RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 858784 - pulse fails to start IPVS sync daemon
Summary: pulse fails to start IPVS sync daemon
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy
Version: 6.4
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Miroslav Grepl
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks: 859338
TreeView+ depends on / blocked
 
Reported: 2012-09-19 16:55 UTC by Ryan O'Hara
Modified: 2013-02-21 08:30 UTC (History)
3 users (show)

Fixed In Version: selinux-policy-3.7.19-168.el6
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 859338 (view as bug list)
Environment:
Last Closed: 2013-02-21 08:30:37 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
AVC denials from pulse when attempting to fork/exec ipvsadm. (1.73 KB, text/plain)
2012-09-19 16:55 UTC, Ryan O'Hara 		no flags Details
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2013:0314 0 normal SHIPPED_LIVE selinux-policy bug fix and enhancement update 2013-02-20 20:35:01 UTC

Description Ryan O'Hara 2012-09-19 16:55:52 UTC 
Created attachment 614473 [details]
AVC denials from pulse when attempting to fork/exec ipvsadm.

When selinux is enforcing, pulse fails to start the IPVS sync daemon at startup. If selinux is disabled to set to permissive mode, the sync daemon is started by pulse as expected.

# rpm -q selinux-policy
selinux-policy-3.7.19-154.el6.noarch

1. Chec that selinux is in enforcing mode:
# getenforce 
Enforcing

2. Check that sync daemon is enabled:
# grep sync /etc/sysconfig/ha/lvs.cf
syncdaemon = 1

3. Start pulse:
# service pulse start
Starting pulse:                                            [  OK  ]

4. Check if sync daemon is running:
# ipvsadm --list --daemon

We expect to see this command print "master sync daemon (mcast=eth0, syncid=0)". If the sync daemon is enabled (syncdaemon = 1), pulse will fork and exec the ipvsadm command to start the sync daemon. Looking at the audit.log shows some AVC denials (see attachment). If set selinux to premissive mode and repeat the test, the sync daemon is started as expected.

# setenforce 0
# getenforce 
Permissive

# service pulse start
Starting pulse:                                            [  OK  ]

# ipvsadm --list --daemon
master sync daemon (mcast=eth0, syncid=0)
Comment 2 Daniel Walsh 2012-09-20 00:13:30 UTC 
Looks like pulse can start all initrc domains in F18.
Comment 3 Miroslav Grepl 2012-09-20 06:59:57 UTC 
Yes and I added it also to RHEL6.4.
Comment 4 Milos Malik 2012-09-21 07:48:55 UTC 
Following AVCs appear in permissive mode:
----
type=PATH msg=audit(09/21/2012 09:25:11.167:47267) : item=1 name=(null) inode=21292 dev=08:03 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:ld_so_t:s0 
type=PATH msg=audit(09/21/2012 09:25:11.167:47267) : item=0 name=/sbin/ipvsadm inode=176213 dev=08:03 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:iptables_exec_t:s0 
type=CWD msg=audit(09/21/2012 09:25:11.167:47267) :  cwd=/ 
type=EXECVE msg=audit(09/21/2012 09:25:11.167:47267) : argc=3 a0=/sbin/ipvsadm a1=--stop-daemon a2=backup 
type=SYSCALL msg=audit(09/21/2012 09:25:11.167:47267) : arch=i386 syscall=execve success=yes exit=0 a0=8508008 a1=bf831308 a2=bf831c0c a3=40000003 items=2 ppid=8396 pid=8398 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=21 comm=ipvsadm exe=/sbin/ipvsadm subj=unconfined_u:system_r:piranha_pulse_t:s0 key=(null) 
type=AVC msg=audit(09/21/2012 09:25:11.167:47267) : avc:  denied  { execute_no_trans } for  pid=8398 comm=pulse path=/sbin/ipvsadm dev=sda3 ino=176213 scontext=unconfined_u:system_r:piranha_pulse_t:s0 tcontext=system_u:object_r:iptables_exec_t:s0 tclass=file 
type=AVC msg=audit(09/21/2012 09:25:11.167:47267) : avc:  denied  { read open } for  pid=8398 comm=pulse name=ipvsadm dev=sda3 ino=176213 scontext=unconfined_u:system_r:piranha_pulse_t:s0 tcontext=system_u:object_r:iptables_exec_t:s0 tclass=file 
type=AVC msg=audit(09/21/2012 09:25:11.167:47267) : avc:  denied  { execute } for  pid=8398 comm=pulse name=ipvsadm dev=sda3 ino=176213 scontext=unconfined_u:system_r:piranha_pulse_t:s0 tcontext=system_u:object_r:iptables_exec_t:s0 tclass=file 
----
type=SOCKETCALL msg=audit(09/21/2012 09:25:11.185:47268) : nargs=3 a0=10 a1=3 a2=10 
type=SYSCALL msg=audit(09/21/2012 09:25:11.185:47268) : arch=i386 syscall=socketcall(socket) success=yes exit=3 a0=1 a1=bfededf0 a2=6f87314 a3=86f31e0 items=0 ppid=8396 pid=8398 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=21 comm=ipvsadm exe=/sbin/ipvsadm subj=unconfined_u:system_r:piranha_pulse_t:s0 key=(null) 
type=AVC msg=audit(09/21/2012 09:25:11.185:47268) : avc:  denied  { create } for  pid=8398 comm=ipvsadm scontext=unconfined_u:system_r:piranha_pulse_t:s0 tcontext=unconfined_u:system_r:piranha_pulse_t:s0 tclass=netlink_socket 
----
type=SOCKETCALL msg=audit(09/21/2012 09:25:11.191:47269) : nargs=5 a0=3 a1=1 a2=7 a3=bfededf8 a4=4 
type=SYSCALL msg=audit(09/21/2012 09:25:11.191:47269) : arch=i386 syscall=socketcall(setsockopt) success=yes exit=0 a0=e a1=bfededc0 a2=6f87314 a3=86f31e0 items=0 ppid=8396 pid=8398 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=21 comm=ipvsadm exe=/sbin/ipvsadm subj=unconfined_u:system_r:piranha_pulse_t:s0 key=(null) 
type=AVC msg=audit(09/21/2012 09:25:11.191:47269) : avc:  denied  { setopt } for  pid=8398 comm=ipvsadm scontext=unconfined_u:system_r:piranha_pulse_t:s0 tcontext=unconfined_u:system_r:piranha_pulse_t:s0 tclass=netlink_socket 
----
type=SOCKADDR msg=audit(09/21/2012 09:25:11.192:47270) : saddr=netlink pid:8398 
type=SOCKETCALL msg=audit(09/21/2012 09:25:11.192:47270) : nargs=3 a0=3 a1=86f31e0 a2=c 
type=SYSCALL msg=audit(09/21/2012 09:25:11.192:47270) : arch=i386 syscall=socketcall(bind) success=yes exit=0 a0=2 a1=bfededf0 a2=6f87314 a3=86f31e0 items=0 ppid=8396 pid=8398 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=21 comm=ipvsadm exe=/sbin/ipvsadm subj=unconfined_u:system_r:piranha_pulse_t:s0 key=(null) 
type=AVC msg=audit(09/21/2012 09:25:11.192:47270) : avc:  denied  { bind } for  pid=8398 comm=ipvsadm scontext=unconfined_u:system_r:piranha_pulse_t:s0 tcontext=unconfined_u:system_r:piranha_pulse_t:s0 tclass=netlink_socket 
----
type=SOCKADDR msg=audit(09/21/2012 09:25:11.192:47271) : saddr=netlink pid:8398 
type=SOCKETCALL msg=audit(09/21/2012 09:25:11.192:47271) : nargs=3 a0=3 a1=86f31e0 a2=bfedee1c 
type=SYSCALL msg=audit(09/21/2012 09:25:11.192:47271) : arch=i386 syscall=socketcall(getsockname) success=yes exit=0 a0=6 a1=bfededf0 a2=6f87314 a3=86f31e0 items=0 ppid=8396 pid=8398 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=21 comm=ipvsadm exe=/sbin/ipvsadm subj=unconfined_u:system_r:piranha_pulse_t:s0 key=(null) 
type=AVC msg=audit(09/21/2012 09:25:11.192:47271) : avc:  denied  { getattr } for  pid=8398 comm=ipvsadm scontext=unconfined_u:system_r:piranha_pulse_t:s0 tcontext=unconfined_u:system_r:piranha_pulse_t:s0 tclass=netlink_socket 
----
Comment 5 Miroslav Grepl 2012-09-21 08:43:16 UTC 
Milos,
could you test this local policy


# cat mypol.te
policy_module(mypol, 1.0)

require{
 attribute initrc_domain;
}

typeattribute piranha_pulse_t initrc_domain;
Comment 6 Milos Malik 2012-09-21 09:27:30 UTC 
Did not help. I still see those AVCs.
Comment 7 Miroslav Grepl 2012-09-21 09:37:41 UTC 
Exactly the same? I mean AVC related to iptables should go away.
Comment 8 Milos Malik 2012-09-21 09:51:52 UTC 
The list of AVCs caught in permissive mode is the same as before.
Comment 9 Miroslav Grepl 2012-09-21 12:31:57 UTC 
Ah, I see it now. I need to add initrc_domain attribute also to init_system_domain.
Comment 10 Miroslav Grepl 2012-09-21 12:38:00 UTC 
Could you test it with


iptables_domtrans()

in a local policy?
Comment 11 Milos Malik 2012-09-21 14:36:14 UTC 
When following policy module is enabled then no AVCs appear.

policy_module(mypol, 1.0)

require{
  type piranha_pulse_t;
}

iptables_domtrans(piranha_pulse_t)
Comment 14 errata-xmlrpc 2013-02-21 08:30:37 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-0314.html
Note You need to log in before you can comment on or make changes to this bug.