclient and you will see denial 2. ls -laZ /var/run/dhclient.pid -rw-r--r--. 1 root root system_u:object_r:var_run_t:s0 4 Jul 25 05:25 /var/run/dhclient.pid 3. Actual results: $ tail -f /var/log/audit/audit.log | grep den & [1] 5267 $ dhclient type=AVC msg=audit(1690277578.888:432): avc: denied { read } for pid=5269 comm="dhclient" name="dhclient.pid" dev="tmpfs" ino=778 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0 type=AVC msg=audit(1690277578.889:433): avc: denied { write } for pid=5269 comm="dhclient" name="dhclient.pid" dev="tmpfs" ino=778 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0 Can't create /var/run/dhclient.pid: Permission denied type=AVC msg=audit(1690277580.959:434): avc: denied { write } for pid=5269 comm="dhclient" name="dhclient.pid" dev="tmpfs" ino=778 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0 Expected results: no denial Additional info:
Seen on 1MT-RHEL-9.3.0-20230718.0 machine: # restorecon -Rv /run/ Relabeled /run/dhclient.lease from system_u:object_r:var_run_t:s0 to system_u:object_r:dhcpc_var_run_t:s0 Relabeled /run/dhclient.pid from system_u:object_r:var_run_t:s0 to system_u:object_r:dhcpc_var_run_t:s0 Relabeled /run/NetworkManager/no-stub-resolv.conf from system_u:object_r:NetworkManager_var_run_t:s0 to system_u:object_r:net_conf_t:s0 # The dhclient.pid file must have been created by something else, because the following sequence works correctly: # rm -f /run/dhclient.* # ls -Z /var/run/dhclient.* ls: cannot access '/var/run/dhclient.*': No such file or directory # dhclient # ls -Z /var/run/dhclient.* unconfined_u:object_r:dhcpc_var_run_t:s0 /var/run/dhclient.pid #
Based on SELinux denials shown in comment#0, the /var/run/dhclient.pid file is mislabeled and that's the reason why SELinux denials appear. If it was labeled correctly, no SELinux denials would have appeared. Correct SELinux context defined by SELinux policy is: # matchpathcon /var/run/dhclient.pid /var/run/dhclient.pid system_u:object_r:dhcpc_var_run_t:s0 # Comment#1 shows that execution of the dhclient program is not the cause. In order to fix the issue, we need to find out what process created the mislabeled file: /var/run/dhclient.pid
This is from the cloud-init.log: - subp.py[DEBUG]: Running command ['/usr/sbin/dhclient', '-1', '-v', '-lf', '/run/dhclient.lease', '-pf', '/run/dhclient.pid', 'eth0', '-sf', '/bin/true'] with allowed return codes [0] (shell=False, capture=True) After restorecon and rebooting 1mt machine, the /var/run/dhclient.* got wrong label var_run_t. So I added type transition rule for cloud_init when creating dhclient.pid/lease, and after reboot it has correct label dhcpd_var_run_t. Can you please retest it, and confirm the fix with selinux-policy version 38.22-1.fc39.101? # dnf copr enable nknazeko/selinux-policy Thank you Nikola
Fixed in other copr build, version 38.22-1.fc39.201, can you please test it?
PR: https://github.com/fedora-selinux/selinux-policy/pull/1800