Bug 858784 - pulse fails to start IPVS sync daemon
pulse fails to start IPVS sync daemon
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy (Show other bugs)
6.4
All Linux
medium Severity medium
: rc
: ---
Assigned To: Miroslav Grepl
Milos Malik
:
Depends On:
Blocks: 859338
  Show dependency treegraph
 
Reported: 2012-09-19 12:55 EDT by Ryan O'Hara
Modified: 2013-02-21 03:30 EST (History)
3 users (show)

See Also:
Fixed In Version: selinux-policy-3.7.19-168.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 859338 (view as bug list)
Environment:
Last Closed: 2013-02-21 03:30:37 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
AVC denials from pulse when attempting to fork/exec ipvsadm. (1.73 KB, text/plain)
2012-09-19 12:55 EDT, Ryan O'Hara
no flags Details

  None (edit)
Description Ryan O'Hara 2012-09-19 12:55:52 EDT
Created attachment 614473 [details]
AVC denials from pulse when attempting to fork/exec ipvsadm.

When selinux is enforcing, pulse fails to start the IPVS sync daemon at startup. If selinux is disabled to set to permissive mode, the sync daemon is started by pulse as expected.

# rpm -q selinux-policy
selinux-policy-3.7.19-154.el6.noarch

1. Chec that selinux is in enforcing mode:
# getenforce 
Enforcing

2. Check that sync daemon is enabled:
# grep sync /etc/sysconfig/ha/lvs.cf
syncdaemon = 1

3. Start pulse:
# service pulse start
Starting pulse:                                            [  OK  ]

4. Check if sync daemon is running:
# ipvsadm --list --daemon

We expect to see this command print "master sync daemon (mcast=eth0, syncid=0)". If the sync daemon is enabled (syncdaemon = 1), pulse will fork and exec the ipvsadm command to start the sync daemon. Looking at the audit.log shows some AVC denials (see attachment). If set selinux to premissive mode and repeat the test, the sync daemon is started as expected.

# setenforce 0
# getenforce 
Permissive

# service pulse start
Starting pulse:                                            [  OK  ]

# ipvsadm --list --daemon
master sync daemon (mcast=eth0, syncid=0)
Comment 2 Daniel Walsh 2012-09-19 20:13:30 EDT
Looks like pulse can start all initrc domains in F18.
Comment 3 Miroslav Grepl 2012-09-20 02:59:57 EDT
Yes and I added it also to RHEL6.4.
Comment 4 Milos Malik 2012-09-21 03:48:55 EDT
Following AVCs appear in permissive mode:
----
type=PATH msg=audit(09/21/2012 09:25:11.167:47267) : item=1 name=(null) inode=21292 dev=08:03 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:ld_so_t:s0 
type=PATH msg=audit(09/21/2012 09:25:11.167:47267) : item=0 name=/sbin/ipvsadm inode=176213 dev=08:03 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:iptables_exec_t:s0 
type=CWD msg=audit(09/21/2012 09:25:11.167:47267) :  cwd=/ 
type=EXECVE msg=audit(09/21/2012 09:25:11.167:47267) : argc=3 a0=/sbin/ipvsadm a1=--stop-daemon a2=backup 
type=SYSCALL msg=audit(09/21/2012 09:25:11.167:47267) : arch=i386 syscall=execve success=yes exit=0 a0=8508008 a1=bf831308 a2=bf831c0c a3=40000003 items=2 ppid=8396 pid=8398 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=21 comm=ipvsadm exe=/sbin/ipvsadm subj=unconfined_u:system_r:piranha_pulse_t:s0 key=(null) 
type=AVC msg=audit(09/21/2012 09:25:11.167:47267) : avc:  denied  { execute_no_trans } for  pid=8398 comm=pulse path=/sbin/ipvsadm dev=sda3 ino=176213 scontext=unconfined_u:system_r:piranha_pulse_t:s0 tcontext=system_u:object_r:iptables_exec_t:s0 tclass=file 
type=AVC msg=audit(09/21/2012 09:25:11.167:47267) : avc:  denied  { read open } for  pid=8398 comm=pulse name=ipvsadm dev=sda3 ino=176213 scontext=unconfined_u:system_r:piranha_pulse_t:s0 tcontext=system_u:object_r:iptables_exec_t:s0 tclass=file 
type=AVC msg=audit(09/21/2012 09:25:11.167:47267) : avc:  denied  { execute } for  pid=8398 comm=pulse name=ipvsadm dev=sda3 ino=176213 scontext=unconfined_u:system_r:piranha_pulse_t:s0 tcontext=system_u:object_r:iptables_exec_t:s0 tclass=file 
----
type=SOCKETCALL msg=audit(09/21/2012 09:25:11.185:47268) : nargs=3 a0=10 a1=3 a2=10 
type=SYSCALL msg=audit(09/21/2012 09:25:11.185:47268) : arch=i386 syscall=socketcall(socket) success=yes exit=3 a0=1 a1=bfededf0 a2=6f87314 a3=86f31e0 items=0 ppid=8396 pid=8398 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=21 comm=ipvsadm exe=/sbin/ipvsadm subj=unconfined_u:system_r:piranha_pulse_t:s0 key=(null) 
type=AVC msg=audit(09/21/2012 09:25:11.185:47268) : avc:  denied  { create } for  pid=8398 comm=ipvsadm scontext=unconfined_u:system_r:piranha_pulse_t:s0 tcontext=unconfined_u:system_r:piranha_pulse_t:s0 tclass=netlink_socket 
----
type=SOCKETCALL msg=audit(09/21/2012 09:25:11.191:47269) : nargs=5 a0=3 a1=1 a2=7 a3=bfededf8 a4=4 
type=SYSCALL msg=audit(09/21/2012 09:25:11.191:47269) : arch=i386 syscall=socketcall(setsockopt) success=yes exit=0 a0=e a1=bfededc0 a2=6f87314 a3=86f31e0 items=0 ppid=8396 pid=8398 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=21 comm=ipvsadm exe=/sbin/ipvsadm subj=unconfined_u:system_r:piranha_pulse_t:s0 key=(null) 
type=AVC msg=audit(09/21/2012 09:25:11.191:47269) : avc:  denied  { setopt } for  pid=8398 comm=ipvsadm scontext=unconfined_u:system_r:piranha_pulse_t:s0 tcontext=unconfined_u:system_r:piranha_pulse_t:s0 tclass=netlink_socket 
----
type=SOCKADDR msg=audit(09/21/2012 09:25:11.192:47270) : saddr=netlink pid:8398 
type=SOCKETCALL msg=audit(09/21/2012 09:25:11.192:47270) : nargs=3 a0=3 a1=86f31e0 a2=c 
type=SYSCALL msg=audit(09/21/2012 09:25:11.192:47270) : arch=i386 syscall=socketcall(bind) success=yes exit=0 a0=2 a1=bfededf0 a2=6f87314 a3=86f31e0 items=0 ppid=8396 pid=8398 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=21 comm=ipvsadm exe=/sbin/ipvsadm subj=unconfined_u:system_r:piranha_pulse_t:s0 key=(null) 
type=AVC msg=audit(09/21/2012 09:25:11.192:47270) : avc:  denied  { bind } for  pid=8398 comm=ipvsadm scontext=unconfined_u:system_r:piranha_pulse_t:s0 tcontext=unconfined_u:system_r:piranha_pulse_t:s0 tclass=netlink_socket 
----
type=SOCKADDR msg=audit(09/21/2012 09:25:11.192:47271) : saddr=netlink pid:8398 
type=SOCKETCALL msg=audit(09/21/2012 09:25:11.192:47271) : nargs=3 a0=3 a1=86f31e0 a2=bfedee1c 
type=SYSCALL msg=audit(09/21/2012 09:25:11.192:47271) : arch=i386 syscall=socketcall(getsockname) success=yes exit=0 a0=6 a1=bfededf0 a2=6f87314 a3=86f31e0 items=0 ppid=8396 pid=8398 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=21 comm=ipvsadm exe=/sbin/ipvsadm subj=unconfined_u:system_r:piranha_pulse_t:s0 key=(null) 
type=AVC msg=audit(09/21/2012 09:25:11.192:47271) : avc:  denied  { getattr } for  pid=8398 comm=ipvsadm scontext=unconfined_u:system_r:piranha_pulse_t:s0 tcontext=unconfined_u:system_r:piranha_pulse_t:s0 tclass=netlink_socket 
----
Comment 5 Miroslav Grepl 2012-09-21 04:43:16 EDT
Milos,
could you test this local policy


# cat mypol.te
policy_module(mypol, 1.0)

require{
 attribute initrc_domain;
}

typeattribute piranha_pulse_t initrc_domain;
Comment 6 Milos Malik 2012-09-21 05:27:30 EDT
Did not help. I still see those AVCs.
Comment 7 Miroslav Grepl 2012-09-21 05:37:41 EDT
Exactly the same? I mean AVC related to iptables should go away.
Comment 8 Milos Malik 2012-09-21 05:51:52 EDT
The list of AVCs caught in permissive mode is the same as before.
Comment 9 Miroslav Grepl 2012-09-21 08:31:57 EDT
Ah, I see it now. I need to add initrc_domain attribute also to init_system_domain.
Comment 10 Miroslav Grepl 2012-09-21 08:38:00 EDT
Could you test it with


iptables_domtrans()

in a local policy?
Comment 11 Milos Malik 2012-09-21 10:36:14 EDT
When following policy module is enabled then no AVCs appear.

policy_module(mypol, 1.0)

require{
  type piranha_pulse_t;
}

iptables_domtrans(piranha_pulse_t)
Comment 14 errata-xmlrpc 2013-02-21 03:30:37 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-0314.html

Note You need to log in before you can comment on or make changes to this bug.