Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
One we should not be running packagekit applet in xguest. This should be being blocked by xguest package. We could also fix this by putting in a dontaudit message when xguest_t tries to send a message to rpm_t.
Yes, we should do something about it. Otherwise someone else will complain about the amount of CPU consumed by dbus-daemon. Here is what I accidentally found out:
If there are no rules allowing/dontauditing the USER_AVC actions, dbus-daemon is consuming 99% of CPU. I did some tests with following module created by audit2allow:
module mypol 1.0;
require {
type xguest_t;
type setroubleshootd_t;
type rpm_t;
class dbus send_msg;
}
#============= xguest_t ==============
allow xguest_t rpm_t:dbus send_msg;
allow xguest_t setroubleshootd_t:dbus send_msg;
Few seconds after I loaded the module dbus-daemon stopped consuming 99% of CPU. To be sure that behaviour of dbus-daemon is related to the existence of those 2 rules I decided to unload the module. Few seconds after that dbus-daemon started consuming 99% CPU again.
Description of problem: Version-Release number of selected component (if applicable): dbus-1.2.24-3.el6.i686 dbus-glib-0.86-5.el6.i686 dbus-libs-1.2.24-3.el6.i686 dbus-python-0.83.0-6.1.el6.i686 dbus-x11-1.2.24-3.el6.i686 eggdbus-0.6-3.el6.i686 python-slip-dbus-0.2.11-1.el6.noarch rpm-4.8.0-12.el6.i686 rpm-libs-4.8.0-12.el6.i686 rpm-python-4.8.0-12.el6.i686 selinux-policy-3.7.19-55.el6.noarch selinux-policy-doc-3.7.19-55.el6.noarch selinux-policy-minimum-3.7.19-55.el6.noarch selinux-policy-mls-3.7.19-55.el6.noarch selinux-policy-targeted-3.7.19-55.el6.noarch How reproducible: always Steps to Reproduce: 1. install xguest package 2. switch SELinux to enforcing mode 3. log in as kiosk user via GDM 4. wait a couple of minutes Actual results: type=USER_AVC msg=audit(1286179464.692:517): user pid=1315 uid=81 auid=429496729 5 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.PackageK it member=GetNetworkState dest=org.freedesktop.PackageKit spid=5527 tpid=5584 sc ontext=xguest_u:xguest_r:xguest_t:s0 tcontext=system_u:system_r:rpm_t:s0-s0:c0.c 1023 tclass=dbus : exe="/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' type=USER_AVC msg=audit(1286179489.732:518): user pid=1315 uid=81 auid=429496729 5 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.PackageK it member=GetTransactionList dest=org.freedesktop.PackageKit spid=5527 tpid=5588 scontext=xguest_u:xguest_r:xguest_t:s0 tcontext=system_u:system_r:rpm_t:s0-s0:c 0.c1023 tclass=dbus : exe="/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal =?' type=USER_AVC msg=audit(1286179564.748:521): user pid=1315 uid=81 auid=429496729 5 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.PackageK it member=SetProxy dest=org.freedesktop.PackageKit spid=5527 tpid=5596 scontext= xguest_u:xguest_r:xguest_t:s0 tcontext=system_u:system_r:rpm_t:s0-s0:c0.c1023 tc lass=dbus : exe="/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' Expected results: no USER_AVCs of this kind