Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-94508

[c9s] bootupctl adopt get selinux denied logs

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Normal Normal
    • rhel-9.7
    • CentOS Stream 9
    • selinux-policy
    • None
    • selinux-policy-38.1.58-1.el9
    • No
    • Moderate
    • 1
    • rhel-security-selinux
    • ssg_security
    • 17
    • 1
    • QE ack
    • False
    • False
    • Hide

      None

      Show
      None
    • No
    • SELINUX 250625: 8
    • Release Note Not Required
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      Run `bootupctl adopt-and-update` on centos stream 9, get avc denied logs.

      Versions:
      selinux-policy-38.1.56-1.el9.noarch
      bootupd-0.2.27-3.el9.x86_64

      [root@cosa-devsh core]# mount -o remount,rw /boot
      [root@cosa-devsh core]# rm -f /boot/bootupd-state.json 
      [root@cosa-devsh core]# bootupctl adopt-and-update
      Running as unit: bootupd.service
      Adopted and updated: BIOS: grub2-tools-1:2.06-107.el9.x86_64
      Adopted and updated: EFI: grub2-efi-x64-1:2.06-107.el9.x86_64,shim-x64-15-15.el8_2.x86_64
      [root@cosa-devsh core]# ausearch -m avc
      ----
      time->Fri May 30 02:37:46 2025
      type=PROCTITLE msg=audit(1748572666.250:101): proctitle=2F62696E2F626F6F74757063746C00757064617465
      type=PATH msg=audit(1748572666.250:101): item=0 name="/tmp" inode=19 dev=00:1f mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tmp_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
      type=CWD msg=audit(1748572666.250:101): cwd="/"
      type=SYSCALL msg=audit(1748572666.250:101): arch=c000003e syscall=257 success=yes exit=5 a0=ffffff9c a1=7ffe66a61730 a2=490002 a3=1b6 items=1 ppid=1 pid=2073 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="bootupctl" exe="/usr/bin/bootupctl" subj=system_u:system_r:bootupd_t:s0 key=(null)
      type=AVC msg=audit(1748572666.250:101): avc:  denied  { write open } for  pid=2073 comm="bootupctl" path=2F746D702F233139202864656C6574656429 dev="tmpfs" ino=19 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file permissive=1
      type=AVC msg=audit(1748572666.250:101): avc:  denied  { write } for  pid=2073 comm="bootupctl" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir permissive=1
      ----
      time->Fri May 30 02:37:46 2025
      type=PROCTITLE msg=audit(1748572666.263:102): proctitle=73666469736B002D4A002F6465762F766461
      type=PATH msg=audit(1748572666.263:102): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=6912 dev=00:22 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
      type=PATH msg=audit(1748572666.263:102): item=0 name="/7e/4df395d734709ab17963fbcd730001bccbda5862edb4f814f692794c1506a8.file" inode=309 dev=fc:04 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:fsadm_exec_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
      type=CWD msg=audit(1748572666.263:102): cwd="/"
      type=EXECVE msg=audit(1748572666.263:102): argc=3 a0="sfdisk" a1="-J" a2="/dev/vda"
      type=SYSCALL msg=audit(1748572666.263:102): arch=c000003e syscall=59 success=yes exit=0 a0=7f31d982fdc0 a1=5639ec403060 a2=7ffe66a63440 a3=8 items=2 ppid=2073 pid=2076 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sfdisk" exe="/usr/sbin/sfdisk" subj=system_u:system_r:bootupd_t:s0 key=(null)
      type=AVC msg=audit(1748572666.263:102): avc:  denied  { map } for  pid=2076 comm="sfdisk" path="/usr/sbin/sfdisk" dev="overlay" ino=11856 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:fsadm_exec_t:s0 tclass=file permissive=1
      type=AVC msg=audit(1748572666.263:102): avc:  denied  { execute_no_trans } for  pid=2076 comm="bootupctl" path="/usr/sbin/sfdisk" dev="overlay" ino=11856 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:fsadm_exec_t:s0 tclass=file permissive=1
      type=AVC msg=audit(1748572666.263:102): avc:  denied  { read open } for  pid=2076 comm="bootupctl" path="/usr/sbin/sfdisk" dev="overlay" ino=11856 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:fsadm_exec_t:s0 tclass=file permissive=1
      type=AVC msg=audit(1748572666.263:102): avc:  denied  { execute } for  pid=2076 comm="bootupctl" name="sfdisk" dev="overlay" ino=11856 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:fsadm_exec_t:s0 tclass=file permissive=1
      ----
      time->Fri May 30 02:37:46 2025
      type=PROCTITLE msg=audit(1748572666.267:103): proctitle=73666469736B002D4A002F6465762F766461
      type=SYSCALL msg=audit(1748572666.267:103): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=7ffc1c0c7f4a a2=80000 a3=0 items=0 ppid=2073 pid=2076 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sfdisk" exe="/usr/sbin/sfdisk" subj=system_u:system_r:bootupd_t:s0 key=(null)
      type=AVC msg=audit(1748572666.267:103): avc:  denied  { open } for  pid=2076 comm="sfdisk" path="/dev/vda" dev="devtmpfs" ino=292 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file permissive=1
      type=AVC msg=audit(1748572666.267:103): avc:  denied  { read } for  pid=2076 comm="sfdisk" name="vda" dev="devtmpfs" ino=292 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file permissive=1
      ----
      time->Fri May 30 02:37:46 2025
      type=PROCTITLE msg=audit(1748572666.268:104): proctitle=73666469736B002D4A002F6465762F766461
      type=SYSCALL msg=audit(1748572666.268:104): arch=c000003e syscall=16 success=yes exit=0 a0=3 a1=80081272 a2=7ffc1c0c5b20 a3=1 items=0 ppid=2073 pid=2076 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sfdisk" exe="/usr/sbin/sfdisk" subj=system_u:system_r:bootupd_t:s0 key=(null)
      type=AVC msg=audit(1748572666.268:104): avc:  denied  { ioctl } for  pid=2076 comm="sfdisk" path="/dev/vda" dev="devtmpfs" ino=292 ioctlcmd=0x1272 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file permissive=1
      

              rhn-support-zpytela Zdenek Pytela
              hhei@redhat.com Huijing Hei
              Zdenek Pytela Zdenek Pytela
              Milos Malik Milos Malik
              Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

                Created:
                Updated: