Project

General

Profile

Actions

Bug #7178

closed

Allow passenger_t to EXECMEM

Added by Lukas Zapletal over 9 years ago. Updated over 5 years ago.

Status:
Closed
Priority:
High
Category:
Packaging
Target version:
Difficulty:
trivial
Triaged:
Fixed in Releases:
Found in Releases:

Description

It was confirmed by our QA department that our application does work file in Enforcing.


Related issues 1 (0 open1 closed)

Related to SELinux - Tracker #7249: Policy with workarounds for Foreman w/ KatelloClosedLukas Zapletal08/25/2014

Actions
Actions #1

Updated by Lukas Zapletal over 9 years ago

  • Subject changed from Don't audit passenger's EXECMEM to Allos passenger_t to EXECMEM

Scratch that for RHEL7, after investigation from this evening with Jason and Og, it turns out it is not passenger but foreman-tasks what causes this denial. And it does not start without this.

We run foreman-tasks (dynflow process) in passenger_t because it boots whole foreman to do its work. We need to allow this rule.

It does work in RHEL6 but in RHEL7 it does not start. Permissive only gives this denial and enforcing stops tasks from coming up. Allowing this rule proceeds.

service foreman-tasks start
Redirecting to /bin/systemctl start  foreman-tasks.service
Job for foreman-tasks.service failed. See 'systemctl status foreman-tasks.service' and 'journalctl -xn' for details.
[root@el7-smoketest ~]# vi log
[root@el7-smoketest ~]# audit2allow -m passenger-execmem < log

module passenger-execmem 1.0;

require {
        type passenger_t;
        class process execmem;
}

#============= passenger_t ==============
allow passenger_t self:process execmem;
You have new mail in /var/spool/mail/root
[root@el7-smoketest ~]# audit2allow -M passenger-execmem < log
******************** IMPORTANT ***********************
To make this policy package active, execute:

semodule -i passenger-execmem.pp

[root@el7-smoketest ~]# semodule -i passenger-execmem.pp
[root@el7-smoketest ~]# getenforce
Enforcing
[root@el7-smoketest ~]# service foreman-tasks start
Redirecting to /bin/systemctl start  foreman-tasks.service
You have new mail in /var/spool/mail/root
[root@el7-smoketest ~]# cat log
type=AVC msg=audit(1408565585.751:711): avc:  denied  { execmem } for  pid=52386 comm="ruby" scontext=system_u:system_r:passenger_t:s0 tcontext=system_u:system_r:passenger_t:s0 tclass=process
[root@el7-smoketest ~]# systemctl status foreman-tasks
foreman-tasks.service - Foreman jobs daemon
   Loaded: loaded (/usr/lib/systemd/system/foreman-tasks.service; enabled)
   Active: active (running) since Wed 2014-08-20 16:22:15 EDT; 22s ago
     Docs: https://github.com/iNecas/foreman-tasks
  Process: 52738 ExecStop=/usr/bin/foreman-tasks stop (code=exited, status=134)
  Process: 54593 ExecStart=/usr/bin/foreman-tasks start (code=exited, status=0/SUCCESS)
   CGroup: /system.slice/foreman-tasks.service
           ├─54635 dynflow_executor
           └─54637 dynflow_executor_monitor

Aug 20 16:20:56 el7-smoketest.sat6.lab.eng.bos.redhat.com foreman-tasks[54593]: ...
Aug 20 16:20:59 el7-smoketest.sat6.lab.eng.bos.redhat.com foreman-tasks[54593]: ...
Aug 20 16:20:59 el7-smoketest.sat6.lab.eng.bos.redhat.com foreman-tasks[54593]: ...
Aug 20 16:22:14 el7-smoketest.sat6.lab.eng.bos.redhat.com foreman-tasks[54593]: ...
Aug 20 16:22:15 el7-smoketest.sat6.lab.eng.bos.redhat.com systemd[1]: Started Fo...
Hint: Some lines were ellipsized, use -l to show in full.
Actions #2

Updated by Anonymous over 9 years ago

  • Status changed from Assigned to Closed
  • % Done changed from 10 to 100
Actions #3

Updated by Dominic Cleal over 9 years ago

  • translation missing: en.field_release set to 21
Actions #4

Updated by Lukas Zapletal over 9 years ago

  • Subject changed from Allos passenger_t to EXECMEM to Allow passenger_t to EXECMEM

Investigating if daemons gem (used by foreman-tasks) does not cause that.

Actions #5

Updated by Lukas Zapletal over 9 years ago

  • Related to Tracker #7249: Policy with workarounds for Foreman w/ Katello added
Actions #6

Updated by The Foreman Bot over 9 years ago

  • Pull request https://github.com/theforeman/foreman-selinux/pull/32 added
  • Pull request deleted ()
Actions

Also available in: Atom PDF