Foreman » SELinux

Forgot to add that I'm running version "foreman-1.5.0-1.el6.noarch"

Hello,

I don't see any denials that have something to do with our VNC proxy. Can you do this for me:

ps auxwwwZ

and

ll -Z /usr/share/foreman/extras/noVNC

This is audit2allow:

#============= passenger_t ==============
allow passenger_t puppet_etc_t:file { execute execute_no_trans };

#!!!! This avc is allowed in the current policy
allow passenger_t puppet_log_t:file relabelto;

#!!!! This avc is allowed in the current policy
allow passenger_t puppet_var_lib_t:dir relabelto;

#!!!! This avc is allowed in the current policy
allow passenger_t puppet_var_lib_t:file relabelto;

allow passenger_t self:process { getcap setcap };
corenet_udp_bind_generic_port(passenger_t)
ssh_exec(passenger_t)

Dom, what is your opinion about last three rules?

The first one - it looks like some passenger magic (execmem soon? :-)

The second one - and we can see this from the audit.log as well - Foreman/Passenger really wants to bind random UDP ports. We've seen this already. Possible solutions - dontaudit, allowing ports (7k-64k), ignoring.

The third one - Foreman obviously uses ssh to do provisioning, but why do we see this denial today? Don't we have this feature for years now?

Jorick, can you please tail -f the audit.log and then try to access the console. Paste me those lines which are added after the requrest. I really think this has noting to do with SELinux.

Also try "setenforce 0".

I updated to 1.6 nightly to get around some other bugs and it works now. I'll revert back to 1.5 stable later in the day and tail the audit.log for you

Hello,

thanks for testing. Can you install foreman-selinux from nightly repo (you can mix and match this package without any issue), set Permissive (setenforce 0), then restart Foreman and try to tail audit log while trying to connect?

There is no denial in the listing you pasted above and SELinux should not hurt in this case. Also send me your "ps auxwwwZ" output.

Ping me on irc (FreeNode) my nick is "lzap".

I already have the latest foreman-selinux installed and "setenforce 0" works and "setenforce 1" fails consistently without anything in audit.log..... This makes no sense to me but I can reproduce everytime....

rpm -qa|grep foreman-selinux
foreman-selinux-1.6.0-0.develop.201405301314git8ad6a63.el6.noarch

There are only some lines added to audit.log when I restart the foreman service and try it the first time:

type=AVC msg=audit(1402573453.803:63): avc: denied { getattr } for pid=1843 comm="ruby" path="/usr/bin/ssh" dev=dm-0 ino=2100741 scontext=system_u:system_r:passenger_t:s0 tcontext=system_u:object_r:ssh_exec_t:s0 tclass=file
type=SYSCALL msg=audit(1402573453.803:63): arch=c000003e syscall=4 success=yes exit=0 a0=7f0728195ed0 a1=7f0742e43e90 a2=7f0742e43e90 a3=d items=0 ppid=1815 pid=1843 auid=4294967295 uid=497 gid=497 euid=497 suid=497 fsuid=497 egid=497 sgid=497 fsgid=497 tty=(none) ses=4294967295 comm="ruby" exe="/opt/rh/ruby193/root/usr/bin/ruby" subj=system_u:system_r:passenger_t:s0 key=(null)
type=AVC msg=audit(1402573453.807:64): avc: denied { getcap } for pid=1846 comm="ruby" scontext=system_u:system_r:passenger_t:s0 tcontext=system_u:system_r:passenger_t:s0 tclass=process
type=SYSCALL msg=audit(1402573453.807:64): arch=c000003e syscall=125 success=yes exit=0 a0=7f07287244b4 a1=7f07287244bc a2=4 a3=7f0742e43cc0 items=0 ppid=1838 pid=1846 auid=4294967295 uid=497 gid=497 euid=497 suid=497 fsuid=497 egid=497 sgid=497 fsgid=497 tty=(none) ses=4294967295 comm="ruby" exe="/opt/rh/ruby193/root/usr/bin/ruby" subj=system_u:system_r:passenger_t:s0 key=(null)
type=AVC msg=audit(1402573453.807:65): avc: denied { setcap } for pid=1846 comm="ruby" scontext=system_u:system_r:passenger_t:s0 tcontext=system_u:system_r:passenger_t:s0 tclass=process
type=SYSCALL msg=audit(1402573453.807:65): arch=c000003e syscall=126 success=yes exit=0 a0=7f07287244b4 a1=7f07287244bc a2=4 a3=7f0742e43cc0 items=0 ppid=1838 pid=1846 auid=4294967295 uid=497 gid=497 euid=497 suid=497 fsuid=497 egid=497 sgid=497 fsgid=497 tty=(none) ses=4294967295 comm="ruby" exe="/opt/rh/ruby193/root/usr/bin/ruby" subj=system_u:system_r:passenger_t:s0 key=(null)
type=AVC msg=audit(1402573453.807:66): avc: denied { execute } for pid=1846 comm="ruby" name="ssh" dev=dm-0 ino=2100741 scontext=system_u:system_r:passenger_t:s0 tcontext=system_u:object_r:ssh_exec_t:s0 tclass=file
type=AVC msg=audit(1402573453.807:66): avc: denied { read open } for pid=1846 comm="ruby" name="ssh" dev=dm-0 ino=2100741 scontext=system_u:system_r:passenger_t:s0 tcontext=system_u:object_r:ssh_exec_t:s0 tclass=file
type=AVC msg=audit(1402573453.807:66): avc: denied { execute_no_trans } for pid=1846 comm="ruby" path="/usr/bin/ssh" dev=dm-0 ino=2100741 scontext=system_u:system_r:passenger_t:s0 tcontext=system_u:object_r:ssh_exec_t:s0 tclass=file
type=SYSCALL msg=audit(1402573453.807:66): arch=c000003e syscall=59 success=yes exit=0 a0=7f0728195ed0 a1=7f07289012b0 a2=7f07288f7060 a3=7f0742e43cf0 items=0 ppid=1838 pid=1846 auid=4294967295 uid=497 gid=497 euid=497 suid=497 fsuid=497 egid=497 sgid=497 fsgid=497 tty=(none) ses=4294967295 comm="ssh" exe="/usr/bin/ssh" subj=system_u:system_r:passenger_t:s0 key=(null)

ps auxwwwZ
LABEL USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
system_u:system_r:init_t:s0 root 1 0.1 0.0 19232 1516 ? Ss 13:39 0:00 /sbin/init
system_u:system_r:kernel_t:s0 root 2 0.0 0.0 0 0 ? S 13:39 0:00 [kthreadd]
system_u:system_r:kernel_t:s0 root 3 0.0 0.0 0 0 ? S 13:39 0:00 [migration/0]
system_u:system_r:kernel_t:s0 root 4 0.0 0.0 0 0 ? S 13:39 0:00 [ksoftirqd/0]
system_u:system_r:kernel_t:s0 root 5 0.0 0.0 0 0 ? S 13:39 0:00 [migration/0]
system_u:system_r:kernel_t:s0 root 6 0.0 0.0 0 0 ? S 13:39 0:00 [watchdog/0]
system_u:system_r:kernel_t:s0 root 7 0.0 0.0 0 0 ? S 13:39 0:00 [events/0]
system_u:system_r:kernel_t:s0 root 8 0.0 0.0 0 0 ? S 13:39 0:00 [cgroup]
system_u:system_r:kernel_t:s0 root 9 0.0 0.0 0 0 ? S 13:39 0:00 [khelper]
system_u:system_r:kernel_t:s0 root 10 0.0 0.0 0 0 ? S 13:39 0:00 [netns]
system_u:system_r:kernel_t:s0 root 11 0.0 0.0 0 0 ? S 13:39 0:00 [async/mgr]
system_u:system_r:kernel_t:s0 root 12 0.0 0.0 0 0 ? S 13:39 0:00 [pm]
system_u:system_r:kernel_t:s0 root 13 0.0 0.0 0 0 ? S 13:39 0:00 [sync_supers]
system_u:system_r:kernel_t:s0 root 14 0.0 0.0 0 0 ? S 13:39 0:00 [bdi-default]
system_u:system_r:kernel_t:s0 root 15 0.0 0.0 0 0 ? S 13:39 0:00 [kintegrityd/0]
system_u:system_r:kernel_t:s0 root 16 0.0 0.0 0 0 ? S 13:39 0:00 [kblockd/0]
system_u:system_r:kernel_t:s0 root 17 0.0 0.0 0 0 ? S 13:39 0:00 [kacpid]
system_u:system_r:kernel_t:s0 root 18 0.0 0.0 0 0 ? S 13:39 0:00 [kacpi_notify]
system_u:system_r:kernel_t:s0 root 19 0.0 0.0 0 0 ? S 13:39 0:00 [kacpi_hotplug]
system_u:system_r:kernel_t:s0 root 20 0.0 0.0 0 0 ? S 13:39 0:00 [ata_aux]
system_u:system_r:kernel_t:s0 root 21 0.0 0.0 0 0 ? S 13:39 0:00 [ata_sff/0]
system_u:system_r:kernel_t:s0 root 22 0.0 0.0 0 0 ? S 13:39 0:00 [ksuspend_usbd]
system_u:system_r:kernel_t:s0 root 23 0.0 0.0 0 0 ? S 13:39 0:00 [khubd]
system_u:system_r:kernel_t:s0 root 24 0.0 0.0 0 0 ? S 13:39 0:00 [kseriod]
system_u:system_r:kernel_t:s0 root 25 0.0 0.0 0 0 ? S 13:39 0:00 [md/0]
system_u:system_r:kernel_t:s0 root 26 0.0 0.0 0 0 ? S 13:39 0:00 [md_misc/0]
system_u:system_r:kernel_t:s0 root 27 0.0 0.0 0 0 ? S 13:39 0:00 [linkwatch]
system_u:system_r:kernel_t:s0 root 28 0.0 0.0 0 0 ? S 13:39 0:00 [khungtaskd]
system_u:system_r:kernel_t:s0 root 29 0.0 0.0 0 0 ? S 13:39 0:00 [kswapd0]
system_u:system_r:kernel_t:s0 root 30 0.0 0.0 0 0 ? SN 13:39 0:00 [ksmd]
system_u:system_r:kernel_t:s0 root 31 0.0 0.0 0 0 ? SN 13:39 0:00 [khugepaged]
system_u:system_r:kernel_t:s0 root 32 0.0 0.0 0 0 ? S 13:39 0:00 [aio/0]
system_u:system_r:kernel_t:s0 root 33 0.0 0.0 0 0 ? S 13:39 0:00 [crypto/0]
system_u:system_r:kernel_t:s0 root 38 0.0 0.0 0 0 ? S 13:39 0:00 [kthrotld/0]
system_u:system_r:kernel_t:s0 root 40 0.0 0.0 0 0 ? S 13:39 0:00 [kpsmoused]
system_u:system_r:kernel_t:s0 root 41 0.0 0.0 0 0 ? S 13:39 0:00 [usbhid_resumer]
system_u:system_r:kernel_t:s0 root 72 0.0 0.0 0 0 ? S 13:39 0:00 [kstriped]
