Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1517656 - PCP SELinux AVCs
Summary: PCP SELinux AVCs
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: pcp
Version: 7.4
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Lukas Berk
QA Contact: Michal Kolar
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-11-27 08:11 UTC by Marko Myllynen
Modified: 2018-04-10 17:08 UTC (History)
8 users (show)

Fixed In Version: pcp-3.12.2-5.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-04-10 17:08:10 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:0926 None None None 2018-04-10 17:08:32 UTC

Description Marko Myllynen 2017-11-27 08:11:56 UTC
Description of problem:
root@mars:/var/log/audit# grep denied audit.log
type=AVC msg=audit(1511770140.085:443): avc:  denied  { read } for  pid=21132 comm="python2" name="libvirt.conf" dev="dm-0" ino=538359106 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:virt_etc_t:s0 tclass=file
type=AVC msg=audit(1511770140.085:443): avc:  denied  { open } for  pid=21132 comm="python2" path="/etc/libvirt/libvirt.conf" dev="dm-0" ino=538359106 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:virt_etc_t:s0 tclass=file
type=AVC msg=audit(1511770140.085:444): avc:  denied  { connectto } for  pid=21132 comm="python2" path="/run/libvirt/libvirt-sock-ro" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:virtd_t:s0-s0:c0.c1023 tclass=unix_stream_socket
type=AVC msg=audit(1511770149.183:448): avc:  denied  { read } for  pid=25720 comm="pmie" name="unix" dev="proc" ino=4026532015 scontext=system_u:system_r:pcp_pmie_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file
type=AVC msg=audit(1511770170.277:449): avc:  denied  { ipc_owner } for  pid=21128 comm="pmdalinux" capability=15  scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=capability
type=AVC msg=audit(1511770170.277:449): avc:  denied  { unix_read } for  pid=21128 comm="pmdalinux" key=0  scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=shm
type=AVC msg=audit(1511770170.277:449): avc:  denied  { getattr associate } for  pid=21128 comm="pmdalinux" key=0  scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=shm
type=AVC msg=audit(1511770170.388:450): avc:  denied  { getattr } for  pid=21125 comm="pmdaproc" path="/dev/gpmctl" dev="devtmpfs" ino=15296 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:gpmctl_t:s0 tclass=sock_file
type=AVC msg=audit(1511770170.389:451): avc:  denied  { getattr } for  pid=21125 comm="pmdaproc" path="/run/systemd/initctl/fifo" dev="tmpfs" ino=13225 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:initctl_t:s0 tclass=fifo_file
type=AVC msg=audit(1511770170.390:452): avc:  denied  { getattr } for  pid=21125 comm="pmdaproc" path="/proc/kcore" dev="proc" ino=4026532045 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:proc_kcore_t:s0 tclass=file
type=AVC msg=audit(1511770172.879:453): avc:  denied  { unix_read } for  pid=21128 comm="pmdalinux" key=0  scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=shm
type=AVC msg=audit(1511770172.879:453): avc:  denied  { getattr associate } for  pid=21128 comm="pmdalinux" key=0  scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=shm

Version-Release number of selected component (if applicable):
pcp-3.11.8-7.el7.x86_64
pcp-selinux-3.11.8-7.el7.x86_64
selinux-policy-targeted-3.13.1-166.el7_4.5.noarch

How reproducible:
Always

Steps to Reproduce:
1. setenforce 0
2. systemctl restart pmcd pmlogger pmie
3. pminfo -f

Comment 2 Marko Myllynen 2017-11-27 08:36:48 UTC
type=AVC msg=audit(1511771694.686:575): avc:  denied  { read } for  pid=28833 comm="pmproxy" name="unix" dev="proc" ino=4026532015 scontext=system_u:system_r:pcp_pmproxy_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file

Comment 3 Lukas Berk 2017-11-27 17:26:42 UTC
Fix in my upstream repo, will get merged to upstream master soon.

commit 8dbdae14f11df0e8817a9a532fb3c37fc9a51c6a 
Author: Lukas Berk <lberk@redhat.com>
Date:   Mon Nov 27 11:16:00 2017 -0500

    selinux: RHBZ1517656
    
    Add three type enforcement context allowance lines
    update qa, config bits for conditional context

Comment 4 Marko Myllynen 2017-12-04 15:55:31 UTC
After updating the latest Brew build, running restorecon -R / for a good measure, putting SELinux to Permissive in its configuration file and rebooting, this is what I see after doing pminfo -f as root & non-root:

