Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1814142 - the openhpid service triggers SELinux denials: setsched + sys_nice
Summary: the openhpid service triggers SELinux denials: setsched + sys_nice
Keywords:
Status: CLOSED DUPLICATE of bug 1811407
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 32
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-03-17 08:15 UTC by Milos Malik
Modified: 2020-05-28 21:12 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-04-09 13:42:23 UTC
Type: Bug
Embargoed:

Attachments (Terms of Use)

Description Milos Malik 2020-03-17 08:15:47 UTC 
Description of problem:
 * the openhpid service runs successfully even if the denials appear

Version-Release number of selected component (if applicable):
openhpi-3.8.0-10.fc32.x86_64
openhpi-libs-3.8.0-10.fc32.x86_64
selinux-policy-3.14.5-28.fc32.noarch
selinux-policy-targeted-3.14.5-28.fc32.noarch

How reproducible:
 * always

Steps to Reproduce:
1. get a Fedora 32 machine (targeted policy is active)
2. remove the OPENHPI_UNCONFIGURED line from /etc/openhpi/openhpi.conf file
3. start the openhpid service
4. search for SELinux denials

Actual results (enforcing mode):
----
type=PROCTITLE msg=audit(03/17/2020 04:10:18.052:360) : proctitle=/usr/sbin/openhpid -c /etc/openhpi/openhpi.conf 
type=SYSCALL msg=audit(03/17/2020 04:10:18.052:360) : arch=x86_64 syscall=sched_setattr success=no exit=EACCES(Permission denied) a0=0x63e a1=0x55c86579aab0 a2=0x0 a3=0x7ff2cce78a40 items=0 ppid=1 pid=1598 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=openhpid exe=/usr/sbin/openhpid subj=system_u:system_r:openhpid_t:s0 key=(null) 
type=AVC msg=audit(03/17/2020 04:10:18.052:360) : avc:  denied  { setsched } for  pid=1598 comm=openhpid scontext=system_u:system_r:openhpid_t:s0 tcontext=system_u:system_r:openhpid_t:s0 tclass=process permissive=0 
type=AVC msg=audit(03/17/2020 04:10:18.052:360) : avc:  denied  { sys_nice } for  pid=1598 comm=openhpid capability=sys_nice  scontext=system_u:system_r:openhpid_t:s0 tcontext=system_u:system_r:openhpid_t:s0 tclass=capability permissive=0 
----

Expected results:
 * no SELinux denials
Comment 1 Milos Malik 2020-03-17 08:18:36 UTC 
Actual results (permissive mode):
----
type=PROCTITLE msg=audit(03/17/2020 04:17:30.146:367) : proctitle=/usr/sbin/openhpid -c /etc/openhpi/openhpi.conf 
type=SYSCALL msg=audit(03/17/2020 04:17:30.146:367) : arch=x86_64 syscall=sched_setattr success=yes exit=0 a0=0x67e a1=0x55eaa59efa80 a2=0x0 a3=0x7f479ce07a40 items=0 ppid=1 pid=1662 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=openhpid exe=/usr/sbin/openhpid subj=system_u:system_r:openhpid_t:s0 key=(null) 
type=AVC msg=audit(03/17/2020 04:17:30.146:367) : avc:  denied  { setsched } for  pid=1662 comm=openhpid scontext=system_u:system_r:openhpid_t:s0 tcontext=system_u:system_r:openhpid_t:s0 tclass=process permissive=1 
type=AVC msg=audit(03/17/2020 04:17:30.146:367) : avc:  denied  { sys_nice } for  pid=1662 comm=openhpid capability=sys_nice  scontext=system_u:system_r:openhpid_t:s0 tcontext=system_u:system_r:openhpid_t:s0 tclass=capability permissive=1 
----

There are no additional SELinux denials recorded on the machine.
Comment 2 Milos Malik 2020-03-17 08:31:11 UTC 
After upgrading selinux-policy* packages to 3.14.5-30.fc32 the number of SELinux denials decreases:
----
type=PROCTITLE msg=audit(03/17/2020 04:30:02.890:383) : proctitle=/usr/sbin/openhpid -c /etc/openhpi/openhpi.conf 
type=SYSCALL msg=audit(03/17/2020 04:30:02.890:383) : arch=x86_64 syscall=sched_setattr success=no exit=EACCES(Permission denied) a0=0x9bb a1=0x559a6eed9a80 a2=0x0 a3=0x7ff4cf883a40 items=0 ppid=1 pid=2491 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=openhpid exe=/usr/sbin/openhpid subj=system_u:system_r:openhpid_t:s0 key=(null) 
type=AVC msg=audit(03/17/2020 04:30:02.890:383) : avc:  denied  { sys_nice } for  pid=2491 comm=openhpid capability=sys_nice  scontext=system_u:system_r:openhpid_t:s0 tcontext=system_u:system_r:openhpid_t:s0 tclass=capability permissive=0 
----
Comment 3 Milos Malik 2020-03-17 08:34:57 UTC 
Following SELinux denial still appears:
----
type=PROCTITLE msg=audit(03/17/2020 04:33:53.480:388) : proctitle=/usr/sbin/openhpid -c /etc/openhpi/openhpi.conf 
type=SYSCALL msg=audit(03/17/2020 04:33:53.480:388) : arch=x86_64 syscall=sched_setattr success=yes exit=0 a0=0x9d6 a1=0x56418ff41a80 a2=0x0 a3=0x7f3f92ee4a40 items=0 ppid=1 pid=2518 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=openhpid exe=/usr/sbin/openhpid subj=system_u:system_r:openhpid_t:s0 key=(null) 
type=AVC msg=audit(03/17/2020 04:33:53.480:388) : avc:  denied  { sys_nice } for  pid=2518 comm=openhpid capability=sys_nice  scontext=system_u:system_r:openhpid_t:s0 tcontext=system_u:system_r:openhpid_t:s0 tclass=capability permissive=1 
----
Comment 4 Zdenek Pytela 2020-04-09 13:42:23 UTC 

*** This bug has been marked as a duplicate of bug 1811407 ***
Note You need to log in before you can comment on or make changes to this bug.