Bug 813738 - rhsmcertd_t cannot read passwd file and search in /var/run
rhsmcertd_t cannot read passwd file and search in /var/run
Status: CLOSED DUPLICATE of bug 822402
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy (Show other bugs)
7.0
All Linux
unspecified Severity unspecified
: rc
: ---
Assigned To: Daniel Walsh
Milos Malik
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-04-18 06:48 EDT by Matěj Cepl
Modified: 2013-01-29 04:44 EST (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-05-11 10:27:46 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Matěj Cepl 2012-04-18 06:48:34 EDT
Description of problem:
wycliff:qemu# ausearch -m AVC -ts today
----
time->Wed Apr 18 03:15:31 2012
type=SYSCALL msg=audit(1334711731.354:238): arch=c000003e syscall=2 success=no exit=-13 a0=7fd9837646ca a1=80000 a2=1b6 a3=238 items=0 ppid=719 pid=3850 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="rhsmcertd-worke" exe="/usr/bin/python" subj=system_u:system_r:rhsmcertd_t:s0 key=(null)
type=AVC msg=audit(1334711731.354:238): avc:  denied  { read } for  pid=3850 comm="rhsmcertd-worke" name="passwd" dev="dm-0" ino=799192 scontext=system_u:system_r:rhsmcertd_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file
----
time->Wed Apr 18 03:15:31 2012
type=SYSCALL msg=audit(1334711731.357:239): arch=c000003e syscall=2 success=no exit=-13 a0=4013df a1=241 a2=1b6 a3=238 items=0 ppid=1 pid=719 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="rhsmcertd" exe="/usr/bin/rhsmcertd" subj=system_u:system_r:rhsmcertd_t:s0 key=(null)
type=AVC msg=audit(1334711731.357:239): avc:  denied  { search } for  pid=719 comm="rhsmcertd" name="rhsm" dev="tmpfs" ino=24344 scontext=system_u:system_r:rhsmcertd_t:s0 tcontext=unconfined_u:object_r:rpm_var_run_t:s0 tclass=dir
----
time->Wed Apr 18 07:15:31 2012
type=SYSCALL msg=audit(1334726131.474:269): arch=c000003e syscall=2 success=no exit=-13 a0=7f8a420fa6ca a1=80000 a2=1b6 a3=238 items=0 ppid=719 pid=29596 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="rhsmcertd-worke" exe="/usr/bin/python" subj=system_u:system_r:rhsmcertd_t:s0 key=(null)
type=AVC msg=audit(1334726131.474:269): avc:  denied  { read } for  pid=29596 comm="rhsmcertd-worke" name="passwd" dev="dm-0" ino=799192 scontext=system_u:system_r:rhsmcertd_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file
----
time->Wed Apr 18 11:15:31 2012
type=SYSCALL msg=audit(1334740531.398:442): arch=c000003e syscall=2 success=no exit=-13 a0=7f1174f4e6ca a1=80000 a2=1b6 a3=238 items=0 ppid=719 pid=2943 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="rhsmcertd-worke" exe="/usr/bin/python" subj=system_u:system_r:rhsmcertd_t:s0 key=(null)
type=AVC msg=audit(1334740531.398:442): avc:  denied  { read } for  pid=2943 comm="rhsmcertd-worke" name="passwd" dev="dm-0" ino=799192 scontext=system_u:system_r:rhsmcertd_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file
wycliff:qemu# 

and

wycliff:~# ausearch -m AVC -ts today|audit2allow


#============= rhsmcertd_t ==============
allow rhsmcertd_t passwd_file_t:file read;
allow rhsmcertd_t rpm_var_run_t:dir search;
wycliff:~# 


Version-Release number of selected component (if applicable):
selinux-policy-3.10.0-114.el7.noarch

How reproducible:
happened today

Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:
Comment 1 Miroslav Grepl 2012-04-18 08:03:06 EDT
I need to rebuild RHEL7 with the latest F17 patch.
Comment 2 Daniel Walsh 2012-04-20 10:32:17 EDT
Just mark this as fixed in selinux-policy-3.10.0-116.el7

Which they should pull in the next merge.
Comment 3 Jan Ščotka 2012-05-11 08:23:00 EDT
Hi,
we found same (similar problem with RHEL7 0508 build

700 tasks job finished without abort.
https://beaker.engineering.redhat.com/jobs/230447

only very strange behaviur is, that the test what does nothing
2-times (per 700 same task) failed :-)
due to some AVC


Info: Searching AVC errors produced since 1336687858.21 (Thu May 10 18:10:58
2012)
Searching logs...
Running '/usr/bin/env LC_ALL=en_US.UTF-8 /sbin/ausearch -m AVC -m USER_AVC -m
SELINUX_ERR -ts 05/10/2012 18:10:58 < /dev/null
>/mnt/testarea/tmp.rhts-db-submit-result.BLFDDQ 2>&1'
----
time->Thu May 10 18:11:32 2012
type=SYSCALL msg=audit(1336687892.905:463): arch=c000003e syscall=4 success=no
exit=-13 a0=fa0ce0 a1=7fffb39aac20 a2=7fffb39aac20 a3=20 items=0 ppid=828
pid=15135 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=(none) ses=4294967295 comm="rhsmcertd-worke"
exe="/usr/bin/python2.7" subj=system_u:system_r:rhsmcertd_t:s0 key=(null)
type=AVC msg=audit(1336687892.905:463): avc:  denied  { getattr } for 
pid=15135 comm="rhsmcertd-worke" path="/run/rhsm" dev="tmpfs" ino=17203
scontext=system_u:system_r:rhsmcertd_t:s0
tcontext=system_u:object_r:rpm_var_run_t:s0 tclass=dir
Comment 4 Miroslav Grepl 2012-05-11 08:54:51 EDT
you are saying the /run/rhsm is labeled as rpm_var_run_t?

ls -dZ /run/rhsm
Comment 5 Matěj Cepl 2012-05-11 09:49:32 EDT
wycliff:piglit (master) $ ls -ldZ /run/rhsm/
drwxr-xr-x. root root system_u:object_r:var_run_t:s0   /run/rhsm/
wycliff:piglit (master) $ rpm -q selinux-policy
selinux-policy-3.10.0-114.el7.noarch
wycliff:piglit (master) $
Comment 6 Miroslav Grepl 2012-05-11 10:27:46 EDT
Should be fixed in the latest F17 policy which will be added to RHEL7.
Comment 7 Miroslav Grepl 2012-05-17 08:23:36 EDT

*** This bug has been marked as a duplicate of bug 822402 ***

Note You need to log in before you can comment on or make changes to this bug.