Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-35644

[RHEL-10]avc: denied { name_bind } for pid=7379 comm=rpcbind

    • rhel-sst-filesystems
    • ssg_filesystems_storage_and_HA
    • 24
    • 1
    • False
    • Hide

      None

      Show
      None
    • None
    • Red Hat Enterprise Linux
    • None
    • All
    • None

      What were you trying to do that didn't work?
      See below avc denied log during ec2 test.

      
      
      
      2024-05-06 17:41:06,859:INFO:Run on remote: sudo ausearch -i -m AVC -ts today 13:40:53|grep -Ev "os_tests.tests.test_general_check.TestGeneralCheck.test_check_avclog_nfs"|grep -Ev test_check
      2024-05-06 17:41:07,439:INFO:CMD ret: 0 out:----
      type=PROCTITLE msg=audit(05/06/24 13:40:54.531:1772) : proctitle=/usr/bin/rpcbind -w -f 
      type=SYSCALL msg=audit(05/06/24 13:40:54.531:1772) : arch=x86_64 syscall=bind success=no exit=EACCES(Permission denied) a0=0xa a1=0x7ffc6fceb8e0 a2=0x10 a3=0x55798ad60010 items=0 ppid=1 pid=7379 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=rpcbind exe=/usr/bin/rpcbind subj=system_u:system_r:rpcbind_t:s0 key=(null) 
      type=AVC msg=audit(05/06/24 13:40:54.531:1772) : avc:  denied  { name_bind } for  pid=7379 comm=rpcbind src=61208 scontext=system_u:system_r:rpcbind_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=udp_socket permissive=0 
      ----
      type=PROCTITLE msg=audit(05/06/24 13:40:54.532:1773) : proctitle=/usr/bin/rpcbind -w -f 
      type=SYSCALL msg=audit(05/06/24 13:40:54.532:1773) : arch=x86_64 syscall=bind success=no exit=EACCES(Permission denied) a0=0xb a1=0x7ffc6fceb8e0 a2=0x1c a3=0x55798ad60010 items=0 ppid=1 pid=7379 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=rpcbind exe=/usr/bin/rpcbind subj=system_u:system_r:rpcbind_t:s0 key=(null) 
      type=AVC msg=audit(05/06/24 13:40:54.532:1773) : avc:  denied  { name_bind } for  pid=7379 comm=rpcbind src=62595 scontext=system_u:system_r:rpcbind_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=udp_socket permissive=0 
      2024-05-06 17:40:51,736:INFO:Run on remote: rpm -qa selinux\* container\* | sort
      2024-05-06 17:40:52,163:INFO:CMD ret: 0 out:container-selinux-2.229.0-2.el10.noarch
      containers-common-0.57.3-3.el10.noarch
      containers-common-extra-0.57.3-3.el10.noarch
      selinux-policy-40.13-1.el10.noarch
      selinux-policy-targeted-40.13-1.el10.noarch
      

      Please provide the package NVR for which bug is seen:
      6.9.0-0.rc2.1.el10.x86_64

      How reproducible:
      100%

      Steps to reproduce

      • run test_check_avclog_nfs on aws

      Expected results
      No avc denied log

      Actual results
      rpcbind avc denied log detected.

              stevedatrhn Steve Dickson
              xiliang@redhat.com Frank Liang
              Steve Dickson Steve Dickson
              Yongcheng Yang Yongcheng Yang
              Votes:
              0 Vote for this issue
              Watchers:
              15 Start watching this issue

                Created:
                Updated: