Le mardi 07 avril 2020 à 15:08 +0200, Zdenek Pytela a écrit :
Hi Laurent,
On Tue, Apr 7, 2020 at 1:54 PM Laurent Jacquot <jk(a)lutty.net> wrote:
> Hello,
>
> Every days I have these AVC in my logs (F31 fully updated)
>
>
>
> Apr 7 00:00:00 jack audit[1]: SERVICE_START pid=1 uid=0
>
> auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0
>
> msg='unit=sa-update comm="systemd"
exe="/usr/lib/systemd/systemd"
>
> hostname=? addr=? terminal=? res=success'
>
>
>
> Apr 7 00:15:19 jack audit[1]: USER_AVC pid=1 uid=0 auid=4294967295
>
> ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: denied
> {
>
> start } for auid=n/a uid=0 gid=0
>
> path="/usr/lib/systemd/system/spamassassin.service" cmdline=""
>
> scontext=system_u:system_r:spamd_update_t:s0
>
> tcontext=system_u:object_r:systemd_unit_file_t:s0 tclass=service
>
> permissive=0#012 exe="/usr/lib/systemd/systemd" sauid=0 hostname=?
>
> addr=? terminal=?'
>
>
>
> Apr 7 00:15:19 jack audit[1]: USER_AVC pid=1 uid=0 auid=4294967295
>
> ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: denied
> {
>
> status } for auid=n/a uid=0 gid=0 cmdline=""
>
> scontext=system_u:system_r:spamd_update_t:s0
>
> tcontext=system_u:system_r:init_t:s0 tclass=system permissive=0#012
>
> exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=?
> terminal=?'
>
>
>
>
>
> Apr 7 00:15:19 jack audit[1]: SERVICE_STOP pid=1 uid=0
> auid=4294967295
>
> ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=sa-update
>
> comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=?
>
> terminal=? res=success'
>
>
>
> and in /var/log/sa-update.log
>
> 07-avril-2020 00:15:19: SpamAssassin: Update processed successfully
>
>
>
>
>
> I try to understand what is going on: the sa-update service is
> started
>
> OK, but 15 seconds later, the same? service is denied start and
> status,
>
> and finally is stopped with success.
At 00:00, sa-update service is started off a timer service. It waits
a random time (this time 15 minutes, not seconds) and executes
systemctl condrestart spamassassin.service
which is denied as spamd_update_d is only allowed to manage antivirus
unit type:
# sesearch -A -s spamd_update_t -c service
allow spamd_update_t antivirus_unit_file_t:service { disable enable
reload start status stop };
>
> I would be grateful to get any hints on how to debug this issue and
>
> stop the AVCs.
To debug further and see more details, these commands may appear to
be useful provided you have the auditd service running:
1. Open the /etc/audit/rules.d/audit.rules file.
2. Remove or comment-out the following line if it exists:
-a task,never
3. Add the following line at the end of the file:
-w /etc/shadow -p w -k shadow-write
4. Restart the audit daemon:
# service auditd restart
5. Verify the current audit rules (no rule for not auditing, a watch
rule):
# auditctl -l
6. Wait for the nightly job to process.
7. Collect the denials:
ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts today >
/tmp/ausearch.out
These changes will persist boot.
To resolve, a change is required in the selinux-policy package, or a
custom policy can be created as a workaround.
>
Thank you for your explanation, before opening BZ to request the
change, I'll try to dig further with the audit rules, and create a
custom policy package. regardsLaurent
> best regards
>
> Laurent Jacquot
>
>
>
>
>
> _______________________________________________
>
> selinux mailing list -- selinux(a)lists.fedoraproject.org
>
> To unsubscribe send an email to
> selinux-leave(a)lists.fedoraproject.org
>
> Fedora Code of Conduct:
>
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>
> List Guidelines:
>
https://fedoraproject.org/wiki/Mailing_list_guidelines
>
> List Archives:
>
https://lists.fedoraproject.org/archives/list/selinux@lists.fedoraproject.or
Cheers,
--
Zdenek Pytela