-
Bug
-
Resolution: Unresolved
-
Normal
-
rhel-10.0
-
selinux-policy-40.13.28-1.el10
-
No
-
Moderate
-
1
-
rhel-security-selinux
-
ssg_security
-
8
-
2
-
QE ack
-
False
-
False
-
-
No
-
SELINUX 250423: 5
-
-
Pass
-
Automated
-
Release Note Not Required
-
Unspecified
-
Unspecified
-
Unspecified
-
-
x86_64
-
None
What were you trying to do that didn't work?
What is the impact of this issue to you?
Please provide the package NVR for which the bug is seen:
chrony-4.6.1-1.el10.x86_64
selinux-policy-40.13.26-1.el10.noarch
selinux-policy-devel-40.13.26-1.el10.noarch
selinux-policy-targeted-40.13.26-1.el10.noarch
How reproducible is this bug?
always
Steps to reproduce
- get a RHEL-10.0 machine (targeted policy is active)
- service chronyd stop
- service chronyd-restricted start
- chronyc reload sources
- ausearch -m avc -i -ts recent
Expected results
- no error messages
- no SELinux denials
Actual results (enforcing mode):
506 Cannot talk to daemon
---- type=PROCTITLE msg=audit(03/05/2025 13:10:07.576:492) : proctitle=chronyc reload sources type=PATH msg=audit(03/05/2025 13:10:07.576:492) : item=0 name=/run/chrony/chronyd.sock inode=1985 dev=00:1a mode=socket,700 ouid=chrony ogid=chrony rdev=00:00 obj=system_u:object_r:chronyd_var_run_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(03/05/2025 13:10:07.576:492) : cwd=/root type=SOCKADDR msg=audit(03/05/2025 13:10:07.576:492) : saddr={ saddr_fam=local path=/run/chrony/chronyd.sock } type=SYSCALL msg=audit(03/05/2025 13:10:07.576:492) : arch=x86_64 syscall=connect success=no exit=EACCES(Permission denied) a0=0x3 a1=0x7fff594077b0 a2=0x6e a3=0x0 items=1 ppid=5018 pid=43070 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=4 comm=chronyc exe=/usr/bin/chronyc subj=unconfined_u:unconfined_r:chronyc_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(03/05/2025 13:10:07.576:492) : avc: denied { sendto } for pid=43070 comm=chronyc path=/run/chrony/chronyd.sock scontext=unconfined_u:unconfined_r:chronyc_t:s0-s0:c0.c1023 tcontext=system_u:system_r:chronyd_restricted_t:s0 tclass=unix_dgram_socket permissive=0 ----
- is cloned by
-
RHEL-82308 [rhel-9] SELinux prevents chronyc from talking to chronyd-restricted via socket
-
- Release Pending
-
- links to
-
RHBA-2025:147963 selinux-policy bug fix and enhancement update