system_u:system_r:kernel_t:s0 root 142 0.0 0.0 0 0 ? S 13:39 0:00 [scsi_eh_0]
system_u:system_r:kernel_t:s0 root 143 0.0 0.0 0 0 ? S 13:39 0:00 [scsi_eh_1]
system_u:system_r:kernel_t:s0 root 260 0.0 0.0 0 0 ? S 13:39 0:00 [virtio-blk]
system_u:system_r:kernel_t:s0 root 294 0.0 0.0 0 0 ? S 13:39 0:00 [kdmflush]
system_u:system_r:kernel_t:s0 root 296 0.0 0.0 0 0 ? S 13:39 0:00 [kdmflush]
system_u:system_r:kernel_t:s0 root 313 0.0 0.0 0 0 ? S 13:39 0:00 [jbd2/dm-0-8]
system_u:system_r:kernel_t:s0 root 314 0.0 0.0 0 0 ? S 13:39 0:00 [ext4-dio-unwrit]
system_u:system_r:udev_t:s0-s0:c0.c1023 root 396 0.0 0.0 11376 1448 ? S<s 13:39 0:00 /sbin/udevd -d
system_u:system_r:kernel_t:s0 root 434 0.0 0.0 0 0 ? S 13:39 0:00 [virtio-net]
system_u:system_r:kernel_t:s0 root 436 0.0 0.0 0 0 ? S 13:39 0:00 [vballoon]
system_u:system_r:kernel_t:s0 root 720 0.0 0.0 0 0 ? S 13:39 0:00 [jbd2/vda1-8]
system_u:system_r:kernel_t:s0 root 721 0.0 0.0 0 0 ? S 13:39 0:00 [ext4-dio-unwrit]
system_u:system_r:kernel_t:s0 root 766 0.0 0.0 0 0 ? S 13:39 0:00 [kauditd]
system_u:system_r:kernel_t:s0 root 778 0.0 0.0 0 0 ? S 13:39 0:00 [flush-253:0]
system_u:system_r:auditd_t:s0 root 992 0.0 0.0 27640 824 ? S<sl 13:39 0:00 auditd
system_u:system_r:syslogd_t:s0 root 1017 0.0 0.0 249088 1588 ? Sl 13:39 0:00 /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
system_u:system_r:named_t:s0 named 1036 0.0 0.2 160032 11676 ? Ssl 13:39 0:00 /usr/sbin/named -u named
system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 dbus 1056 0.0 0.0 97332 1472 ? Ssl 13:39 0:00 dbus-daemon --system
system_u:system_r:hald_t:s0 68 1086 0.0 0.1 37632 4200 ? Ssl 13:39 0:00 hald
system_u:system_r:hald_t:s0 root 1087 0.0 0.0 20324 1340 ? S 13:39 0:00 hald-runner
system_u:system_r:hald_t:s0 root 1119 0.0 0.0 22444 1272 ? S 13:39 0:00 hald-addon-input: Listening on /dev/input/event2 /dev/input/event0
system_u:system_r:hald_t:s0 68 1134 0.0 0.0 17932 1136 ? S 13:39 0:00 hald-addon-acpi: listening on acpi kernel interface /proc/acpi/event
system_u:system_r:sshd_t:s0-s0:c0.c1023 root 1146 0.0 0.0 66608 1232 ? Ss 13:39 0:00 /usr/sbin/sshd
system_u:system_r:inetd_t:s0-s0:c0.c1023 root 1154 0.0 0.0 22180 964 ? Ss 13:39 0:00 xinetd -stayalive -pidfile /var/run/xinetd.pid
system_u:system_r:postgresql_t:s0 postgres 1177 0.1 0.1 216272 6372 ? S 13:39 0:00 /usr/bin/postmaster -p 5432 -D /var/lib/pgsql/data
system_u:system_r:dhcpd_t:s0 dhcpd 1191 0.0 0.1 49048 4300 ? Ss 13:39 0:00 /usr/sbin/dhcpd -user dhcpd -group dhcpd eth0
system_u:system_r:postfix_master_t:s0 root 1267 0.0 0.0 81284 3412 ? Ss 13:39 0:00 /usr/libexec/postfix/master
system_u:system_r:postfix_pickup_t:s0 postfix 1273 0.0 0.0 81364 3372 ? S 13:39 0:00 pickup -l -t fifo -u
system_u:system_r:postfix_qmgr_t:s0 postfix 1274 0.0 0.0 81432 3428 ? S 13:39 0:00 qmgr -l -t fifo -u
system_u:system_r:postgresql_t:s0 postgres 1279 0.0 0.0 179284 1496 ? Ss 13:39 0:00 postgres: logger process
system_u:system_r:postgresql_t:s0 postgres 1281 0.0 0.0 216392 2896 ? Ss 13:39 0:00 postgres: writer process
system_u:system_r:postgresql_t:s0 postgres 1282 0.0 0.0 216272 1752 ? Ss 13:39 0:00 postgres: wal writer process
system_u:system_r:postgresql_t:s0 postgres 1283 0.0 0.0 216556 1992 ? Ss 13:39 0:00 postgres: autovacuum launcher process
system_u:system_r:postgresql_t:s0 postgres 1284 0.0 0.0 179556 1736 ? Ss 13:39 0:00 postgres: stats collector process
system_u:system_r:initrc_t:s0 498 1290 0.0 0.8 132788 34228 ? S 13:39 0:00 /usr/bin/ruby /usr/share/foreman-proxy/bin/smart-proxy
system_u:system_r:httpd_t:s0 root 1317 0.0 0.1 155644 6052 ? Ss 13:39 0:00 /usr/sbin/httpd
system_u:system_r:passenger_t:s0 root 1321 0.0 0.0 214048 1836 ? Ssl 13:39 0:00 PassengerWatchdog
system_u:system_r:passenger_t:s0 root 1325 0.1 0.1 575788 5756 ? Sl 13:39 0:00 PassengerHelperAgent
system_u:system_r:passenger_t:s0 nobody 1331 0.0 0.0 214128 3872 ? Sl 13:39 0:00 PassengerLoggingAgent
system_u:system_r:crond_t:s0-s0:c0.c1023 root 1343 0.1 0.0 117300 1392 ? Ss 13:39 0:00 crond
system_u:system_r:httpd_t:s0 apache 1347 0.0 0.1 155992 6160 ? S 13:39 0:00 /usr/sbin/httpd
system_u:system_r:httpd_t:s0 apache 1348 0.0 0.1 155928 5940 ? S 13:39 0:00 /usr/sbin/httpd
system_u:system_r:httpd_t:s0 apache 1349 0.0 0.1 156064 6140 ? S 13:39 0:00 /usr/sbin/httpd
system_u:system_r:httpd_t:s0 apache 1350 0.0 0.1 155928 5952 ? S 13:39 0:00 /usr/sbin/httpd
system_u:system_r:httpd_t:s0 apache 1351 0.0 0.1 155848 6004 ? S 13:39 0:00 /usr/sbin/httpd
system_u:system_r:httpd_t:s0 apache 1352 0.0 0.1 155972 6032 ? S 13:39 0:00 /usr/sbin/httpd
system_u:system_r:httpd_t:s0 apache 1353 0.0 0.1 155784 5868 ? S 13:39 0:00 /usr/sbin/httpd
system_u:system_r:httpd_t:s0 apache 1354 0.0 0.1 156092 5856 ? S 13:39 0:00 /usr/sbin/httpd
system_u:system_r:puppet_t:s0 root 1364 0.1 1.7 178224 68696 ? Ss 13:39 0:00 /usr/bin/ruby /usr/sbin/puppetd
system_u:system_r:getty_t:s0 root 1385 0.0 0.0 4064 580 tty1 Ss+ 13:39 0:00 /sbin/mingetty /dev/tty1
system_u:system_r:getty_t:s0 root 1387 0.0 0.0 4064 580 tty2 Ss+ 13:39 0:00 /sbin/mingetty /dev/tty2
system_u:system_r:getty_t:s0 root 1389 0.0 0.0 4064 580 tty3 Ss+ 13:39 0:00 /sbin/mingetty /dev/tty3
system_u:system_r:getty_t:s0 root 1391 0.0 0.0 4064 580 tty4 Ss+ 13:39 0:00 /sbin/mingetty /dev/tty4
system_u:system_r:getty_t:s0 root 1393 0.0 0.0 4064 580 tty5 Ss+ 13:39 0:00 /sbin/mingetty /dev/tty5
system_u:system_r:udev_t:s0-s0:c0.c1023 root 1395 0.0 0.0 12296 2592 ? S< 13:39 0:00 /sbin/udevd -d
system_u:system_r:udev_t:s0-s0:c0.c1023 root 1396 0.0 0.0 12296 2584 ? S< 13:39 0:00 /sbin/udevd -d
system_u:system_r:getty_t:s0 root 1398 0.0 0.0 4064 576 tty6 Ss+ 13:39 0:00 /sbin/mingetty /dev/tty6
system_u:system_r:passenger_t:s0 puppet 1429 0.2 1.7 173052 66776 ? Sl 13:39 0:00 Passenger RackApp: /etc/puppet/rack
system_u:system_r:sshd_t:s0-s0:c0.c1023 root 1577 0.0 0.1 100360 4112 ? Ss 13:40 0:00 sshd: root@pts/0
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 1584 0.0 0.0 108432 1988 pts/0 Ss 13:40 0:00 -bash
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 1610 0.0 0.0 100944 648 pts/0 S+ 13:40 0:00 tail -200f /var/log/audit/audit.log
system_u:system_r:sshd_t:s0-s0:c0.c1023 root 1652 0.0 0.1 100356 4056 ? Ss 13:40 0:00 sshd: root@pts/1
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 1660 0.0 0.0 108432 1968 pts/1 Ss 13:40 0:00 -bash
system_u:system_r:passenger_t:s0 foreman 1802 0.0 0.0 9196 1244 ? S 13:43 0:00 /bin/bash /usr/bin/ruby193-ruby /usr/lib/ruby/gems/1.8/gems/passenger-4.0.18/helper-scripts/rack-preloader.rb
system_u:system_r:passenger_t:s0 foreman 1811 0.0 0.0 4060 548 ? S 13:43 0:00 scl enable ruby193 ruby /usr/lib/ruby/gems/1.8/gems/passenger-4.0.18/helper-scripts/rack-preloader.rb
system_u:system_r:passenger_t:s0 foreman 1812 0.0 0.0 9196 1304 ? S 13:43 0:00 /bin/bash /var/tmp/scl2VSOqz
system_u:system_r:passenger_t:s0 foreman 1815 11.2 3.7 341764 147052 ? Sl 13:43 0:13 Passenger AppPreloader: /usr/share/foreman
system_u:system_r:passenger_t:s0 foreman 1838 1.2 4.0 543984 159688 ? Sl 13:44 0:01 Passenger RackApp: /usr/share/foreman
system_u:system_r:postgresql_t:s0 postgres 1845 0.0 0.2 218452 8008 ? Ss 13:44 0:00 postgres: foreman foreman [local] idle
system_u:system_r:passenger_t:s0 foreman 1846 0.0 0.0 60364 3392 ? S 13:44 0:00 ssh xx.xxx.xxx.xxx sh -c 'if 'nc' -q 2>&1 | grep "requires an argument" >/dev/null 2>&1; then ARG=-q0;else ARG=;fi;'nc' $ARG -U /var/run/libvirt/libvirt-sock'
system_u:system_r:websockify_t:s0 foreman 1850 0.0 0.2 99228 7892 ? S 13:44 0:00 /usr/bin/python /usr/share/foreman/extras/noVNC/websockify.py --daemon --idle-timeout=120 --timeout=120 5910 yyyyy.yyyyy.yyyy:5902
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 1897 4.0 0.0 110236 1196 pts/1 R+ 13:45 0:00 ps auxwwwZ

Reproduced with:

#============= passenger_t ==============
allow passenger_t websockify_t:process { siginh rlimitinh noatsecure };
selinux_get_enforce_mode(passenger_t)

#============= websockify_t ==============
allow websockify_t self:netlink_route_socket { write read };
allow websockify_t self:tcp_socket { read write };
allow websockify_t self:udp_socket { write read };
apache_search_config(websockify_t)

Trying to test it but I don't see your foreman-selinux build in the nightly repo. Do I need to get it from somewhere else?

Jorick Astrego wrote:

Trying to test it but I don't see your foreman-selinux build in the nightly repo. Do I need to get it from somewhere else?

It's a test/scratch build, direct link:
http://koji.katello.org/koji/getfile?taskID=119387&name=foreman-selinux-1.6.0-0.develop.el6.noarch.rpm

Sorry, I'm only the Ops in DevOps. Still learning the rest ;-)

The patch works as intended, I now can use the console while enforcing selinux.

Oh, right. I apologize for that, it was not clear for you.