Bug 510053 - AVC denial on sa2 run
AVC denial on sa2 run
Product: Fedora
Classification: Fedora
Component: sysstat (Show other bugs)
All Linux
low Severity medium
: ---
: ---
Assigned To: Ivana Varekova
Fedora Extras Quality Assurance
Depends On:
  Show dependency treegraph
Reported: 2009-07-07 11:09 EDT by Jerry James
Modified: 2009-07-29 02:39 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2009-07-29 02:39:55 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Jerry James 2009-07-07 11:09:20 EDT
Description of problem:
I installed sysstat yesterday because I had a use for iostat.  Last night at 11:53, the sysstat cron job ran /usr/lib64/sa/sa2.  At that point, I got 3 AVC denials, all identical:

node=localhost.localdomain type=AVC msg=audit(1246945981.863:36711): avc: denied { read } for pid=26488 comm="find" name="mls" dev=selinuxfs ino=12 scontext=system_u:system_r:sysstat_t:s0-s0:c0.c1023 tcontext=system_u:object_r:security_t:s0 tclass=file

node=localhost.localdomain type=SYSCALL msg=audit(1246945981.863:36711): arch=c000003e syscall=2 success=no exit=-13 a0=7fff931f6ca0 a1=0 a2=7fff931f6cac a3=fffffff8 items=0 ppid=26480 pid=26488 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=101 comm="find" exe="/bin/find" subj=system_u:system_r:sysstat_t:s0-s0:c0.c1023 key=(null)

So it appears that sa2 tried to descend into /selinux and was denied.

Version-Release number of selected component (if applicable):

How reproducible:
I don't know.  It has only run once.  But given the symptoms, I expect this to happen every time the cron job runs.

Steps to Reproduce:
1. Install sysstat on a system with SELinux in enforcing mode.
2. Wait for the sysstat cron job to run at 11:53 PM.
Actual results:
AVC denials on /selinux.

Expected results:
No AVC denials.

Additional info:
Comment 1 Ivana Varekova 2009-07-15 09:08:06 EDT
I don't know any reason why sysstat should read mls file. 
Please could you change the row:
53 23 * * * root /usr/lib/sa/sa2 -A
53 23 * * * root strace /usr/lib/sa/sa2 -A 2>&1 | grep ^open
and write the result here.
And try to use command /usr/lib/sa/sa2 -A from command line and write the results here too.
Comment 2 Jerry James 2009-07-28 16:23:57 EDT
Sorry, I've been on vacation.  Looking back at the system logs, I see that I got the AVC denials the nights of July 6, 7, 8, and 9.  The AVC denial has not happened since then.  According to yum.log, I did not update any packages after installing sysstat on July 6 until I returned from vacation yesterday, July 27.  I'm mystified why the AVC denials should stop on their own like that.  I see that the statistics gathering has continued, since the timestamps on /var/log/sa/* are up to date.

I don't know what to say.  It looks like I can no longer reproduce the problem.  Running /usr/lib64/sa/sa2 -A produces the expected files in /var/log/sa, but no AVC denial and no terminal output.  <*Shrug*>  If it happens again, I'll let you know.
Comment 3 Ivana Varekova 2009-07-29 02:39:55 EDT
Thanks, for now, I'm closing this bug, but if the problem appears again please reopen it and paste here the data from comment #1.

Note You need to log in before you can comment on or make changes to this bug.