Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-127329

insights-client cannot 'getattr' rpm_exec_t (rhel9)

Linking RHIVOS CVEs to...Migration: Automation ...RHELPRIO AssignedTeam ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • selinux-policy-38.1.68-1.el9
    • None
    • Moderate
    • 1
    • rhel-security-selinux
    • 14
    • 1
    • QE ack
    • False
    • False
    • Hide

      None

      Show
      None
    • No
    • SELINUX 251119: 15
    • Release Note Not Required
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      What were you trying to do that didn't work?

      Run newest insights-client build from a common side-tag.

      What is the impact of this issue to you?

      SELinux logs a denial, trying to stat rpm_exec_t. No behavioral problems were identified.

      Please provide the package NVR for which the bug is seen:

      # rpm -q insights-client insights-core insights-core-selinux selinux-policy
insights-client-3.9.1-1.el9.noarch
insights-core-3.6.9.1-2.el9.noarch
insights-core-selinux-3.7.0-2.el9.noarch
selinux-policy-38.1.67-1.el9.noarch

      from RHEL side-tag rhel-9.8.0-build-sidetag-173813-stack-gate

      How reproducible is this bug?:

      Always

      Steps to reproduce

      1. Ensure the system is registered with subscription-manager
      2. Install the packages
      3. insights-client --register
      4. Observe the background daemon automatically run after registration causes denials

      Expected results

      No audit logs discovered.

      Actual results

      # ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts recent
----
type=PROCTITLE msg=audit(11/10/2025 09:12:07.880:511) : proctitle=/usr/bin/python3 /usr/bin/insights-client --check-results 
type=SYSCALL msg=audit(11/10/2025 09:12:07.880:511) : arch=x86_64 syscall=newfstatat success=no exit=EACCES(Permission denied) a0=AT_FDCWD a1=0x7fc10e6f4560 a2=0x7ffe4f2d3870 a3=0x0 items=0 ppid=1 pid=21555 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=insights-client exe=/usr/bin/python3.9 subj=system_u:system_r:insights_client_t:s0 key=(null) 
type=AVC msg=audit(11/10/2025 09:12:07.880:511) : avc:  denied  { getattr } for  pid=21555 comm=insights-client path=/usr/bin/rpm dev="dm-0" ino=202275672 scontext=system_u:system_r:insights_client_t:s0 tcontext=system_u:object_r:rpm_exec_t:s0 tclass=file permissive=0

              rhn-support-zpytela Zdenek Pytela
              pkoprda@redhat.com Peter Koprda
              Zdenek Pytela Zdenek Pytela
              Milos Malik Milos Malik
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

                Created:
                Updated: