Likely a duplicate of 669665.

This happens with updated harness too, as TESTOUT.log moved from /tmp to /mnt/testarea which is not covered by the policy. The error messages found in dmesg are:

  audit(1295352310.832:553): avc:  denied  { append } for  pid=7675 comm="nscd" name="TESTOUT.log" dev=dm-0 ino=770064 scontext=root:system_r:nscd_t tcontext=user_u:object_r:mnt_t tclass=file
  audit(1295352310.849:554): avc:  denied  { append } for  pid=7675 comm="nscd" name="TESTOUT.log" dev=dm-0 ino=770064 scontext=root:system_r:nscd_t tcontext=user_u:object_r:mnt_t tclass=file

We need to update rhts policy to allow anyone to write to all files in that directory.

I was just told by Dan Walsh that we don't care about selinux on RHEL4.  They haven't shipped an selinux update in years.

So I'm using this bz to change the default RHEL4 kickstarts to selinux=disabled.  It can still be turned on but its not supported.

 Since SELinux is still supported and we are still shipping RHEL4. Disabling it by default is not the correct thing to do. 

 I have a couple of questions. Is the issue with nscd? Or is the issue the way the
testing is being run in the test environment?

 Looking at the Comment #2 It looks like we could create a policy to avoid this. I don't see a test harness policy loaded for RHEL4. Perhaps we now need one.

http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/4/html/SELinux_Guide/selg-part-0062.html

rhel4 does not have the capability to do stuff like modular policy.  You need to write everything in base policy.

Is there a reason this can't be fixed in the base policy?

Well we don't want to allow apps to append to mnt_t.  

Writing policy for RHEL4 is insanity at this point.

Reply to Comment #9
"Well we don't want to allow apps to append to mnt_t."
 - Why not? This will allow our testing to run with SELinux enabled. Surly adding apps the ability to append to mnt_t is better then disabling SELinux all together.

"Writing policy for RHEL4 is insanity at this point."
 - No more insane then having our entire QE team test a shipping product differently then how a customer will be using the product.

Could we label just the /mnt/testarea to some very liberal role (one allowing anything to anyone) but leave the creation of that directory very restricted?

That way we should ensure the directory is not created by malicious service while at the same time when created anyone could write anything there.

You could label it var_log_t and see if this works, but I would doubt it.  RHEL4 policy was not ready for prime time, and anyone who used it would need to customize policy.  

Jeff the only option would be to build an errata policy for RHEL4 that said allow domain mnt_t:file append; Which would then need to be shipped to all customers.  There is no way to do the hack that we did for RHEL5 and beyond.   We have been ignoring AVC messages from RHEL4 for years, so I am not sure why this is suddenly a big deal.

Reply to Comment #11 and #12
"You could label it var_log_t and see if this works"
 - Marian is that something you can do in beaker stage to test?

"the only option would be to build an errata policy for RHEL4 that said
allow domain mnt_t:file append;Which would then need to be shipped to all
customers."
 - I agree that is too big of a hammer to fix this.

"We have been ignoring AVC messages from RHEL4 for years, so I am not sure why
this is suddenly a big deal."
 - I think there may be a mis-understand in my interest in this BZ. I don't have an interest in the actual AVC messages that are getting printed out. I am fine if you want to ignore them, but the fact is we are not ignoring them. The issue I have is the big hammer approach to stopping the AVC messages. Avoiding the by disabling SELinux IMO is not the correct answer.

Perhaps it be possible to have a harness have a whitelist of messages to ignore.

If we ignore the failing avc-sub-tests for now, does it currently cause any regular tests to end with false-negatives? Going through Petr's results for nscd, only avc tests failed.

I agree with Jeff, and would suggest to hold back with disabling SELinux for RHEL 4 systems.

Jeff has a really good point with a whitelist of messages to ignore on RHEL 4 systems. It shouldn't be that hard to add a simple check to the avc subtest. This is a bug introduced by a change in the harness and if it does not break anything else I would give it a try. 

Has anyone tried the suggested "var_log_t" approach?

Maybe I'm missing something. If so, could someone please summarize what is the current problem?

It appears I can fix the harness to not throw the error on rhel4.

-       make run >>/mnt/testarea/TESTOUT.log 2>&1 &
+       make run | cat >>/mnt/testarea/TESTOUT.log 2>&1 &


This keeps it from reporting the particular avc that has been reported above.  It doesn't mean that other selinux errors won't be thrown. 

I will revert the kickstart change that disables selinux by default.

Seems I jumped the gun.  It still throws an selinux error. :-/

Following messages were found in dmesg:
audit(1296008440.142:2): avc:  denied  { write } for  pid=30361 comm="nscd" name="[134741]" dev=pipefs ino=134741 scontext=root:system_r:nscd_t tcontext=root:system_r:unconfined_t tclass=fifo_file

Dan, any suggestions?

IIUC while the files were in /tmp this was not a problem.
Thus looks like policy on el4 treats tmp_t more liberally than mnt_t.
Relabeling /mnt/testarea to either tmp_t or var_log_t may be the way.

(In reply to comment #12)
> You could label it var_log_t and see if this works, but I would doubt it. 

Sadly, you were right - does not work with tmp_t, initrc_tmp_t nor var_log_t:

  https://beaker.engineering.redhat.com/jobs/48794

> RHEL4 policy was not ready for prime time, and anyone who used it would need to
> customize policy.  
> 
> Jeff the only option would be to build an errata policy for RHEL4 that said
> allow domain mnt_t:file append; Which would then need to be shipped to all
> customers.

Could we ship this to beaker only?

The policy is not modular, but:

a) can we modify and rebuild the policy on runtime
b) or would we need a fork? [not-feasible IMHO]

I am giving up and will leave this up to experts :-)

One more idea:

Is this a wider spread error is does it apply only to nscd? May be we could simply tweak the tests so nscd output is sent to file with different context, relabeled when done and appended to TESTOUT...

> There is no way to do the hack that we did for RHEL5 and beyond.  
> We have been ignoring AVC messages from RHEL4 for years, so I am not sure why
> this is suddenly a big deal.

We are wasting a collossal amount of time on this.  RHEL4 should testing should just ignore the AVC's or just change the script to look for AVC's that don't include mnt_t.

The test is broken as well.

switch_db(){
  rlLog "Switching database $1 to $2"
  tmpf=`mktemp`
  cat /etc/nsswitch.conf | sed -e "s/^$1:.*/$1: $2/g" > $tmpf
  mv $tmpf /etc/nsswitch.conf
  rlAssertGrep "^$1: $2" "/etc/nsswitch.conf"
}


That piece of code breaks selinux context and causes the following failures:

audit(1296062668.376:6): avc:  denied  { read } for  pid=32716 comm="nscd" name="passwd.db" dev=dm-0 ino=1248426 scontext=root:system_r:nscd_t tcontext=system_u:object_r:var_t tclass=file
audit(1296062670.480:9): avc:  denied  { read } for  pid=352 comm="nscd" name="passwd.db" dev=dm-0 ino=1248426 scontext=root:system_r:nscd_t tcontext=system_u:object_r:var_t tclass=file
audit(1296062676.955:16): avc:  denied  { read } for  pid=682 comm="nscd" name="passwd.db" dev=dm-0 ino=1248426 scontext=root:system_r:nscd_t tcontext=system_u:object_r:var_t tclass=file
audit(1296062676.963:17): avc:  denied  { read } for  pid=682 comm="nscd" name="group.db" dev=dm-0 ino=1248439 scontext=root:system_r:nscd_t tcontext=system_u:object_r:var_t tclass=file


I have a version of the harness which ignores TESTOUT.log errors, so its only real errors left.

Thx, that test is old. I'll fix the test to edit the config file in-place. But, how can a bad context on a config file cause selinux failure on nscd reading the legitimate files? (passwd/group.db is where nscd looks for names when configured to db)

Maybe I was looking at the wrong bit of code...

something must have created these files with the wrong context..

[root@hp-bl685cg6-01 db]# pwd
/var/db
[root@hp-bl685cg6-01 db]# ls -lZ
-rw-r--r--  root     root     system_u:object_r:var_t          group.db
-rw-r--r--  root     root     system_u:object_r:var_t          Makefile
drwxr-xr-x  root     root     system_u:object_r:nscd_var_run_t nscd
-rw-r--r--  root     root     system_u:object_r:var_t          passwd.db
-rw-r--r--  root     root     system_u:object_r:var_t          protocols.db
-rw-r--r--  root     root     system_u:object_r:var_t          rpc.db
-rw-r--r--  root     root     system_u:object_r:var_t          services.db
-rw-------  root     root     system_u:object_r:var_t          shadow.db
[root@hp-bl685cg6-01 db]# ls -lZ nscd/
-rw-------  root     root     root:object_r:nscd_var_run_t     group
-rw-------  root     root     root:object_r:nscd_var_run_t     hosts
-rw-------  root     root     root:object_r:nscd_var_run_t     passwd

The .db files are created by the Makefile in the directory. The test indeed does this, and it is the part of the tested functionality.

switch_db(){
  rlLog "Switching database $1 to $2"
  tmpf=`mktemp`
  cat /etc/nsswitch.conf | sed -e "s/^$1:.*/$1: $2/g" > $tmpf
  mv $tmpf /etc/nsswitch.conf
  rlAssertGrep "^$1: $2" "/etc/nsswitch.conf"
}

should be

switch_db(){
  rlLog "Switching database $1 to $2"
  sed -i -e "s/^$1:.*/$1: $2/g" /etc/nsswitch.conf
  rlAssertGrep "^$1: $2" "/etc/nsswitch.conf"
}


The code that makes the DB needs to run a restorecon on /var/db

Will fix the test, thanks for the hints.

Marian,

Does this look like it would work?

commit 367886df1d681b6112085ea7075a62f8895cfb29
Author: Bill Peck <bpeck>
Date:   Wed Jan 26 11:14:33 2011 -0500

    Avoid reporting selinux errors on the harness itself.

diff --git a/bin/rhts-db-submit-result b/bin/rhts-db-submit-result
index 8014909..cd82655 100755
--- a/bin/rhts-db-submit-result
+++ b/bin/rhts-db-submit-result
@@ -338,6 +338,8 @@ class AuContext(object):
             str = "/bin/grep 'avc: ' %s" % (log_file,)
         else:
             str = "/bin/grep 'avc: ' %s | /bin/grep --invert-match granted" % (log_file,)
+        # Don't report on TESTOUT.log errors
+        str = "%s | /bin/grep --invert-match TESTOUT.log" % (str)
         self.append_message(str)
         (ret_val, data) = commands.getstatusoutput(str)
         data_l = data.split("\n")

Beaker 0.6.4 has been released.