Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-38905

[ptp4l service]denied { module_request } tcontext=system_u:system_r:kernel_t:s0

    • selinux-policy-38.1.40-1.el9
    • None
    • Moderate
    • rhel-sst-security-selinux
    • ssg_security
    • 17
    • None
    • False
    • Hide

      None

      Show
      None
    • No
    • None
    • Hide

      SELinux policy allows the ptp4l service to load kernel modules without the need to enable any SELinux booleans.

      Show
      SELinux policy allows the ptp4l service to load kernel modules without the need to enable any SELinux booleans.
    • Pass
    • None
    • Unspecified Release Note Type - Unknown
    • x86_64
    • None

      What were you trying to do that didn't work?

      start ptp4l service and got avc error log under selinux enforce mode.

      Please provide the package NVR for which bug is seen:

      kernel version: 5.14.0-452.el9/ 5.14.0-427.20.1.el9_4

      linuxptp: linuxptp-4.2-2.el9.x86_64

      How reproducible: 100%

      Steps to reproduce

      1. configure /etc/ptp4l.conf as belo

       

      cat /etc/ptp4l.conf 
      # For more information about this file, see the ptp4l(8) man page.
      # Examples are available in /usr/share/doc/linuxptp/configs.
      [global]
      domainNumber        0
      slaveOnly        1
      time_stamping        hardware
      tx_timestamp_timeout    1
      logging_level        6
      summary_interval    0
      [eth0]
      network_transport    UDPv4
      hybrid_e2e        0
      

       

      2. configure /etc/sysconfig/ptp4l as below

      cat /etc/sysconfig/ptp4l
      OPTIONS="-f /etc/ptp4l.conf -i ens7f0"

      3. start ptp4l service

       

      systemctl start ptp4l
      systemctl status ptp4l -l --no-pager
      

       

       

      ● ptp4l.service - Precision Time Protocol (PTP) service
           Loaded: loaded (/usr/lib/systemd/system/ptp4l.service; disabled; preset: disabled)
           Active: active (running) since Mon 2024-05-27 22:38:51 EDT; 7min ago
         Main PID: 10691 (ptp4l)
            Tasks: 1 (limit: 405873)
           Memory: 688.0K
              CPU: 13ms
           CGroup: /system.slice/ptp4l.service
                   └─10691 /usr/sbin/ptp4l -f /etc/ptp4l.conf -i ens7f0
      May 27 22:46:05 dell-per750-09.rhts.eng.pek2.redhat.com ptp4l[10691]: [613.391] port 2 (eth0): defaultDS.priority1 probably misconfigured
      May 27 22:46:13 dell-per750-09.rhts.eng.pek2.redhat.com ptp4l[10691]: [621.390] port 2 (eth0): assuming the grand master role
      May 27 22:46:13 dell-per750-09.rhts.eng.pek2.redhat.com ptp4l[10691]: [621.390] port 2 (eth0): master state recommended in slave only mode
      May 27 22:46:13 dell-per750-09.rhts.eng.pek2.redhat.com ptp4l[10691]: [621.390] port 2 (eth0): defaultDS.priority1 probably misconfigured
      May 27 22:46:19 dell-per750-09.rhts.eng.pek2.redhat.com ptp4l[10691]: [627.958] port 2 (eth0): assuming the grand master role
      May 27 22:46:19 dell-per750-09.rhts.eng.pek2.redhat.com ptp4l[10691]: [627.958] port 2 (eth0): master state recommended in slave only mode
      May 27 22:46:19 dell-per750-09.rhts.eng.pek2.redhat.com ptp4l[10691]: [627.958] port 2 (eth0): defaultDS.priority1 probably misconfigured
      May 27 22:46:26 dell-per750-09.rhts.eng.pek2.redhat.com ptp4l[10691]: [634.405] port 2 (eth0): assuming the grand master role
      May 27 22:46:26 dell-per750-09.rhts.eng.pek2.redhat.com ptp4l[10691]: [634.405] port 2 (eth0): master state recommended in slave only mode
      May 27 22:46:26 dell-per750-09.rhts.eng.pek2.redhat.com ptp4l[10691]: [634.405] port 2 (eth0): defaultDS.priority1 probably misconfigured
      

       

      Expected results

      Actual results

      [root@dell-per750-09 ~]# sealert -a /var/log/audit/audit.log
      100% done
      found 1 alerts in /var/log/audit/audit.log
      --------------------------------------------------------------------------------SELinux is preventing /usr/sbin/ptp4l from module_request access on the system labeled kernel_t.*****  Plugin catchall_boolean (89.3 confidence) suggests   ******************If you want to allow domain to kernel load modules
      Then you must tell SELinux about this by enabling the 'domain_kernel_load_modules' boolean.Do
      setsebool -P domain_kernel_load_modules 1*****  Plugin catchall (11.6 confidence) suggests   **************************If you believe that ptp4l should be allowed module_request access on system labeled kernel_t by default.
      Then you should report this as a bug.
      You can generate a local policy module to allow this access.
      Do
      allow this access for now by executing:
      # ausearch -c 'ptp4l' --raw | audit2allow -M my-ptp4l
      # semodule -X 300 -i my-ptp4l.pp
      Additional Information:
      Source Context                system_u:system_r:ptp4l_t:s0
      Target Context                system_u:system_r:kernel_t:s0
      Target Objects                Unknown [ system ]
      Source                        ptp4l
      Source Path                   /usr/sbin/ptp4l
      Port                          <Unknown>
      Host                          <Unknown>
      Source RPM Packages           linuxptp-4.2-2.el9.x86_64
      Target RPM Packages           
      SELinux Policy RPM            selinux-policy-targeted-38.1.38-1.el9.noarch
      Local Policy RPM              selinux-policy-targeted-38.1.38-1.el9.noarch
      Selinux Enabled               True
      Policy Type                   targeted
      Enforcing Mode                Enforcing
      Host Name                     dell-per750-09.rhts.eng.pek2.redhat.com
      Platform                      Linux dell-per750-09.rhts.eng.pek2.redhat.com
                                    5.14.0-452.el9.x86_64 #1 SMP PREEMPT_RT Sat May
                                    18 19:04:07 EDT 2024 x86_64 x86_64
      Alert Count                   6
      First Seen                    2024-05-27 22:13:38 EDT
      Last Seen                     2024-05-27 22:13:38 EDT
      Local ID                      dfb5908a-971e-4c7a-b953-9efa5839dd2cRaw Audit Messages
      type=AVC msg=audit(1716862418.381:226): avc:  denied  { module_request } for  pid=13694 comm="ptp4l" kmod="netdev-eth0" scontext=system_u:system_r:ptp4l_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system permissive=0
      type=SYSCALL msg=audit(1716862418.381:226): arch=x86_64 syscall=ioctl success=no exit=ENODEV a0=1a a1=8933 a2=7fff83c07cb0 a3=7f73dfb5cac0 items=0 ppid=1 pid=13694 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=ptp4l exe=/usr/sbin/ptp4l subj=system_u:system_r:ptp4l_t:s0 key=(null)ARCH=x86_64 SYSCALL=ioctl AUID=unset UID=root GID=root EUID=root SUID=root FSUID=root EGID=root SGID=root FSGID=rootHash: ptp4l,ptp4l_t,kernel_t,system,module_request
       

              rhn-support-zpytela Zdenek Pytela
              mhou@redhat.com Minxi Hou
              Zdenek Pytela Zdenek Pytela
              Milos Malik Milos Malik
              Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

                Created:
                Updated:
                Resolved: