Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-1553

MLS: kmod-static-nodes.service fails at boot due to a AVC popping up

    • selinux-policy-38.1.28-1.el9
    • Normal
    • sst_security_selinux
    • ssg_security
    • 14
    • None
    • QE ack, Dev ack
    • False
    • Hide

      None

      Show
      None
    • Yes
    • None
    • Hide

      The kmod-static-nodes service can write into the /run/tmpfiles.d/static-nodes.conf file when running under the MLS policy. No SELinux denials are triggered during the scenario.

      Show
      The kmod-static-nodes service can write into the /run/tmpfiles.d/static-nodes.conf file when running under the MLS policy. No SELinux denials are triggered during the scenario.
    • Pass
    • None
    • Bug Fix
    • Hide
      .`kmod` runs in the SELinux MLS policy

      Previously, the SELinux did not assign a private type for the `/var/run/tmpfiles.d/static-nodes.conf` file. As a consequence, the `kmod` utility may fail to work in the SELinux multi-level security (MLS) policy. This update adds the `kmod_var_run_t` label for `/var/run/tmpfiles.d/static-nodes.conf` to the SELinux policy, and as a result, `kmod` runs successfully in the SELinux MLS policy.
      Show
      .`kmod` runs in the SELinux MLS policy Previously, the SELinux did not assign a private type for the `/var/run/tmpfiles.d/static-nodes.conf` file. As a consequence, the `kmod` utility may fail to work in the SELinux multi-level security (MLS) policy. This update adds the `kmod_var_run_t` label for `/var/run/tmpfiles.d/static-nodes.conf` to the SELinux policy, and as a result, `kmod` runs successfully in the SELinux MLS policy.
    • Done
    • None

      Description of problem:

      After switching the system from Targeted to MLS, relabelling while in permissive and switching back to Enforcing, we can see that kmod-static-nodes.service fails during boot due to hidden AVC:

      ~~~

      1. systemctl --failed
        UNIT LOAD ACTIVE SUB DESCRIPTION
        ● kmod-static-nodes.service loaded failed failed Create List of Static Device Nodes
      1. systemctl status kmod-static-nodes.service
        [...]
        Aug 10 09:06:03 vm-mls9 systemd[1]: Starting Create List of Static Device Nodes...
        Aug 10 09:06:03 vm-mls9 kmod[655]: Error: could not create /run/tmpfiles.d/static-nodes.conf - Permission denied
        Aug 10 09:06:03 vm-mls9 systemd[1]: kmod-static-nodes.service: Main process exited, code=exited, status=1/FAILURE
        Aug 10 09:06:03 vm-mls9 systemd[1]: kmod-static-nodes.service: Failed with result 'exit-code'.
        Aug 10 09:06:03 vm-mls9 systemd[1]: Failed to start Create List of Static Device Nodes.
        ~~~

      AVC (not showing without dontaudit rules):
      ~~~
      type=PROCTITLE msg=audit(08/10/2023 09:16:26.228:147) : proctitle=/usr/bin/kmod static-nodes --format=tmpfiles --output=/run/tmpfiles.d/static-nodes.conf
      type=SYSCALL msg=audit(08/10/2023 09:16:26.228:147) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=AT_FDCWD a1=0x7fff817c3f24 a2=O_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC a3=0x1b6 items=0 ppid=1 pid=1208 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=kmod exe=/usr/bin/kmod subj=system_u:system_r:kmod_t:s0-s15:c0.c1023 key=(null)
      type=AVC msg=audit(08/10/2023 09:16:26.228:147) : avc: denied

      { write }

      for pid=1208 comm=kmod name=static-nodes.conf dev="tmpfs" ino=56 scontext=system_u:system_r:kmod_t:s0-s15:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0
      ~~~

      Version-Release number of selected component (if applicable):

      selinux-policy-mls-38.1.11-2.el9_2.3.noarch

      How reproducible:

      Always in MLS

            rhn-support-zpytela Zdenek Pytela
            rhn-support-rmetrich Renaud Métrich
            Nikola Kňažeková Nikola Kňažeková (Inactive)
            Milos Malik Milos Malik
            Jan Fiala Jan Fiala
            Votes:
            0 Vote for this issue
            Watchers:
            11 Start watching this issue

              Created:
              Updated:
              Resolved: