-
Bug
-
Resolution: Done-Errata
-
Normal
-
rhel-9.3.0
-
None
-
selinux-policy-38.1.31-1.el9
-
None
-
Moderate
-
rhel-security-selinux
-
ssg_security
-
23
-
None
-
QE ack
-
False
-
False
-
-
No
-
Red Hat Enterprise Linux
-
None
-
-
Pass
-
Automated
-
Release Note Not Required
-
None
What were you trying to do that didn't work?
When conntrackd is configured with "Filter From Kernelspace", an AVC pops up when starting the service:
type=PROCTITLE msg=audit(01/22/2024 12:46:49.999:248) : proctitle=/usr/sbin/conntrackd -C /etc/conntrackd/conntrackd.conf type=SYSCALL msg=audit(01/22/2024 12:46:49.999:248) : arch=x86_64 syscall=setsockopt success=yes exit=0 a0=0x10 a1=SOL_SOCKET a2=SO_ATTACH_FILTER a3=0x7ffc4d1a8210 items=0 ppid=1 pid=1927 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=conntrackd exe=/usr/sbin/conntrackd subj=system_u:system_r:conntrackd_t:s0 key=(null) type=AVC msg=audit(01/22/2024 12:46:49.999:248) : avc: denied { sys_admin } for pid=1927 comm=conntrackd capability=sys_admin scontext=system_u:system_r:conntrackd_t:s0 tcontext=system_u:system_r:conntrackd_t:s0 tclass=capability permissive=0 type=AVC msg=audit(01/22/2024 12:46:49.999:248) : avc: denied { bpf } for pid=1927 comm=conntrackd capability=bpf scontext=system_u:system_r:conntrackd_t:s0 tcontext=system_u:system_r:conntrackd_t:s0 tclass=capability2 permissive=0
Configuration file used to reproduce (/etc/conntrackd/conntrackd.conf):
Sync { Mode NOTRACK { } UDP { IPv4_address 225.0.0.50 IPv4_Destination_Address 192.168.100.100 Port 3780 Interface itf0 <<<<<<<<<<<<<<<< SET YOUR ITF HERE SndSocketBuffer 4194304 RcvSocketBuffer 4194304 } } General { Nice -20 HashSize 32768 HashLimit 131072 LogFile off Syslog on LockFile /var/lock/conntrack.lock UNIX { Path /var/run/conntrackd.ctl Backlog 20 } NetlinkBufferSize 4194304 NetlinkBufferSizeMaxGrowth 12582912 Filter From Kernelspace { <<<<<<<<<<<<<<<< HERE Protocol Accept { TCP SCTP DCCP } Address Ignore { IPv4_address 169.254.100.4 IPv4_address 169.254.100.253 } } }
Please provide the package NVR for which bug is seen:
conntrack-tools-1.4.7-2.el9
selinux-policy-38.1.23-1.el9
How reproducible:
Always
Steps to reproduce
See above
- clones
-
RHEL-22276 AVC "sys_admin" on conntrackd when using Kernel space filtering
-
- Closed
-
- links to
-
RHBA-2023:121166 selinux-policy bug fix and enhancement update
- mentioned on