Bug 514922 - Spacewalk 0.6 EL5 Selinux Denials
Summary: Spacewalk 0.6 EL5 Selinux Denials
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Spacewalk
Classification: Community
Component: Installation
Version: 0.6
Hardware: All
OS: Linux
low
medium
Target Milestone: ---
Assignee: Jan Pazdziora (Red Hat)
QA Contact: Red Hat Satellite QA List
URL:
Whiteboard:
Depends On:
Blocks: space06
TreeView+ depends on / blocked
 
Reported: 2009-07-31 14:30 UTC by Devan Goodwin
Modified: 2009-09-10 12:06 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2009-09-10 12:06:53 UTC
Embargoed:


Attachments (Terms of Use)
audit.log with lots of selinux denials (3.63 MB, text/plain)
2009-08-10 06:36 UTC, Sandro Mathys
no flags Details

Description Devan Goodwin 2009-07-31 14:30:50 UTC
Description of problem:

Spacewalk 0.6 on CentOS 5 generates a handful of selinux denials.

Version-Release number of selected component (if applicable):

[root@sw3 audit]# rpm -qa | grep selinux
libselinux-python-1.33.4-5.el5
oracle-nofcontext-selinux-0.1-23.10.el5
jabberd-selinux-1.4.6-1.el5
spacewalk-selinux-0.6.13-1.el5
oracle-instantclient-selinux-10.2-15.el5
spacewalk-monitoring-selinux-0.6.12-1.el5
libselinux-1.33.4-5.el5
selinux-policy-2.4.6-137.el5
selinux-policy-targeted-2.4.6-137.el5
oracle-instantclient-sqlplus-selinux-10.2-15.el5
osa-dispatcher-selinux-5.9.20-1.el5
[root@sw3 audit]# 




Steps to Reproduce:
1. Install 0.6 from devel repo on CentOS 5
2.
3.
  
Actual results:

(dgoodwin@redhat ~) $ grep AVC audit.log =
type=AVC msg=audit(1249049382.962:250): avc:  denied  { write } for  pid=8212 comm="sqlplus" path="/var/log/rhn/populate_db.log" dev=dm-0 ino=1444841 scontext=root:system_r:oracle_sqlplus_t:s0-s0:c0.c1023 tcontext=system_u:object_r:spacewalk_install_log_t:s0 tclass=file
type=AVC msg=audit(1249049382.994:251): avc:  denied  { getattr } for  pid=8212 comm="sqlplus" path="/var/log/rhn/populate_db.log" dev=dm-0 ino=1444841 scontext=root:system_r:oracle_sqlplus_t:s0-s0:c0.c1023 tcontext=system_u:object_r:spacewalk_install_log_t:s0 tclass=file


Additional info:

[root@sw3 audit]# getenforce 
Permissive
[root@sw3 audit]#

Comment 1 Jan Pazdziora (Red Hat) 2009-07-31 15:08:12 UTC
Fixed in Spacewalk repo, master 86a120213c5626cf0024aae93381f23e9e84fe8e. New spacewalk-setup package will be needed.

Comment 2 Sandro Mathys 2009-08-10 06:36:40 UTC
Created attachment 356855 [details]
audit.log with lots of selinux denials

Did this fix go to the 0.6 release? Because I got lots of SELinux denials related to oracle after yum upgrade from 0.5 to 0.6 while it worked fine before. I was only able to do the upgrade-howto Spacewalk on my RHEL 5Server after setting SELinux to permissive mode.

See the audit.log attached - you may want to grep it for oracle (or sqlplus, too).

Comment 3 Jan Pazdziora (Red Hat) 2009-08-10 07:38:04 UTC
The fix mentioned in comment 1 appeared in spacewalk-setup-0.6.17-1.

I'll have to investigate your audit.log. Could you please previde output of

# rpm -qa | egrep '(spacewalk|selinux)'

? Thank you.

Comment 4 Sandro Mathys 2009-08-10 09:50:32 UTC
# rpm -qa | egrep '(spacewalk|selinux)'
libselinux-1.33.4-5.1.el5
selinux-policy-2.4.6-203.el5
spacewalk-backend-0.6.30-1.el5
oracle-instantclient-selinux-10.2-15.el5
spacewalk-html-0.6.19-1.el5
spacewalk-repo-0.6-1.el5
spacewalk-backend-server-0.6.30-1.el5
spacewalk-backend-app-0.6.30-1.el5
spacewalk-backend-package-push-server-0.6.30-1.el5
spacewalk-base-minimal-0.6.19-1.el5
spacewalk-monitoring-selinux-0.6.12-1.el5
spacewalk-setup-0.6.21-1.el5
spacewalk-0.6.4-1.el5
selinux-policy-targeted-2.4.6-203.el5
oracle-nofcontext-selinux-0.1-23.11.el5
spacewalk-backend-xml-export-libs-0.6.30-1.el5
spacewalk-backend-config-files-tool-0.6.30-1.el5
spacewalk-backend-iss-0.6.30-1.el5
spacewalk-java-0.6.42-1.el5
spacewalk-pxt-0.6.19-1.el5
spacewalk-moon-0.6.19-1.el5
spacewalk-monitoring-0.6.7-1.el5
spacewalk-selinux-0.6.13-1.el5
libselinux-python-1.33.4-5.1.el5
spacewalk-java-config-0.6.42-1.el5
jabberd-selinux-1.4.6-1.el5
spacewalk-doc-indexes-0.6.1-1.el5
spacewalk-backend-config-files-common-0.6.30-1.el5
spacewalk-backend-config-files-0.6.30-1.el5
spacewalk-backend-applet-0.6.30-1.el5
spacewalk-taskomatic-0.6.42-1.el5
spacewalk-base-0.6.19-1.el5
spacewalk-grail-0.6.19-1.el5
spacewalk-sniglets-0.6.19-1.el5
spacewalk-admin-0.6.3-1.el5
spacewalk-schema-0.6.22-1.el5
libselinux-utils-1.33.4-5.1.el5
spacewalk-certs-tools-0.6.3-1.el5
spacewalk-config-0.6.13-1.el5
spacewalk-java-lib-0.6.42-1.el5
spacewalk-branding-0.6.8-1.el5
oracle-instantclient-sqlplus-selinux-10.2-15.el5
oracle-xe-selinux-10.2-13.el5
spacewalk-backend-sql-0.6.30-1.el5
spacewalk-backend-xmlrpc-0.6.30-1.el5
spacewalk-backend-iss-export-0.6.30-1.el5
spacewalk-backend-xp-0.6.30-1.el5
spacewalk-search-0.6.11-1.el5
spacewalk-cypress-0.6.19-1.el5
spacewalk-backend-tools-0.6.30-1.el5
osa-dispatcher-selinux-5.9.21-1.el5

Comment 5 Jan Pazdziora (Red Hat) 2009-08-11 13:18:44 UTC
OK, so the first AVC denial (type of) is

type=AVC msg=audit(1249826813.350:2295): avc:  denied  { getattr } for  pid=5053 comm="osa-dispatcher" path="/etc/tnsnames.ora" dev=dm-0 ino=8683711 scontext=user_u:system_r:osa_dispatcher_t:s0 tcontext=user_u:object_r:etc_runtime_t:s0 tclass=file

How did you create the /etc/tnsnames.ora? What does

# restorecon -nrvvi /etc/tnsnames.ora

say? Because I don't see anything in our policies which should cause it to be etc_runtime_t.

Comment 6 Jan Pazdziora (Red Hat) 2009-08-11 13:21:30 UTC
By the way, is your RHEL 5 fully upgraded? Because that

type=AVC msg=audit(1249835323.219:3612): avc:  denied  { connectto } for  pid=8336 comm="semodule" path="/var/run/setrans/.setrans-unix" scontext=user_u:system_r:semanage_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket

sure looks like some generic problem in your system installation -- something which you probably should fix before we try to decipher the rest of those AVCs.

Comment 7 Sandro Mathys 2009-08-11 13:32:33 UTC
I think I never touched that file, i.e. it was created during the installation/upgrade (was 0.5, now 0.6) procedure. But I'm not 100% sure about that.

[root@id-rhn-proxy-01 ~]# restorecon -nrvvi /etc/tnsnames.ora
restorecon reset /etc/tnsnames.ora context user_u:object_r:etc_runtime_t:s0->system_u:object_r:etc_t:s0

There's some updates pending, from pretty new errata (i.e. newer than this bug report): libxml2{,-python, apr{,-util}, spacewalk-repo. Will update them ASAP.

Comment 8 Miroslav Suchý 2009-09-10 12:06:53 UTC
Spacewalk 0.6 released


Note You need to log in before you can comment on or make changes to this bug.