Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 639862

Summary: USER_AVC: denied { send_msg } for msgtype=method_call interface=org.freedesktop.PackageKit member=... dest=org.freedesktop.PackageKit
Product: Red Hat Enterprise Linux 6 Reporter: Milos Malik <mmalik>
Component: xguestAssignee: Daniel Walsh <dwalsh>
Status: CLOSED DUPLICATE QA Contact: Milos Malik <mmalik>
Severity: medium Docs Contact:
Priority: low    
Version: 6.0   
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-10-13 15:47:40 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Milos Malik 2010-10-04 08:58:42 UTC
Description of problem:


Version-Release number of selected component (if applicable):
dbus-1.2.24-3.el6.i686
dbus-glib-0.86-5.el6.i686
dbus-libs-1.2.24-3.el6.i686
dbus-python-0.83.0-6.1.el6.i686
dbus-x11-1.2.24-3.el6.i686
eggdbus-0.6-3.el6.i686
python-slip-dbus-0.2.11-1.el6.noarch
rpm-4.8.0-12.el6.i686
rpm-libs-4.8.0-12.el6.i686
rpm-python-4.8.0-12.el6.i686
selinux-policy-3.7.19-55.el6.noarch
selinux-policy-doc-3.7.19-55.el6.noarch
selinux-policy-minimum-3.7.19-55.el6.noarch
selinux-policy-mls-3.7.19-55.el6.noarch
selinux-policy-targeted-3.7.19-55.el6.noarch

How reproducible:
always

Steps to Reproduce:
1. install xguest package
2. switch SELinux to enforcing mode
3. log in as kiosk user via GDM
4. wait a couple of minutes
  
Actual results:
type=USER_AVC msg=audit(1286179464.692:517): user pid=1315 uid=81 auid=429496729
5 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: 
 denied  { send_msg } for msgtype=method_call interface=org.freedesktop.PackageK
it member=GetNetworkState dest=org.freedesktop.PackageKit spid=5527 tpid=5584 sc
ontext=xguest_u:xguest_r:xguest_t:s0 tcontext=system_u:system_r:rpm_t:s0-s0:c0.c
1023 tclass=dbus : exe="/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1286179489.732:518): user pid=1315 uid=81 auid=429496729
5 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: 
 denied  { send_msg } for msgtype=method_call interface=org.freedesktop.PackageK
it member=GetTransactionList dest=org.freedesktop.PackageKit spid=5527 tpid=5588
 scontext=xguest_u:xguest_r:xguest_t:s0 tcontext=system_u:system_r:rpm_t:s0-s0:c
0.c1023 tclass=dbus : exe="/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal
=?'
type=USER_AVC msg=audit(1286179564.748:521): user pid=1315 uid=81 auid=429496729
5 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: 
 denied  { send_msg } for msgtype=method_call interface=org.freedesktop.PackageK
it member=SetProxy dest=org.freedesktop.PackageKit spid=5527 tpid=5596 scontext=
xguest_u:xguest_r:xguest_t:s0 tcontext=system_u:system_r:rpm_t:s0-s0:c0.c1023 tc
lass=dbus : exe="/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'

Expected results:
no USER_AVCs of this kind

Comment 1 Milos Malik 2010-10-04 09:00:53 UTC
# rpm -qa | grep -i packagekit | sort
gnome-packagekit-2.28.3-3.el6.i686
PackageKit-0.5.8-13.el6.i686
PackageKit-device-rebind-0.5.8-13.el6.i686
PackageKit-glib-0.5.8-13.el6.i686
PackageKit-gtk-module-0.5.8-13.el6.i686
PackageKit-yum-0.5.8-13.el6.i686
PackageKit-yum-plugin-0.5.8-13.el6.i686

Comment 2 Daniel Walsh 2010-10-04 15:20:52 UTC
One we should not be running packagekit applet in xguest.  This should be being blocked by xguest package.  We could also fix this by putting in a dontaudit message when xguest_t tries to send a message to rpm_t.

Comment 3 Milos Malik 2010-10-05 07:23:11 UTC
Yes, we should do something about it. Otherwise someone else will complain about the amount of CPU consumed by dbus-daemon. Here is what I accidentally found out:

If there are no rules allowing/dontauditing the USER_AVC actions, dbus-daemon is consuming 99% of CPU. I did some tests with following module created by audit2allow:

module mypol 1.0;

require {
        type xguest_t;
        type setroubleshootd_t;
        type rpm_t;
        class dbus send_msg;
}

#============= xguest_t ==============
allow xguest_t rpm_t:dbus send_msg;
allow xguest_t setroubleshootd_t:dbus send_msg;

Few seconds after I loaded the module dbus-daemon stopped consuming 99% of CPU. To be sure that behaviour of dbus-daemon is related to the existence of those 2 rules I decided to unload the module. Few seconds after that dbus-daemon started consuming 99% CPU again.

Comment 4 Daniel Walsh 2010-10-13 15:44:06 UTC
Fixed in xguest-1.0.9-1.el6.noarch

Comment 5 Daniel Walsh 2010-10-13 15:47:40 UTC

*** This bug has been marked as a duplicate of bug 639857 ***