# rpm -q pcp pcp-selinux
pcp-3.12.2-4.el7.x86_64
pcp-selinux-3.12.2-4.el7.x86_64
# grep denied /var/log/audit/audit.log 
type=AVC msg=audit(1512402750.431:105): avc:  denied  { read } for  pid=2875 comm="pmdalinux" name="pool_threads" dev="nfsd" ino=8 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:nfsd_fs_t:s0 tclass=file
type=AVC msg=audit(1512402750.431:105): avc:  denied  { open } for  pid=2875 comm="pmdalinux" path="/proc/fs/nfsd/pool_threads" dev="nfsd" ino=8 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:nfsd_fs_t:s0 tclass=file
type=AVC msg=audit(1512402750.431:106): avc:  denied  { getattr } for  pid=2875 comm="pmdalinux" path="/proc/fs/nfsd/pool_threads" dev="nfsd" ino=8 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:nfsd_fs_t:s0 tclass=file
type=AVC msg=audit(1512402776.271:118): avc:  denied  { read } for  pid=2875 comm="pmdalinux" name="pool_threads" dev="nfsd" ino=8 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:nfsd_fs_t:s0 tclass=file
type=AVC msg=audit(1512402776.271:118): avc:  denied  { open } for  pid=2875 comm="pmdalinux" path="/proc/fs/nfsd/pool_threads" dev="nfsd" ino=8 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:nfsd_fs_t:s0 tclass=file
type=AVC msg=audit(1512402776.271:119): avc:  denied  { getattr } for  pid=2875 comm="pmdalinux" path="/proc/fs/nfsd/pool_threads" dev="nfsd" ino=8 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:nfsd_fs_t:s0 tclass=file
type=AVC msg=audit(1512402776.272:120): avc:  denied  { ipc_owner } for  pid=2875 comm="pmdalinux" capability=15  scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=capability
type=AVC msg=audit(1512402776.272:120): avc:  denied  { unix_read } for  pid=2875 comm="pmdalinux" key=0  scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=shm
type=AVC msg=audit(1512402776.272:120): avc:  denied  { getattr associate } for  pid=2875 comm="pmdalinux" key=0  scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=shm
type=AVC msg=audit(1512402776.279:121): avc:  denied  { ipc_owner } for  pid=2875 comm="pmdalinux" capability=15  scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=capability
type=AVC msg=audit(1512402776.337:122): avc:  denied  { getattr } for  pid=2868 comm="pmdaproc" path="/dev/gpmctl" dev="devtmpfs" ino=18010 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:gpmctl_t:s0 tclass=sock_file
type=AVC msg=audit(1512402776.337:123): avc:  denied  { getattr } for  pid=2868 comm="pmdaproc" path="/run/systemd/initctl/fifo" dev="tmpfs" ino=10112 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:initctl_t:s0 tclass=fifo_file
type=AVC msg=audit(1512402776.338:124): avc:  denied  { getattr } for  pid=2868 comm="pmdaproc" path="/proc/kcore" dev="proc" ino=4026532045 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:proc_kcore_t:s0 tclass=file
type=AVC msg=audit(1512402776.339:125): avc:  denied  { getattr } for  pid=2868 comm="pmdaproc" path="/proc/kcore" dev="proc" ino=4026532045 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:proc_kcore_t:s0 tclass=file
type=AVC msg=audit(1512402776.379:126): avc:  denied  { getattr } for  pid=2868 comm="pmdaproc" path="/run/systemd/initctl/fifo" dev="tmpfs" ino=10112 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:initctl_t:s0 tclass=fifo_file
type=AVC msg=audit(1512402780.932:127): avc:  denied  { getattr } for  pid=2868 comm="pmdaproc" path="/dev/gpmctl" dev="devtmpfs" ino=18010 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:gpmctl_t:s0 tclass=sock_file
type=AVC msg=audit(1512402813.395:128): avc:  denied  { read } for  pid=2875 comm="pmdalinux" name="pool_threads" dev="nfsd" ino=8 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:nfsd_fs_t:s0 tclass=file
type=AVC msg=audit(1512402813.395:128): avc:  denied  { open } for  pid=2875 comm="pmdalinux" path="/proc/fs/nfsd/pool_threads" dev="nfsd" ino=8 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:nfsd_fs_t:s0 tclass=file
type=AVC msg=audit(1512402813.395:129): avc:  denied  { getattr } for  pid=2875 comm="pmdalinux" path="/proc/fs/nfsd/pool_threads" dev="nfsd" ino=8 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:nfsd_fs_t:s0 tclass=file
#

Comment 5 Marko Myllynen 2018-02-02 09:36:57 UTC
When updating from 3.12.2-4.el7.x86_64 to 3.12.2-5.el7.x86_64 I see:

   5:pcp-selinux-3.12.2-5.el7         ################################# [ 12%]
libsemanage.semanage_pipe_data: Child process /usr/libexec/selinux/hll/pp failed with code: 255. (No such file or directory).
pcpupstream: libsepol.policydb_read: policydb module version 19 does not match my version range 4-17
pcpupstream: libsepol.sepol_module_package_read: invalid module in module package (at section 0)
pcpupstream: Failed to read policy package
libsemanage.semanage_direct_commit: Failed to compile hll files into cil files.
 (No such file or directory).
semodule:  Failed!
warning: %post(pcp-selinux-3.12.2-5.el7.x86_64) scriptlet failed, exit status 1
libsemanage.semanage_pipe_data: Child process /usr/libexec/selinux/hll/pp failed with code: 255. (No such file or directory).
pcpupstream-container: libsepol.policydb_read: policydb module version 19 does not match my version range 4-17
pcpupstream-container: libsepol.sepol_module_package_read: invalid module in module package (at section 0)
pcpupstream-container: Failed to read policy package
libsemanage.semanage_direct_commit: Failed to compile hll files into cil files.
 (No such file or directory).
semodule:  Failed!
warning: %triggerin(pcp-selinux-3.12.2-5.el7.x86_64) scriptlet failed, exit status 1
   6:pcp-conf-3.12.2-5.el7            ################################# [ 14%]

Comment 8 Marko Myllynen 2018-02-08 17:02:02 UTC
After upgrading to the following packages (from latest RHEL 7.4 packages - I haven't bisected what's the minimal set of packages needing to be upgraded) the error shown in comment 5 is gone when running the command on command line (semodule -X 400 -i /var/lib/pcp/selinux/pcpupstream.pp) and all AVCs are also gone. Thanks.

Comment 9 Michal Kolar 2018-02-09 08:48:25 UTC
Reproduced against pcp-3.11.8-7.el7 and verified against pcp-3.12.2-5.el7.

Comment 10 Marko Myllynen 2018-02-14 09:53:56 UTC
(In reply to Marko Myllynen from comment #8)
> After upgrading to the following packages (from latest RHEL 7.4 packages - I
> haven't bisected what's the minimal set of packages needing to be upgraded)
> the error shown in comment 5 is gone when running the command on command
> line (semodule -X 400 -i /var/lib/pcp/selinux/pcpupstream.pp) and all AVCs
> are also gone. Thanks.

And here's the list of packages that I had to upgrade to make the issue shown in comment 5 to disappear:

checkpolicy-2.5-6.el7.x86_64
container-selinux-2.41-1.git126c1c0.el7.noarch
libsemanage-2.5-10.el7.x86_64
libsemanage-python-2.5-10.el7.x86_64
libsepol-2.5-8.1.el7.x86_64
libsepol-devel-2.5-8.1.el7.x86_64
policycoreutils-2.5-22.el7.x86_64
policycoreutils-python-2.5-22.el7.x86_64
selinux-policy-3.13.1-189.el7.noarch
selinux-policy-targeted-3.13.1-189.el7.noarch
setools-console-3.3.8-2.el7.x86_64
setools-libs-3.3.8-2.el7.x86_64

Thanks.

Comment 11 Marko Myllynen 2018-02-22 14:40:54 UTC
(In reply to Marko Myllynen from comment #10)
> (In reply to Marko Myllynen from comment #8)
> > After upgrading to the following packages (from latest RHEL 7.4 packages - I
> > haven't bisected what's the minimal set of packages needing to be upgraded)
> > the error shown in comment 5 is gone when running the command on command
> > line (semodule -X 400 -i /var/lib/pcp/selinux/pcpupstream.pp) and all AVCs
> > are also gone. Thanks.
> 
> And here's the list of packages that I had to upgrade to make the issue
> shown in comment 5 to disappear:
> 
> checkpolicy-2.5-6.el7.x86_64
> container-selinux-2.41-1.git126c1c0.el7.noarch
> libsemanage-2.5-10.el7.x86_64
> libsemanage-python-2.5-10.el7.x86_64
> libsepol-2.5-8.1.el7.x86_64
> libsepol-devel-2.5-8.1.el7.x86_64
> policycoreutils-2.5-22.el7.x86_64
> policycoreutils-python-2.5-22.el7.x86_64
> selinux-policy-3.13.1-189.el7.noarch
> selinux-policy-targeted-3.13.1-189.el7.noarch
> setools-console-3.3.8-2.el7.x86_64
> setools-libs-3.3.8-2.el7.x86_64

I've filed a separate BZ about this:

https://bugzilla.redhat.com/show_bug.cgi?id=1548025

Thanks.

Comment 15 errata-xmlrpc 2018-04-10 17:08:10 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:0926


Note You need to log in before you can comment on or make changes to this bug.