-
Bug
-
Resolution: Unresolved
-
Normal
-
None
-
rhel-9.2.0
-
None
-
Moderate
-
rhel-sst-high-availability
-
ssg_filesystems_storage_and_HA
-
5
-
False
-
-
None
-
None
-
None
-
None
-
If docs needed, set a value
-
-
All
-
None
Description of problem:
Misconfigured selinux policy for keepalived triggers AVC denial when using MISC_CHECK in keepalived.conf
Version-Release number of selected component (if applicable):
keepalived-2.2.4-6.el9.x86_64
selinux-policy-38.1.14-1.el9.noarch
How reproducible:
always
Steps to Reproduce:
1.Find location for keepalived scripts:
$ semanage fcontext -l | grep keepalived_unconfined_script
/usr/libexec/keepalived(/.*)? all files system_u:object_r:keepalived_unconfined_script_exec_t:s0
2.Create a script in this location:
$ cat /usr/libexec/keepalived/misc_checker
#!/usr/bin/bash
true
3.Create a keepalived.conf file with MISC_CHECK:
$ cat /etc/keepalived/keepalived.conf
vrrp_instance VRRP_INSTANCE {
state MASTER
priority 128
advert_int 1
virtual_router_id 1
interface ens3
virtual_ipaddress
}
virtual_server 10.37.165.105 80 {
real_server 10.37.167.2 80 {
weight 1
MISC_CHECK
}
}
4.Start keepalived
Actual results:
Keepalived works but a selinux denial appears
$ ausearch -m AVC,USER_AVC
time->Wed Jun 7 16:56:46 2023
type=PROCTITLE msg=audit(1686149806.955:980): proctitle=2F7573722F7362696E2F6B656570616C69766564002D2D646F6E742D666F726B002D44002D2D636F6E6669672D6964006D61696E
type=SYSCALL msg=audit(1686149806.955:980): arch=c000003e syscall=280 success=no exit=-13 a0=ffffff9c a1=55df7dcb4c30 a2=7ffff3502c80 a3=0 items=0 ppid=63215 pid=63216 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="keepalived" exe="/usr/sbin/keepalived" subj=system_u:system_r:keepalived_t:s0 key=(null)
type=AVC msg=audit(1686149806.955:980): avc: denied
for pid=63216 comm="keepalived" name="misc_checker" dev="dm-0" ino=9451029 scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:object_r:keepalived_unconfined_script_exec_t:s0 tclass=file permissive=0
Expected results:
No denial