Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-107589

insights-client cannot find core / execute during automatic registration

Linking RHIVOS CVEs to...Migration: Automation ...Sync from "Extern...XMLWordPrintable

    • rhel-security-selinux
    • 1
    • False
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • Hide

      The reproducer does not trigger SELinux denials.

      Show
      The reproducer does not trigger SELinux denials.
    • None
    • None
    • Unspecified
    • Unspecified
    • Unspecified
    • x86_64
    • None

      What were you trying to do that didn't work?

      Cloud automatic registration workflow via redhat-cloud-client-configuration-cdn packaging.

      What is the impact of this issue to you?

      Prevents use/registration of insights-client

      Please provide the package NVR for which the bug is seen:

      insights-client-3.10.1-2.el10.noarch

      How reproducible is this bug?:

      100%

      Steps to reproduce

      1. Install insights-client from latest nightly
      2. Utilize redhat-cloud-client-configuration{-cdn} from a cloud instance to automate execution of insights-client
      3.  

      Expected results

      Registration should succeed / core should be found

      Actual results

      Aug 05 16:42:06 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Started insights-register.service - Automatically Register with Red Hat Insights.
      Aug 05 16:42:06 ip-10-31-51-217.us-east-1.aws.redhat.com insights-client[1946]: Client: 3.10.1
      Aug 05 16:42:06 ip-10-31-51-217.us-east-1.aws.redhat.com insights-client[1946]: Core: not found 

       

      Additional Info:

      Here are all the details I have:

      Updating packages from nightly:

      [root@ip-10-31-51-217 yum.repos.d]# dnf update subscription-manager insights-client rhc -y;systemctl daemon-reload;systemctl stop rhsmcertd
      Updating Subscription Management repositories.
      Unable to read consumer identity
      
      This system is not registered with an entitlement server. You can use "rhc" or "subscription-manager" to register.
      
      Last metadata expiration check: 0:00:26 ago on Tue Aug  5 16:24:55 2025.
      Dependencies resolved.
      ==============================================================================================================================
       Package                                 Arch        Version                Repository                                   Size
      ==============================================================================================================================
      Upgrading:
       insights-client                         noarch      3.10.1-2.el10          rhel-for-x86_64-appstream-rpms-nightly      1.2 M
       libdnf-plugin-subscription-manager      x86_64      1.30.10-1.el10         rhel-for-x86_64-baseos-rpms-nightly          43 k
       libselinux                              x86_64      3.9-1.el10             rhel-for-x86_64-baseos-rpms-nightly          97 k
       libselinux-utils                        x86_64      3.9-1.el10             rhel-for-x86_64-baseos-rpms-nightly         127 k
       libsemanage                             x86_64      3.9-1.el10             rhel-for-x86_64-baseos-rpms-nightly         122 k
       libsepol                                x86_64      3.9-1.el10             rhel-for-x86_64-baseos-rpms-nightly         348 k
       policycoreutils                         x86_64      3.9-1.el10             rhel-for-x86_64-baseos-rpms-nightly         227 k
       policycoreutils-python-utils            noarch      3.9-1.el10             rhel-for-x86_64-appstream-rpms-nightly       47 k
       python3-cloud-what                      x86_64      1.30.10-1.el10         rhel-for-x86_64-baseos-rpms-nightly          72 k
       python3-libselinux                      x86_64      3.9-1.el10             rhel-for-x86_64-appstream-rpms-nightly      201 k
       python3-libsemanage                     x86_64      3.9-1.el10             rhel-for-x86_64-appstream-rpms-nightly       81 k
       python3-policycoreutils                 noarch      3.9-1.el10             rhel-for-x86_64-appstream-rpms-nightly      2.2 M
       python3-subscription-manager-rhsm       x86_64      1.30.10-1.el10         rhel-for-x86_64-baseos-rpms-nightly         183 k
       rhc                                     x86_64      1:0.3.3-1.el10         rhel-for-x86_64-appstream-rpms-nightly      3.4 M
       selinux-policy                          noarch      42.1.4-1.el10          rhel-for-x86_64-baseos-rpms-nightly          47 k
       selinux-policy-targeted                 noarch      42.1.4-1.el10          rhel-for-x86_64-baseos-rpms-nightly         6.2 M
       subscription-manager                    x86_64      1.30.10-1.el10         rhel-for-x86_64-baseos-rpms-nightly         959 k
      Installing dependencies:
       insights-core-selinux                   noarch      3.7.0-1.el10           rhel-for-x86_64-appstream-rpms-nightly       31 k
      
      Transaction Summary
      ==============================================================================================================================
      Install   1 Package
      Upgrade  17 Packages
      
      Total download size: 16 M
      Downloading Packages:
      (1/18): insights-core-selinux-3.7.0-1.el10.noarch.rpm                                         396 kB/s |  31 kB     00:00
      (2/18): libdnf-plugin-subscription-manager-1.30.10-1.el10.x86_64.rpm                          469 kB/s |  43 kB     00:00
      (3/18): libselinux-3.9-1.el10.x86_64.rpm                                                      821 kB/s |  97 kB     00:00
      (4/18): libsemanage-3.9-1.el10.x86_64.rpm                                                     880 kB/s | 122 kB     00:00
      (5/18): libselinux-utils-3.9-1.el10.x86_64.rpm                                                759 kB/s | 127 kB     00:00
      (6/18): python3-cloud-what-1.30.10-1.el10.x86_64.rpm                                          811 kB/s |  72 kB     00:00
      (7/18): libsepol-3.9-1.el10.x86_64.rpm                                                        1.3 MB/s | 348 kB     00:00
      (8/18): policycoreutils-3.9-1.el10.x86_64.rpm                                                 1.5 MB/s | 227 kB     00:00
      (9/18): selinux-policy-42.1.4-1.el10.noarch.rpm                                               319 kB/s |  47 kB     00:00
      (10/18): python3-subscription-manager-rhsm-1.30.10-1.el10.x86_64.rpm                          913 kB/s | 183 kB     00:00
      (11/18): subscription-manager-1.30.10-1.el10.x86_64.rpm                                       1.3 MB/s | 959 kB     00:00
      (12/18): insights-client-3.10.1-2.el10.noarch.rpm                                             1.7 MB/s | 1.2 MB     00:00
      (13/18): policycoreutils-python-utils-3.9-1.el10.noarch.rpm                                   456 kB/s |  47 kB     00:00
      (14/18): python3-libselinux-3.9-1.el10.x86_64.rpm                                             1.2 MB/s | 201 kB     00:00
      (15/18): python3-libsemanage-3.9-1.el10.x86_64.rpm                                            661 kB/s |  81 kB     00:00
      (16/18): selinux-policy-targeted-42.1.4-1.el10.noarch.rpm                                     4.8 MB/s | 6.2 MB     00:01
      (17/18): python3-policycoreutils-3.9-1.el10.noarch.rpm                                        4.8 MB/s | 2.2 MB     00:00
      (18/18): rhc-0.3.3-1.el10.x86_64.rpm                                                          3.5 MB/s | 3.4 MB     00:00
      ------------------------------------------------------------------------------------------------------------------------------
      Total                                                                                         6.3 MB/s |  16 MB     00:02
      Running transaction check
      Transaction check succeeded.
      Running transaction test
      Transaction test succeeded.
      Running transaction
        Running scriptlet: selinux-policy-targeted-42.1.4-1.el10.noarch                                                         1/1
        Preparing        :                                                                                                      1/1
        Upgrading        : libsepol-3.9-1.el10.x86_64                                                                          1/35
        Upgrading        : libselinux-3.9-1.el10.x86_64                                                                        2/35
        Running scriptlet: libselinux-3.9-1.el10.x86_64                                                                        2/35
        Upgrading        : python3-libselinux-3.9-1.el10.x86_64                                                                3/35
        Upgrading        : libselinux-utils-3.9-1.el10.x86_64                                                                  4/35
        Upgrading        : libsemanage-3.9-1.el10.x86_64                                                                       5/35
        Upgrading        : policycoreutils-3.9-1.el10.x86_64                                                                   6/35
        Running scriptlet: policycoreutils-3.9-1.el10.x86_64                                                                   6/35
        Upgrading        : selinux-policy-42.1.4-1.el10.noarch                                                                 7/35
        Running scriptlet: selinux-policy-42.1.4-1.el10.noarch                                                                 7/35
        Running scriptlet: selinux-policy-targeted-42.1.4-1.el10.noarch                                                        8/35
        Upgrading        : selinux-policy-targeted-42.1.4-1.el10.noarch                                                        8/35
        Running scriptlet: selinux-policy-targeted-42.1.4-1.el10.noarch                                                        8/35
        Upgrading        : python3-cloud-what-1.30.10-1.el10.x86_64                                                            9/35
        Upgrading        : python3-subscription-manager-rhsm-1.30.10-1.el10.x86_64                                            10/35
        Running scriptlet: insights-core-selinux-3.7.0-1.el10.noarch                                                          11/35
        Installing       : insights-core-selinux-3.7.0-1.el10.noarch                                                          11/35
        Running scriptlet: insights-core-selinux-3.7.0-1.el10.noarch                                                          11/35
        Upgrading        : python3-libsemanage-3.9-1.el10.x86_64                                                              12/35
        Upgrading        : python3-policycoreutils-3.9-1.el10.noarch                                                          13/35
        Upgrading        : policycoreutils-python-utils-3.9-1.el10.noarch                                                     14/35
        Upgrading        : libdnf-plugin-subscription-manager-1.30.10-1.el10.x86_64                                           15/35
        Running scriptlet: subscription-manager-1.30.10-1.el10.x86_64                                                         16/35
        Upgrading        : subscription-manager-1.30.10-1.el10.x86_64                                                         16/35
      warning: /etc/rhsm/rhsm.conf created as /etc/rhsm/rhsm.conf.rpmnew
      
        Running scriptlet: subscription-manager-1.30.10-1.el10.x86_64                                                         16/35
        Upgrading        : insights-client-3.10.1-2.el10.noarch                                                               17/35
        Running scriptlet: insights-client-3.10.1-2.el10.noarch                                                               17/35
        Running scriptlet: rhc-1:0.3.3-1.el10.x86_64                                                                          18/35
        Upgrading        : rhc-1:0.3.3-1.el10.x86_64                                                                          18/35
        Running scriptlet: rhc-1:0.3.3-1.el10.x86_64                                                                          18/35
        Running scriptlet: rhc-1:0.3.1-2.el10.x86_64                                                                          19/35
        Cleanup          : rhc-1:0.3.1-2.el10.x86_64                                                                          19/35
        Running scriptlet: rhc-1:0.3.1-2.el10.x86_64                                                                          19/35
        Running scriptlet: insights-client-3.10.0-1.el10.noarch                                                               20/35
        Cleanup          : insights-client-3.10.0-1.el10.noarch                                                               20/35
        Running scriptlet: insights-client-3.10.0-1.el10.noarch                                                               20/35
        Running scriptlet: selinux-policy-40.13.26-1.el10.noarch                                                              21/35
        Cleanup          : selinux-policy-40.13.26-1.el10.noarch                                                              21/35
        Running scriptlet: selinux-policy-40.13.26-1.el10.noarch                                                              21/35
        Running scriptlet: subscription-manager-1.30.6-1.el10_0.x86_64                                                        22/35
        Cleanup          : subscription-manager-1.30.6-1.el10_0.x86_64                                                        22/35
        Running scriptlet: subscription-manager-1.30.6-1.el10_0.x86_64                                                        22/35
        Cleanup          : selinux-policy-targeted-40.13.26-1.el10.noarch                                                     23/35
        Running scriptlet: selinux-policy-targeted-40.13.26-1.el10.noarch                                                     23/35
        Cleanup          : policycoreutils-python-utils-3.8-1.el10.noarch                                                     24/35
        Cleanup          : python3-policycoreutils-3.8-1.el10.noarch                                                          25/35
        Running scriptlet: policycoreutils-3.8-1.el10.x86_64                                                                  26/35
        Cleanup          : policycoreutils-3.8-1.el10.x86_64                                                                  26/35
        Cleanup          : libselinux-utils-3.8-1.el10.x86_64                                                                 27/35
        Cleanup          : python3-libsemanage-3.8.1-1.el10_0.x86_64                                                          28/35
        Cleanup          : libsemanage-3.8.1-1.el10_0.x86_64                                                                  29/35
        Cleanup          : python3-libselinux-3.8-1.el10.x86_64                                                               30/35
        Cleanup          : libselinux-3.8-1.el10.x86_64                                                                       31/35
        Cleanup          : python3-subscription-manager-rhsm-1.30.6-1.el10_0.x86_64                                           32/35
        Cleanup          : python3-cloud-what-1.30.6-1.el10_0.x86_64                                                          33/35
        Cleanup          : libsepol-3.8-1.el10.x86_64                                                                         34/35
        Cleanup          : libdnf-plugin-subscription-manager-1.30.6-1.el10_0.x86_64                                          35/35
        Running scriptlet: selinux-policy-targeted-42.1.4-1.el10.noarch                                                       35/35
        Running scriptlet: subscription-manager-1.30.10-1.el10.x86_64                                                         35/35
        Running scriptlet: libdnf-plugin-subscription-manager-1.30.6-1.el10_0.x86_64                                          35/35
      Installed products updated.
      
      Upgraded:
        insights-client-3.10.1-2.el10.noarch                          libdnf-plugin-subscription-manager-1.30.10-1.el10.x86_64
        libselinux-3.9-1.el10.x86_64                                  libselinux-utils-3.9-1.el10.x86_64
        libsemanage-3.9-1.el10.x86_64                                 libsepol-3.9-1.el10.x86_64
        policycoreutils-3.9-1.el10.x86_64                             policycoreutils-python-utils-3.9-1.el10.noarch
        python3-cloud-what-1.30.10-1.el10.x86_64                      python3-libselinux-3.9-1.el10.x86_64
        python3-libsemanage-3.9-1.el10.x86_64                         python3-policycoreutils-3.9-1.el10.noarch
        python3-subscription-manager-rhsm-1.30.10-1.el10.x86_64       rhc-1:0.3.3-1.el10.x86_64
        selinux-policy-42.1.4-1.el10.noarch                           selinux-policy-targeted-42.1.4-1.el10.noarch
        subscription-manager-1.30.10-1.el10.x86_64
      Installed:
        insights-core-selinux-3.7.0-1.el10.noarch
      
      Complete!

      RHCCC is installed after this, and a reboot follows to simulate autoreg workflow - which is just a dance of systemd units looking for files and executing commands.
      The system gets automatically registered via subscription-manager, and insights-client registration is to follow, but fails:

      Aug 05 16:42:04 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Starting insights-register.service - Automatically Register with Red Hat Insights...
      Aug 05 16:42:04 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: insights-unregister.service - Automatically Unregister from Red Hat Insights was skipped because of an unmet condition check (ConditionPathExists=!/etc/pki/consumer/cert.pem).
      Aug 05 16:42:04 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: yggdrasil-stop.service - Automatically stop yggdrasil when rhsm cert does not exists was skipped because of an unmet condition check (ConditionPathExists=!/etc/pki/consumer/cert.pem).
      Aug 05 16:42:04 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Starting yggdrasil.service - yggdrasil system service...
      Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com yggd[1876]: [yggd] 2025/08/05 16:42:05 starting yggd version 0.4.5
      Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com yggd[1876]: [yggd] 2025/08/05 16:42:05 facts file not found, created '/var/lib/yggdrasil/canonical-facts.json'
      Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Started insights-register.service - Automatically Register with Red Hat Insights.
      Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com yggd[1876]: [yggd] 2025/08/05 16:42:05 exported /com/redhat/Yggdrasil1/Dispatcher1 on bus
      Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com yggd[1876]: [yggd] 2025/08/05 16:42:05 failed to publish message: not Connected
      Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com yggd[1876]: [yggd] 2025/08/05 16:42:05 cannot send connection status: not Connected
      Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Started yggdrasil.service - yggdrasil system service.
      Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com yggd[1876]: [yggd] 2025/08/05 16:42:05 exported /com/redhat/Yggdrasil1 on bus
      Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com yggd[1876]: [yggd] 2025/08/05 16:42:05 connecting to broker: [wss://connect.cloud.stage.redhat.com:443]
      Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com insights-client[1874]: Client: 3.10.1
      Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com insights-client[1874]: Core: not found
      Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com subscription-manager[817]: Added subscription for 'Content Access' contract 'None'
      Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com subscription-manager[817]: Added subscription for product ' Content Access'
      Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com yggd[1876]: [yggd] 2025/08/05 16:42:05 cannot start watching '/etc/yggdrasil/tags.toml': lstat /etc/yggdrasil/tags.toml: no such file or directory
      Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com systemctl[1897]: Created symlink '/etc/systemd/system/insights-register.path''/dev/null'.
      Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Reload requested from client PID 1897 ('systemctl') (unit insights-register.service)...
      Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Reloading...
      Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com systemd-rc-local-generator[1933]: /etc/rc.d/rc.local is not marked executable, skipping.
      Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Reloading finished in 229 ms.
      Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Started yggdrasil.service - yggdrasil system service.
      Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: insights-register.path: Deactivated successfully.
      Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Stopped insights-register.path.
      Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: insights-register.service: Deactivated successfully.
      Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Starting insights-register.service - Automatically Register with Red Hat Insights...
      Aug 05 16:42:06 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Started insights-register.service - Automatically Register with Red Hat Insights.
      Aug 05 16:42:06 ip-10-31-51-217.us-east-1.aws.redhat.com insights-client[1946]: Client: 3.10.1
      Aug 05 16:42:06 ip-10-31-51-217.us-east-1.aws.redhat.com insights-client[1946]: Core: not found
      Aug 05 16:42:06 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Reload requested from client PID 1962 ('systemctl') (unit insights-register.service)...
      Aug 05 16:42:06 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Reloading...
      Aug 05 16:42:06 ip-10-31-51-217.us-east-1.aws.redhat.com systemd-rc-local-generator[2000]: /etc/rc.d/rc.local is not marked executable, skipping.
      Aug 05 16:42:06 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Reloading finished in 242 ms.
      Aug 05 16:42:06 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Started yggdrasil.service - yggdrasil system service.
      Aug 05 16:42:06 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: insights-register.service: Deactivated successfully.

      Some follow-on investigations:

      [root@ip-10-31-51-217 ec2-user]# systemctl status insights-register.service -l --no-pager
      ○ insights-register.service - Automatically Register with Red Hat Insights
           Loaded: loaded (/usr/lib/systemd/system/insights-register.service; static)
           Active: inactive (dead)
             Docs: man:insights-client(8)
      
      Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Started insights-register.service - Automatically Register with Red Hat Insights.
      Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com insights-client[1874]: Client: 3.10.1
      Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com insights-client[1874]: Core: not found
      Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com systemctl[1897]: Created symlink '/etc/systemd/system/insights-register.path''/dev/null'.
      Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: insights-register.service: Deactivated successfully.
      Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Starting insights-register.service - Automatically Register with Red Hat Insights...
      Aug 05 16:42:06 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Started insights-register.service - Automatically Register with Red Hat Insights.
      Aug 05 16:42:06 ip-10-31-51-217.us-east-1.aws.redhat.com insights-client[1946]: Client: 3.10.1
      Aug 05 16:42:06 ip-10-31-51-217.us-east-1.aws.redhat.com insights-client[1946]: Core: not found
      Aug 05 16:42:06 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: insights-register.service: Deactivated successfully.
      [root@ip-10-31-51-217 ~]# ll -a /etc/insights-client/
      total 1328
      drwxr-xr-x.  2 root root     177 Aug  5 16:25 .
      drwxr-xr-x. 92 root root    8192 Aug  5 16:41 ..
      -rw-r--r--.  1 root root     185 May 20 10:28 .exp.sed
      -r--r--r--.  1 root root    4586 May 20 10:28 cert-api.access.redhat.com.pem
      -rw-r--r--.  1 root root    1236 Aug  5 16:20 insights-client.conf
      -rw-r--r--.  1 root root     401 May 20 10:28 insights-client.motd
      -r--r--r--.  1 root root    1147 May 20 10:28 redhattools.pub.gpg
      -rw-r--r--.  1 root root 1318691 May 20 10:28 rpm.egg
      -rw-r--r--.  1 root root     819 May 20 10:28 rpm.egg.asc

      Selinux info:

      [root@ip-10-31-51-217 ~]# python3 -c 'import insights_client.constants; print(f"{insights_client.constants.CORE_SELINUX_POLICY=}")'
      insights_client.constants.CORE_SELINUX_POLICY='insights_core_t'

      Audit log:

      [root@ip-10-31-51-217 ~]# ausearch -i -ts today -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR
      ----
      type=PROCTITLE msg=audit(08/05/25 16:42:05.503:155) : proctitle=gpg-agent --homedir /var/lib/insights/tmpgwfdzd9w --use-standard-socket --daemon
      type=SYSCALL msg=audit(08/05/25 16:42:05.503:155) : arch=x86_64 syscall=bind success=no exit=EACCES(Permission denied) a0=0x3 a1=0x5606da6316e0 a2=0x2b a3=0x0 items=0 ppid=1888 pid=1889 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=gpg-agent exe=/usr/bin/gpg-agent subj=system_u:system_r:gpg_agent_t:s0 key=(null)
      type=AVC msg=audit(08/05/25 16:42:05.503:155) : avc:  denied  { create } for  pid=1889 comm=gpg-agent name=S.gpg-agent scontext=system_u:system_r:gpg_agent_t:s0 tcontext=system_u:object_r:insights_client_var_lib_t:s0 tclass=sock_file permissive=0
      ----
      type=PROCTITLE msg=audit(08/05/25 16:42:06.444:196) : proctitle=gpg-agent --homedir /var/lib/insights/tmpfl8jv7tp --use-standard-socket --daemon
      type=SYSCALL msg=audit(08/05/25 16:42:06.444:196) : arch=x86_64 syscall=bind success=no exit=EACCES(Permission denied) a0=0x3 a1=0x55f174fc46e0 a2=0x2b a3=0x0 items=0 ppid=1952 pid=1953 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=gpg-agent exe=/usr/bin/gpg-agent subj=system_u:system_r:gpg_agent_t:s0 key=(null)
      type=AVC msg=audit(08/05/25 16:42:06.444:196) : avc:  denied  { create } for  pid=1953 comm=gpg-agent name=S.gpg-agent scontext=system_u:system_r:gpg_agent_t:s0 tcontext=system_u:object_r:insights_client_var_lib_t:s0 tclass=sock_file permissive=0

      Finally, manually trying insights-client --register:

      [root@ip-10-31-51-217 ~]# insights-client --register
      Automatic scheduling for Insights has been enabled.
      Starting to collect Insights data for ip-10-31-51-217.us-east-1.aws.redhat.com
      Writing RHSM facts to /etc/rhsm/facts/insights-client.facts ...
      Uploading Insights data.
      Successfully uploaded report for ip-10-31-51-217.us-east-1.aws.redhat.com.
      View the Red Hat Insights console at https://console.stage.redhat.com/insights/

      So we see that it works unconfined from root, but not executed by the systemd service units.

              rhn-support-zpytela Zdenek Pytela
              rhn-support-cdonnell Craig Donnelly
              Zdenek Pytela Zdenek Pytela
              Milos Malik Milos Malik
              Votes:
              0 Vote for this issue
              Watchers:
              18 Start watching this issue

                Created:
                Updated: