-
Bug
-
Resolution: Done
-
Undefined
-
None
-
rhel-10.0
-
None
-
No
-
None
-
rhel-sst-security-selinux
-
ssg_security
-
None
-
False
-
-
None
-
None
-
None
-
None
-
Unspecified
-
Unspecified
-
Unspecified
-
None
Please provide the package NVR for which the bug is seen:
audit-4.0.3-1.el10.x86_64
selinux-policy-40.13.25-1.el10.noarch
How reproducible is this bug?
always
Steps to reproduce
- get a RHEL-10.0 machine (targeted policy is active)
- git clone https://src.fedoraproject.org/tests/dhcpcd
- run the test stored in Sanity/ipv4-tests directory
- search for SELinux denials
Expected results
- no SELinux denials
Actual results
---- type=PROCTITLE msg=audit(03/06/2025 04:15:47.410:703) : proctitle=dhcpcd -4 -M -d --logfile /var/run/dhcpcd-ci/dhcpcd-test.log.dhcpcd-domain-dns.conf -f /var/run/dhcpcd-ci/dhcpcd-domain-dns.conf type=PATH msg=audit(03/06/2025 04:15:47.410:703) : item=0 name=/var/run/dhcpcd-ci/dhcpcd-domain-dns.conf inode=2012 dev=00:1a mode=file,644 ouid=root ogid=root rdev=00:00 obj=unconfined_u:object_r:var_run_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(03/06/2025 04:15:47.410:703) : cwd=/root/dhcpcd/Sanity/ipv4-tests type=SYSCALL msg=audit(03/06/2025 04:15:47.410:703) : arch=x86_64 syscall=openat success=yes exit=4 a0=AT_FDCWD a1=0x55c0ce7d4490 a2=O_RDONLY a3=0x0 items=1 ppid=8221 pid=8234 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=4 comm=dhcpcd exe=/usr/sbin/dhcpcd subj=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(03/06/2025 04:15:47.410:703) : avc: denied { open } for pid=8234 comm=dhcpcd path=/run/dhcpcd-ci/dhcpcd-domain-dns.conf dev="tmpfs" ino=2012 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=file permissive=1 type=AVC msg=audit(03/06/2025 04:15:47.410:703) : avc: denied { read } for pid=8234 comm=dhcpcd name=dhcpcd-domain-dns.conf dev="tmpfs" ino=2012 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=file permissive=1 ---- type=PROCTITLE msg=audit(03/06/2025 04:15:47.411:704) : proctitle=dhcpcd -4 -M -d --logfile /var/run/dhcpcd-ci/dhcpcd-test.log.dhcpcd-domain-dns.conf -f /var/run/dhcpcd-ci/dhcpcd-domain-dns.conf type=PATH msg=audit(03/06/2025 04:15:47.411:704) : item=0 name=/var/run/dhcpcd-ci/dhcpcd-domain-dns.conf inode=2012 dev=00:1a mode=file,644 ouid=root ogid=root rdev=00:00 obj=unconfined_u:object_r:var_run_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(03/06/2025 04:15:47.411:704) : cwd=/root/dhcpcd/Sanity/ipv4-tests type=SYSCALL msg=audit(03/06/2025 04:15:47.411:704) : arch=x86_64 syscall=newfstatat success=yes exit=0 a0=AT_FDCWD a1=0x55c0ce7d4490 a2=0x7ffee5d375c0 a3=0x0 items=1 ppid=8221 pid=8234 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=4 comm=dhcpcd exe=/usr/sbin/dhcpcd subj=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(03/06/2025 04:15:47.411:704) : avc: denied { getattr } for pid=8234 comm=dhcpcd path=/run/dhcpcd-ci/dhcpcd-domain-dns.conf dev="tmpfs" ino=2012 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=file permissive=1 ----
https://artifacts.osci.redhat.com/testing-farm/57af7453-27cd-4694-abd9-3561cf366989/
see part:
/plans/cs_stacks/image-mode-critical-tier1/dhcpcd fail
avc denial: