Uploaded image for project: 'JBoss Web Server'
  1. JBoss Web Server
  2. JWS-808

tomcat fails to start via tomcat-jsvc service startup due to selinux denials

    XMLWordPrintable

Details

    Description

      +++ This bug was initially created as a clone of Bug #1470735 +++
      Description of problem:
      There are present AVC denials during start of tomcat*-jsvc service startup:

      type=SERVICE_START msg=audit(1503497295.901:177): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=tomcat8-jsvc comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=AVC msg=audit(1503497295.924:178): avc:  denied  { setuid } for  pid=3735 comm="jsvc" capability=7  scontext=system_u:system_r:tomcat8_t:s0 tcontext=system_u:system_r:tomcat8_t:s0 tclass=capability
type=SYSCALL msg=audit(1503497295.924:178): arch=c000003e syscall=105 success=yes exit=0 a0=5b a1=5b a2=1 a3=7f6e48a8f300 items=0 ppid=3721 pid=3735 auid=4294967295 uid=91 gid=91 euid=91 suid=91 fsuid=91 egid=91 sgid=91 fsgid=91 tty=(none) ses=4294967295 comm="jsvc" exe="/usr/bin/jsvc" subj=system_u:system_r:tomcat8_t:s0 key=(null)
type=PROCTITLE msg=audit(1503497295.924:178): proctitle=2F7573722F62696E2F6A737663002D6E6F646574616368002D70696466696C65002F7661722F72756E2F6A7376632D746F6D6361742E706964002D7573657200746F6D636174002D6F757466696C65002F7573722F73686172652F746F6D636174382F6C6F67732F636174616C696E612E6F7574002D65727266696C65002F75
type=AVC msg=audit(1503497295.925:179): avc:  denied  { dac_override } for  pid=3721 comm="jsvc" capability=1  scontext=system_u:system_r:tomcat8_t:s0 tcontext=system_u:system_r:tomcat8_t:s0 tclass=capability
type=SYSCALL msg=audit(1503497295.925:179): arch=c000003e syscall=2 success=yes exit=5 a0=e0a280 a1=441 a2=1b6 a3=24 items=0 ppid=1 pid=3721 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="jsvc" exe="/usr/bin/jsvc" subj=system_u:system_r:tomcat8_t:s0 key=(null)
type=PROCTITLE msg=audit(1503497295.925:179): proctitle=6A7376632E65786563002D6E6F646574616368002D70696466696C65002F7661722F72756E2F6A7376632D746F6D6361742E706964002D7573657200746F6D636174002D6F757466696C65002F7573722F73686172652F746F6D636174382F6C6F67732F636174616C696E612E6F7574002D65727266696C65002F7573722F73
type=AVC msg=audit(1503497295.925:180): avc:  denied  { setcap } for  pid=3737 comm="jsvc" scontext=system_u:system_r:tomcat8_t:s0 tcontext=system_u:system_r:tomcat8_t:s0 tclass=process
type=SYSCALL msg=audit(1503497295.925:180): arch=c000003e syscall=126 success=yes exit=0 a0=7ffcdfaaabf0 a1=7ffcdfaaac00 a2=7ff5ca3e3087 a3=1 items=0 ppid=3721 pid=3737 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="jsvc" exe="/usr/bin/jsvc" subj=system_u:system_r:tomcat8_t:s0 key=(null)
type=PROCTITLE msg=audit(1503497295.925:180): proctitle=6A7376632E65786563002D6E6F646574616368002D70696466696C65002F7661722F72756E2F6A7376632D746F6D6361742E706964002D7573657200746F6D636174002D6F757466696C65002F7573722F73686172652F746F6D636174382F6C6F67732F636174616C696E612E6F7574002D65727266696C65002F7573722F73
type=SERVICE_STOP msg=audit(1503497330.768:181): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=tomcat8-jsvc comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
type=SERVICE_START msg=audit(1503497336.769:182): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=tomcat8-jsvc comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'

      Version-Release number of selected component (if applicable):
      tomcat8-8.0.36-24.ep7.el7.noarch

      Steps to Reproduce:
      1. yum install tomcat*-jsvc
      2. service tomcat*-jsvc start
      3. pgrep -l -f tomcat
      service should works

      Actual results:
      service start, but with errors due to AVC denials

      Expected results:
      service starts and there are no AVC denials

      Attachments

        Issue Links

          is caused by

          Bug - A problem that impairs or prevents the functions of the product. JWS-695 tomcat7_t and tomcat8_t domains are in unconfined_domain

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Closed
          links to

          Web Link RH BZ 1470735

          Activity

            People

              rhn-support-csutherl Coty Sutherland
              rhn-support-csutherl Coty Sutherland
              Jan Onderka Jan Onderka
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: