Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-130547

selinux context failure in tuned-ppd

Linking RHIVOS CVEs to...Migration: Automation ...RHELPRIO AssignedTeam ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Undefined Undefined
    • None
    • CentOS Stream 10
    • tuned
    • None
    • Yes
    • None
    • rhel-net-perf
    • None
    • False
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • Unspecified
    • Unspecified
    • Unspecified
    • All
    • None

      What were you trying to do that didn't work?

      tuned-pdd.service fails to start

      ```

      PermissionError: [Errno 13] Permission denied: '/var/log/tuned/tuned-ppd.log'

      ```

      here's the selinux denials:

      ```

      type=SYSCALL msg=audit(1763953148.689:83): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7f5da1
      d5d710 a2=80441 a3=1b6 items=0 ppid=1 pid=2153 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
      fsgid=0 tty=(none) ses=4294967295 comm="tuned-ppd" exe="/usr/bin/python3.12" subj=system_u:system_r:tuned_ppd
      _t:s0 key=(null)
      type=SYSCALL msg=audit(1763953169.296:161): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7fe9e
      4b912d0 a2=80441 a3=1b6 items=0 ppid=1 pid=3516 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=
      0 fsgid=0 tty=(none) ses=4294967295 comm="tuned-ppd" exe="/usr/bin/python3.12" subj=system_u:system_r:tuned_pp
      d_t:s0 key=(null)

      ```

      ```
      ls -lZ /var/log/tuned/
      total 8
      rw-rr-. 1 root root system_u:object_r:tuned_log_t:s0 6575 Nov 24 09:28 tuned.log

      ```

      the tuned-ppd.log fails to create and the service cannot start. 

      What is the impact of this issue to you?

      There is a workaround with restorecon but all image produces with Image Mode present this issue.

      Please provide the package NVR for which the bug is seen:

      selinux-policy-42.1.10-1.el10.noarch

      tuned-ppd-2.26.0-1.el10.1.noarch

      How reproducible is this bug?:

      Steps to reproduce

      1. install tuned-ppd in a bootc build
      2. boot the image and see tuned-pd failed to start

      Expected results

      tuned-ppd should have permission to write it's log file

      Actual results

      The tuned-pdd binary doesn't have the nessesary permission

              jskarvad Jaroslav Škarvada
              trogdor3000 James Reilly
              Jaroslav Škarvada Jaroslav Škarvada
              Robin Hack Robin Hack
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated: