Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-22748

SELinux prevents the caddy service from reading the /proc/sys/net/core/somaxconn file

Linking RHIVOS CVEs to...Migration: Automation ...Sync from "Extern...XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done-Errata
    • Icon: Minor Minor
    • rhel-8.10
    • rhel-8.10
    • selinux-policy
    • None
    • selinux-policy-3.14.3-136.el8
    • None
    • Low
    • rhel-sst-security-selinux
    • ssg_security
    • 25
    • None
    • QE ack
    • False
    • Hide

      None

      Show
      None
    • No
    • None
    • Hide

      The caddy service does not trigger any SELinux denials in default configuration. The caddy service starts and runs successfully in enforcing mode.

      Show
      The caddy service does not trigger any SELinux denials in default configuration. The caddy service starts and runs successfully in enforcing mode.
    • Pass
    • Automated
    • Release Note Not Required
    • All
    • None

      What were you trying to do that didn't work?

      Please provide the package NVR for which bug is seen:

      selinux-policy-3.14.3-134.el8.noarch
      selinux-policy-targeted-3.14.3-134.el8.noarch
      caddy-2.6.4-2.el8.x86_64 (comes from EPEL)

      How reproducible:

      always

      Steps to reproduce

      1. get a RHEL-8.10 machine (targeted policy is active)
      2. start the caddy service
      3. search for SELinux denials

      Expected results

      no SELinux denials

      Actual results (enforcing mode)

      ----
type=PROCTITLE msg=audit(01/25/2024 16:29:04.633:383) : proctitle=/usr/bin/caddy run --environ --config /etc/caddy/Caddyfile 
type=PATH msg=audit(01/25/2024 16:29:04.633:383) : item=0 name=/proc/sys/net/core/somaxconn inode=81663 dev=00:05 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:sysctl_net_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(01/25/2024 16:29:04.633:383) : cwd=/ 
type=SYSCALL msg=audit(01/25/2024 16:29:04.633:383) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=AT_FDCWD a1=0xc0004313a0 a2=O_RDONLY|O_CLOEXEC a3=0x0 items=1 ppid=1 pid=39577 auid=unset uid=caddy gid=caddy euid=caddy suid=caddy fsuid=caddy egid=caddy sgid=caddy fsgid=caddy tty=(none) ses=unset comm=caddy exe=/usr/bin/caddy subj=system_u:system_r:httpd_t:s0 key=(null) 
type=AVC msg=audit(01/25/2024 16:29:04.633:383) : avc:  denied  { read } for  pid=39577 comm=caddy name=somaxconn dev="proc" ino=81663 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file permissive=0 
----

      Actual results (permissive mode)

      ----
type=PROCTITLE msg=audit(01/25/2024 16:29:24.079:389) : proctitle=/usr/bin/caddy run --environ --config /etc/caddy/Caddyfile 
type=PATH msg=audit(01/25/2024 16:29:24.079:389) : item=0 name=/proc/sys/net/core/somaxconn inode=81663 dev=00:05 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:sysctl_net_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(01/25/2024 16:29:24.079:389) : cwd=/ 
type=SYSCALL msg=audit(01/25/2024 16:29:24.079:389) : arch=x86_64 syscall=openat success=yes exit=7 a0=AT_FDCWD a1=0xc0004300a0 a2=O_RDONLY|O_CLOEXEC a3=0x0 items=1 ppid=1 pid=42172 auid=unset uid=caddy gid=caddy euid=caddy suid=caddy fsuid=caddy egid=caddy sgid=caddy fsgid=caddy tty=(none) ses=unset comm=caddy exe=/usr/bin/caddy subj=system_u:system_r:httpd_t:s0 key=(null) 
type=AVC msg=audit(01/25/2024 16:29:24.079:389) : avc:  denied  { open } for  pid=42172 comm=caddy path=/proc/sys/net/core/somaxconn dev="proc" ino=81663 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file permissive=1 
type=AVC msg=audit(01/25/2024 16:29:24.079:389) : avc:  denied  { read } for  pid=42172 comm=caddy name=somaxconn dev="proc" ino=81663 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file permissive=1 
----

              rhn-support-zpytela Zdenek Pytela
              mmalik@redhat.com Milos Malik
              Zdenek Pytela Zdenek Pytela
              Milos Malik Milos Malik
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

                Created:
                Updated:
                Resolved: