Issue

Description of problem: The default RHEL 8.4 CSB configuration disables IPv6. An SELinux error message about "blocked module_request access" (pasted below) appears in journal logs for various applications, including the Red Hat Subscription Manager. Version-Release number of selected component (if applicable): RHEL 8.4 CSB, subscription-manager==1.28.13 How reproducible: Error message appears in logs every day without making any config changes. Steps to Reproduce: 1. Boot with "ipv6.disable=1" added to the kernel command line. 2. Wait for RHSM to run automatically, or run it manually. 3. Check "journalctl -b -p 3" for setroubleshoot messages. Actual results: Error message appears in logs, subscription manager tries to load IPv6 module and is blocked by SELinux policy. Expected results: No error message appears in logs, subscription manager either does not try to make IPv6 calls / load the IPv6 module when it is disabled, or the SELinux policy allows this access and does not flag it. Additional info: The error message for RHSM mentions "/usr/libexec/platform-python3.6", which is invoked by "/usr/libexec/rhsmcertd-worker" to run the "/usr/lib64/python3.6/site-packages/subscription_manager/scripts/rhsmcertd_worker.py" script. The error message is fixed (at least for other applications) by passing config options that disable IPv6 usage, so the applicaton does not try and fail to call module_request for the disabled IPv6 module. For example, chronyd can be run with the "-4" command-line option, and postfix / cups can be configured to bind to "127.0.0.1" (only IPv4) instead of "localhost" (both IPv4 and IPv6). RHSM scripts should probably be updated to not use IPv6 when it is disabled, or the RHSM SELinux policies should be updated to allow requesting the IPv6 module. Contents of rhsmcertd-worker script that invokes platform-python: [user@localhost ~]$ cat /usr/libexec/rhsmcertd-worker #!/usr/libexec/platform-python EASY-INSTALL-ENTRY-SCRIPT: 'subscription-manager==1.28.13','console_scripts','rhsmcertd-worker' requires = 'subscription-manager==1.28.13' import re import sys from pkg_resources import load_entry_point if name == 'main': sys.argv[0] = re.sub(r'(-script\.pyw?|\.exe)?$', '', sys.argv[0]) sys.exit( load_entry_point('subscription-manager==1.28.13', 'console_scripts', 'rhsmcertd-worker')() ) Error message about SELinux blocking module_request access for platform-python: [user@localhost ~]$ journalctl -b -p 3 | grep sealert Sep 12 12:53:06 localhost setroubleshoot[9359]: SELinux is preventing /usr/libexec/platform-python3.6 from module_request access on the system labeled kernel_t. For complete SELinux messages run: sealert -l b4d2c94d-b749-47e8-90c3-21933bd3eaea Verbose error message that shows platform-python is being invoked by rhsmcertd-worker, using the rhsmcertd_t SELinux context: [user@localhost ~]$ sealert -l b4d2c94d-b749-47e8-90c3-21933bd3eaea SELinux is preventing /usr/libexec/platform-python3.6 from module_request access on the system labeled kernel_t. Plugin catchall (5.76 confidence) suggests ************************** If you believe that platform-python3.6 should be allowed module_request access on system labeled kernel_t by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: ausearch -c 'rhsmcertd-worke' --raw | audit2allow -M my-rhsmcertdworke semodule -X 300 -i my-rhsmcertdworke.pp Additional Information: Source Context system_u:system_r:rhsmcertd_t:s0 Target Context system_u:system_r:kernel_t:s0 Target Objects Unknown [ system ] Source rhsmcertd-worke Source Path /usr/libexec/platform-python3.6 Port <Unknown> Host localhost Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-3.14.3-67.el8_4.1.noarch Local Policy RPM selinux-policy-targeted-3.14.3-67.el8_4.1.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name localhost Platform Linux localhost 4.18.0-305.12.1.el8_4.x86_64 #1 SMP Mon Jul 26 08:06:24 EDT 2021 x86_64 x86_64 Alert Count 33 First Seen 2021-08-30 09:48:18 EDT Last Seen 2021-09-12 12:53:00 EDT Local ID b4d2c94d-b749-47e8-90c3-21933bd3eaea Raw Audit Messages type=AVC msg=audit(1631465580.767:256): avc: denied { module_request } for pid=9356 comm="rhsmcertd-worke" kmod="net-pf-10" scontext=system_u:system_r:rhsmcertd_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system permissive=0 Hash: rhsmcertd-worke,rhsmcertd_t,kernel_t,system,module_request

Release Notes

No. of Comments

Resolution

Not a Bug