-
Bug
-
Resolution: Won't Do
-
Normal
-
None
-
rhel-8.6.0
-
None
-
Moderate
-
rhel-security-selinux
-
ssg_security
-
None
-
False
-
False
-
-
None
-
None
-
None
-
None
-
If docs needed, set a value
-
-
All
-
None
Opening this bug again, as the customer has the below feedback, that the bughttps://bugzilla.redhat.com/show_bug.cgi?id=2170511 is not fixed/accepted-as-wanted.
=========================================================================
With SAP HANA the call from insights to 'hdbsrvutil -v' triggers 2 AVCs not handled yet and not documented to be excluded like the write to usr_t was provided as feedback it was not fixed/accepted-as-wanted
~~~
+ sudo ausearch -i -m avc,user_avc -ts today
node=li-lc-2802 type=PROCTITLE msg=audit(03/15/2023 09:05:35.693:274102) : proctitle=/usr/sap/H4C/HDB96/exe/hdbsrvutil -v
node=li-lc-2802 type=SYSCALL msg=audit(03/15/2023 09:05:35.693:274102) : arch=x86_64 syscall=mprotect success=yes exit=0 a0=0x7f483ec03000 a1=0x10000 a2=PROT_READ|PROT_EXEC a3=0x7f483ec03000 items=0 ppid=3165740 pid=3165767 auid=unset uid=h4cadm gid=sapsys euid=h4cadm suid=h4cadm fsuid=h4cadm egid=sapsys sgid=sapsys fsgid=sapsys tty=(none) ses=unset comm=hdbsrvutil exe=/hana/shared/H4C/exe/linuxx86_64/HDB_2.00.059.04.1655794895_1cdbd35ec7472ab5d22a0bac02725a02dc3038f9/hdbsrvutil subj=system_u:system_r:insights_client_t:s0 key=(null)
node=li-lc-2802 type=AVC msg=audit(03/15/2023 09:05:35.693:274102) : avc: denied
for pid=3165767 comm=hdbsrvutil path=/hana/shared/H4C/exe/linuxx86_64/HDB_2.00.059.04.1655794895_1cdbd35ec7472ab5d22a0bac02725a02dc3038f9/librtebasesupp.so dev="dm-6" ino=10575664 scontext=system_u:system_r:insights_client_t:s0 tcontext=unconfined_u:object_r:usr_t:s0 tclass=file permissive=1
node=li-lc-2802 type=PROCTITLE msg=audit(03/15/2023 09:05:35.716:274103) : proctitle=/usr/sap/H4C/HDB96/exe/hdbsrvutil -v
node=li-lc-2802 type=SYSCALL msg=audit(03/15/2023 09:05:35.716:274103) : arch=x86_64 syscall=mprotect success=yes exit=0 a0=0x7f483bdc5000 a1=0x1000 a2=PROT_READ|PROT_WRITE|PROT_EXEC a3=0x0 items=0 ppid=3165740 pid=3165767 auid=unset uid=h4cadm gid=sapsys euid=h4cadm suid=h4cadm fsuid=h4cadm egid=sapsys sgid=sapsys fsgid=sapsys tty=(none) ses=unset comm=hdbsrvutil exe=/hana/shared/H4C/exe/linuxx86_64/HDB_2.00.059.04.1655794895_1cdbd35ec7472ab5d22a0bac02725a02dc3038f9/hdbsrvutil subj=system_u:system_r:insights_client_t:s0 key=(null)
node=li-lc-2802 type=AVC msg=audit(03/15/2023 09:05:35.716:274103) : avc: denied
for pid=3165767 comm=hdbsrvutil scontext=system_u:system_r:insights_client_t:s0 tcontext=system_u:system_r:insights_client_t:s0 tclass=process permissive=1
+ sudo audit2allow -a
#============= insights_client_t ==============
allow insights_client_t self:process execmem;
allow insights_client_t usr_t:file execmod;
~~~
========================================================================================
- external trackers