Red Hat Bugzilla – Bug 912709
When create jenkins app, there will be some AVC message in audit.log
Last modified: 2017-03-08 12:35 EST
Description of problem: Create a jenkins app, see the log in /var/log/audit/audit.log on node. Version-Release number of selected component (if applicable): http://buildvm-devops.usersys.redhat.com/puddle/build/OpenShiftEnterprise/1.1.z/2013-02-18.3 How reproducible: always Steps to Reproduce: 1.Create a jenkins app rhc app create jenkins jenkins 2. On node: tailf /var/log/audit/audit.log | grep java Actual results: [root@node1 ~]# tailf /var/log/audit/audit.log | grep java type=AVC msg=audit(1361280256.039:65402152): avc: denied { name_bind } for pid=25490 comm="java" src=5353 scontext=system_u:system_r:openshift_t:s0:c0,c507 tcontext=system_u:object_r:howl_port_t:s0 tclass=udp_socket type=SYSCALL msg=audit(1361280256.039:65402152): arch=c000003e syscall=49 success=no exit=-13 a0=83 a1=7f6e7719e1e0 a2=10 a3=268 items=0 ppid=1 pid=25490 auid=4294967295 uid=507 gid=507 euid=507 suid=507 fsuid=507 egid=507 sgid=507 fsgid=507 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/jre/bin/java" subj=system_u:system_r:openshift_t:s0:c0,c507 key=(null) Expected results: No such info Additional info:
Does this denial actually cause a breakage from the user's perspective?
I only created jenkins app and access the app. No other things. But now, it doesn't exist. Don't know why.
OK, we'll leave this at low severity but plan on fixing it with the next minor release.
I believe updated selinux-policy may have addressed this at least for OSE 1.2. Can you please test?
Test jenkins application on 1.2 RC2 puddle: http://download.lab.bos.redhat.com/rel-eng/OpenShiftEnterprise/1.2/2013-06-26.3/ selinux-policy-targeted-3.7.19-195.el6_4.10.noarch selinux-policy-3.7.19-195.el6_4.10.noarch During the jenkins app creation and embedding process, there would not be any AVC denied message shown out, so this bug could be verified. But in the end of jenkins build, it would generate avc denial in audit.log, not sure whether it has any relationship with this bug, or it's another new bug. Here's the reproduce step: 1. Create a php app and jenkins app, embed jenkins-client to php app 2. Make some changes in the php app git repo to trigger jenkins build 3. Monitoring the audit.log on the node, avc denial would be generated once the build action completed as "SUCCESS" [root@node1 ~]# tailf /var/log/audit/audit.log |grep avc type=AVC msg=audit(1372654405.272:100925): avc: denied { getattr } for pid=29079 comm="java" path="/proc/mtrr" dev=proc ino=4026531957 scontext=unconfined_u:system_r:openshift_t:s0:c1,c382 tcontext=system_u:object_r:mtrr_device_t:s0 tclass=file
Move this bug to VERIVIED due to the related issue has been resolved. About the new issue mentioned in Comment 6, do you think it is necessary to file a new bug to trace that? Thanks!
I vote we track the issue in Comment #6 as a new bug against 1.2.1.
A new bug was filed to track the new issue: https://bugzilla.redhat.com/show_bug.cgi?id=980353 Thanks
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHEA-2013-1032.html