Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-124855

insights-client cannot 'getattr' rpm_exec_t

Linking RHIVOS CVEs to...Migration: Automation ...RHELPRIO AssignedTeam ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • selinux-policy-42.1.11-1.el10
    • Yes
    • Moderate
    • 1
    • rhel-security-selinux
    • 14
    • 1
    • QE ack
    • False
    • False
    • Hide

      None

      Show
      None
    • No
    • SELINUX 251119: 15
    • Release Note Not Required
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      What were you trying to do that didn't work?

      Run newest insights-client build from a common side-tag.

      What is the impact of this issue to you?

      SELinux logs a denial, trying to stat rpm_exec_t. No behavioral problems were identified.

      Please provide the package NVR for which the bug is seen:

      # rpm -q insights-client insights-core selinux-policy
insights-client-3.10.2-1.el10.noarch
insights-core-3.6.8.1-1.el10.noarch
selinux-policy-42.1.8-1.el10.noarch

      from RHEL side-tag rhel-10.2-build-sidetag-173821-stack-gate

      How reproducible is this bug?:

      Always

      Steps to reproduce

      1. Ensure the system is registered with subscription-manager
      2. Install the packages
      3. insights-client --register
      4. Observe the background daemon automatically run after registration causes denials

      Expected results

      No audit logs discovered.

      Actual results

      root@localhost:~# ausearch -m avc -i -ts recent
----
type=PROCTITLE msg=audit(10/27/2025 12:27:21.547:321) : proctitle=/usr/bin/python3 /usr/bin/insights-client --check-results 
type=SYSCALL msg=audit(10/27/2025 12:27:21.547:321) : arch=x86_64 syscall=newfstatat success=no exit=EACCES(Permission denied) a0=AT_FDCWD a1=0x7fc5c8069100 a2=0x7ffef4913e90 a3=0x0 items=0 ppid=1 pid=4625 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=insights-client exe=/usr/bin/python3.12 subj=system_u:system_r:insights_client_t:s0 key=(null) 
type=AVC msg=audit(10/27/2025 12:27:21.547:321) : avc:  denied  { getattr } for  pid=4625 comm=insights-client path=/usr/bin/rpm dev="dm-0" ino=1228896 scontext=system_u:system_r:insights_client_t:s0 tcontext=system_u:object_r:rpm_exec_t:s0 tclass=file permissive=0

      Additional information

      I have tracked the execution path in CCT-1742: insights-client imports insights-core code, which in turns import rpm Python package, which probably stats some files on the filesystem.

              rhn-support-zpytela Zdenek Pytela
              mhorky@redhat.com Matyas Horky
              Zdenek Pytela Zdenek Pytela
              Milos Malik Milos Malik
              Votes:
              0 Vote for this issue
              Watchers:
              11 Start watching this issue

                Created:
                Updated: