Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-5171

SELinux Policy sets selinuxuser_execmod=off on ppc64le

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Undefined Undefined
    • None
    • rhel-9.2.0
    • selinux-policy
    • None
    • Important
    • rhel-security-selinux
    • ssg_security
    • None
    • False
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • If docs needed, set a value
    • None
    • 57,005

      Description of problem:
      selinux-policy seems to set selinuxuser_execmod=off by default on Power systems

      This results in issues when running OpenShift with privileged pods.

      sh-5.1# rpm -q container-selinux
      container-selinux-2.219.0-1.rhaos4.13.el9.noarch
      sh-5.1# ausearch -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR -ts recent -i | audit2allow

      #============= spc_t ==============

      #!!!! This avc can be allowed using the boolean 'selinuxuser_execmod'
      allow spc_t container_ro_file_t:file execmod;

      See https://bugzilla.redhat.com/show_bug.cgi?id=2230462 for the error in the package consumed by OpenShift.

      Version-Release number of selected component (if applicable):

      How reproducible:
      We've been running openshift-tests on Power systems with the latest builds of RHCOS.

      Steps to Reproduce:
      1. Deploy openshift
      2. Run openShift tests
      3. Audit results for selinux denials

      Actual results:

      sh-5.1# ausearch -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR -ts recent -i | audit2allow

      #============= spc_t ==============

      #!!!! This avc can be allowed using the boolean 'selinuxuser_execmod'
      allow spc_t container_ro_file_t:file execmod;

      Expected results:
      No errors

      Additional info:
      This seems only to be set off on Power. Other architectures are able to run privileged containers without issue.

              rhatdan Daniel Walsh (Inactive)
              jpoulin Jeremy Poulin
              SSG Security QE SSG Security QE
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: