dogtagpki

#2725 AVC denials during RHCS subsystems install
Closed: wontfix Opened by mharmsen.

Closed: wontfix
Reopen Issue

pkispawn of RHCS subsystems shows AVC denials for /usr/sbin/ldconfig.

Steps to Reproduce:

1. pkispawn a CA instance with internal soft token.
2. Installation is successful.

Actual results:

3. Following AVCs are thrown:
time->Fri Jun  2 10:41:48 2017
type=PROCTITLE msg=audit(1496414508.546:90): proctitle=7368002D63002F7362696E2F
6C64636F6E666967202D7020323E2F6465762F6E756C6C
type=SYSCALL msg=audit(1496414508.546:90): arch=c000003e syscall=59 success=no
exit=-13 a0=1517250 a1=15165a0 a2=1515960 a3=7ffe07dfaea0 items=0 ppid=11540
pid=11541 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17
sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="sh" exe="/usr/bin/bash"
subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
type=AVC msg=audit(1496414508.546:90): avc:  denied  { execute } for  pid=11541
comm="sh" name="ldconfig" dev="dm-0" ino=33577980
scontext=system_u:system_r:pki_tomcat_t:s0
tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file
----
time->Fri Jun  2 10:41:48 2017
type=PROCTITLE msg=audit(1496414508.546:91): proctitle=7368002D63002F7362696E2F
6C64636F6E666967202D7020323E2F6465762F6E756C6C
type=SYSCALL msg=audit(1496414508.546:91): arch=c000003e syscall=4 success=no
exit=-13 a0=1517250 a1=7ffe07dfb0e0 a2=7ffe07dfb0e0 a3=7ffe07dfaea0 items=0
ppid=11540 pid=11541 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17
egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="sh"
exe="/usr/bin/bash" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
type=AVC msg=audit(1496414508.546:91): avc:  denied  { getattr } for  pid=11541
comm="sh" path="/usr/sbin/ldconfig" dev="dm-0" ino=33577980
scontext=system_u:system_r:pki_tomcat_t:s0
tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file
----
time->Fri Jun  2 10:41:48 2017
type=PROCTITLE msg=audit(1496414508.546:92): proctitle=7368002D63002F7362696E2F
6C64636F6E666967202D7020323E2F6465762F6E756C6C
type=SYSCALL msg=audit(1496414508.546:92): arch=c000003e syscall=4 success=no
exit=-13 a0=1517250 a1=7ffe07dfb0c0 a2=7ffe07dfb0c0 a3=7ffe07dfaea0 items=0
ppid=11540 pid=11541 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17
egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="sh"
exe="/usr/bin/bash" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
type=AVC msg=audit(1496414508.546:92): avc:  denied  { getattr } for  pid=11541
comm="sh" path="/usr/sbin/ldconfig" dev="dm-0" ino=33577980
scontext=system_u:system_r:pki_tomcat_t:s0
tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file
----
time->Fri Jun  2 10:41:48 2017
type=PROCTITLE msg=audit(1496414508.557:93): proctitle=7368002D63002F7362696E2F
6C64636F6E666967202D7020323E2F6465762F6E756C6C
type=SYSCALL msg=audit(1496414508.557:93): arch=c000003e syscall=59 success=no
exit=-13 a0=2116250 a1=21155a0 a2=2114960 a3=7ffc72521a70 items=0 ppid=11546
pid=11547 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17
sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="sh" exe="/usr/bin/bash"
subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
type=AVC msg=audit(1496414508.557:93): avc:  denied  { execute } for  pid=11547
comm="sh" name="ldconfig" dev="dm-0" ino=33577980
scontext=system_u:system_r:pki_tomcat_t:s0
tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file
----
time->Fri Jun  2 10:41:48 2017
type=PROCTITLE msg=audit(1496414508.557:94): proctitle=7368002D63002F7362696E2F
6C64636F6E666967202D7020323E2F6465762F6E756C6C
type=SYSCALL msg=audit(1496414508.557:94): arch=c000003e syscall=4 success=no
exit=-13 a0=2116250 a1=7ffc72521cb0 a2=7ffc72521cb0 a3=7ffc72521a70 items=0
ppid=11546 pid=11547 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17
egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="sh"
exe="/usr/bin/bash" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
type=AVC msg=audit(1496414508.557:94): avc:  denied  { getattr } for  pid=11547
comm="sh" path="/usr/sbin/ldconfig" dev="dm-0" ino=33577980
scontext=system_u:system_r:pki_tomcat_t:s0
tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file
----
time->Fri Jun  2 10:41:48 2017
type=PROCTITLE msg=audit(1496414508.557:95): proctitle=7368002D63002F7362696E2F
6C64636F6E666967202D7020323E2F6465762F6E756C6C
type=SYSCALL msg=audit(1496414508.557:95): arch=c000003e syscall=4 success=no
exit=-13 a0=2116250 a1=7ffc72521c90 a2=7ffc72521c90 a3=7ffc72521a70 items=0
ppid=11546 pid=11547 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17
egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="sh"
exe="/usr/bin/bash" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
type=AVC msg=audit(1496414508.557:95): avc:  denied  { getattr } for  pid=11547
comm="sh" path="/usr/sbin/ldconfig" dev="dm-0" ino=33577980
scontext=system_u:system_r:pki_tomcat_t:s0
tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file
----
time->Fri Jun  2 10:42:17 2017
type=PROCTITLE msg=audit(1496414537.209:99): proctitle=7368002D63002F7362696E2F
6C64636F6E666967202D7020323E2F6465762F6E756C6C
type=SYSCALL msg=audit(1496414537.209:99): arch=c000003e syscall=59 success=no
exit=-13 a0=f5d250 a1=f5c5a0 a2=f5b960 a3=7ffce84fcdf0 items=0 ppid=12206
pid=12207 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17
sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="sh" exe="/usr/bin/bash"
subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
type=AVC msg=audit(1496414537.209:99): avc:  denied  { execute } for  pid=12207
comm="sh" name="ldconfig" dev="dm-0" ino=33577980
scontext=system_u:system_r:pki_tomcat_t:s0
tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file
----
time->Fri Jun  2 10:42:17 2017
type=PROCTITLE msg=audit(1496414537.209:100): proctitle=7368002D63002F7362696E2
F6C64636F6E666967202D7020323E2F6465762F6E756C6C
type=SYSCALL msg=audit(1496414537.209:100): arch=c000003e syscall=4 success=no
exit=-13 a0=f5d250 a1=7ffce84fd030 a2=7ffce84fd030 a3=7ffce84fcdf0 items=0
ppid=12206 pid=12207 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17
egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="sh"
exe="/usr/bin/bash" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
type=AVC msg=audit(1496414537.209:100): avc:  denied  { getattr } for
pid=12207 comm="sh" path="/usr/sbin/ldconfig" dev="dm-0" ino=33577980
scontext=system_u:system_r:pki_tomcat_t:s0
tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file
----
time->Fri Jun  2 10:42:17 2017
type=PROCTITLE msg=audit(1496414537.209:101): proctitle=7368002D63002F7362696E2
F6C64636F6E666967202D7020323E2F6465762F6E756C6C
type=SYSCALL msg=audit(1496414537.209:101): arch=c000003e syscall=4 success=no
exit=-13 a0=f5d250 a1=7ffce84fd010 a2=7ffce84fd010 a3=7ffce84fcdf0 items=0
ppid=12206 pid=12207 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17
egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="sh"
exe="/usr/bin/bash" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
type=AVC msg=audit(1496414537.209:101): avc:  denied  { getattr } for
pid=12207 comm="sh" path="/usr/sbin/ldconfig" dev="dm-0" ino=33577980
scontext=system_u:system_r:pki_tomcat_t:s0
tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file
----
time->Fri Jun  2 10:42:17 2017
type=PROCTITLE msg=audit(1496414537.219:102): proctitle=7368002D63002F7362696E2
F6C64636F6E666967202D7020323E2F6465762F6E756C6C
type=SYSCALL msg=audit(1496414537.219:102): arch=c000003e syscall=59 success=no
exit=-13 a0=1eb6250 a1=1eb55a0 a2=1eb4960 a3=7ffdefdd3b60 items=0 ppid=12212
pid=12213 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17
sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="sh" exe="/usr/bin/bash"
subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
type=AVC msg=audit(1496414537.219:102): avc:  denied  { execute } for
pid=12213 comm="sh" name="ldconfig" dev="dm-0" ino=33577980
scontext=system_u:system_r:pki_tomcat_t:s0
tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file
----
time->Fri Jun  2 10:42:17 2017
type=PROCTITLE msg=audit(1496414537.219:103): proctitle=7368002D63002F7362696E2
F6C64636F6E666967202D7020323E2F6465762F6E756C6C
type=SYSCALL msg=audit(1496414537.219:103): arch=c000003e syscall=4 success=no
exit=-13 a0=1eb6250 a1=7ffdefdd3da0 a2=7ffdefdd3da0 a3=7ffdefdd3b60 items=0
ppid=12212 pid=12213 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17
egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="sh"
exe="/usr/bin/bash" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
type=AVC msg=audit(1496414537.219:103): avc:  denied  { getattr } for
pid=12213 comm="sh" path="/usr/sbin/ldconfig" dev="dm-0" ino=33577980
scontext=system_u:system_r:pki_tomcat_t:s0
tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file
----
time->Fri Jun  2 10:42:17 2017
type=PROCTITLE msg=audit(1496414537.219:104): proctitle=7368002D63002F7362696E2
F6C64636F6E666967202D7020323E2F6465762F6E756C6C
type=SYSCALL msg=audit(1496414537.219:104): arch=c000003e syscall=4 success=no
exit=-13 a0=1eb6250 a1=7ffdefdd3d80 a2=7ffdefdd3d80 a3=7ffdefdd3b60 items=0
ppid=12212 pid=12213 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17
egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="sh"
exe="/usr/bin/bash" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
type=AVC msg=audit(1496414537.219:104): avc:  denied  { getattr } for
pid=12213 comm="sh" path="/usr/sbin/ldconfig" dev="dm-0" ino=33577980
scontext=system_u:system_r:pki_tomcat_t:s0
tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file

Expected results:

AVC denials should not occur.

Metadata Update from @mharmsen:
- Custom field component adjusted to General
- Custom field feature adjusted to ''
- Custom field origin adjusted to Community
- Custom field proposedmilestone adjusted to ''
- Custom field proposedpriority adjusted to ''
- Custom field reviewer adjusted to ''
- Custom field type adjusted to defect
- Custom field version adjusted to ''

Metadata Update from @mharmsen:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1458420
- Issue priority set to: critical

This ticket is being closed as WONTFIX since the associated bug was changed to the selinux-policy component.

Metadata Update from @mharmsen:
- Issue close_status updated to: wontfix
- Issue set to the milestone: 10.4.7 (was: 10.4)
- Issue status updated to: Closed (was: Open)

Metadata Update from @mharmsen:
- Issue assigned to vakwetu

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/2845

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.
Metadata
None
None
None
Low
defect
General
''
''
Community
''
''
''
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.