| Newsgroups |
gmane.comp.sysutils.cfengine.general |
| Message-ID |
<[email protected]> |
[SOLVED]
I believe I have tracked this down and fixed it. So this self-reply is
really "for the record" just in case someone else stumbles across it or
something similar in years to come.
Our "/var/log/messages" file had massive amounts of:
setroubleshoot[2406242]: SELinux is preventing /usr/bin/pgrep from
getattr access on the directory /proc/<pid> ...
It turns out our local policy had an ancient clause that executed "pgrep".
This was in a generic, global "classes:", in an attempt to determine if a
particular process was running. So when above I said "*I've tried
stripping out almost all of our local policy but it seems to make no
difference*" that particular clause had unintentionally remained because it
was in our generic stuff. Sigh. Firstly, it turns out we didn't need it,
not even on existing systems. Secondly, under RHEL8 it wouldn't have
worked anyway (a difference between our use of RHEL7 and RHEL8). Thirdly,
of course, if we did still need it, then "processes:" would have been by
far the better way to do it. (I rather suspect this particular clause was
very, very ancient...)
Once I removed that old cruft, the problem vanished. My
"/var/log/messages" file for the last week dropped in size to a mere 1% of
its size for previous weeks, and all trace of any troubling "pgrep" line
had vanished.
-- David Lee
On Wednesday, 16 February 2022 at 16:55:09 UTC [email protected]
wrote:
> Background: We're doing a sizeable project to pull our CFE installations
> up from 3.10 and non-MPF towards something higher and MPF. Overall, it's
> going reasonably well. On our main installation we are at 3.12/RHEL7 and
> 3.15/RHEL8. with the hub also on 3.15/RHEL8. We had a few interesting
> little adventures with SELinux, but we've now got that stabilised, with
> just a minimal amount of additional rules to handle things.
>
> The issue. We have a separate installation (gitlab repo; hub). Our local
> policy for that broadly resembles the main installation in structure,
> although with a lot of differences in detail. I've just started the
> equivalent exercise of trying to pull that also up from 3.10/non-MPF. But
> my RHEL8/3.15 machines are seeing a big new SELinux problem that we never
> saw on the main installation: lots of SELinux errors for cf_serverd
> relating to "pgrep" (and, on the client, a similar set for "ps"). The
> resulting ".te" file that I generate (using the recommended "ausearch ... |
> audit2allow ..." is nearly 90 lines in length: so nearly 40 lines all of
> the form:
>
> allow cfengine_serverd_t NetworkManager_t:dir getattr;
>
> (with the variation among the lines being in that "NetworkManager_t"
> component).
>
> I've tried stripping out almost all of our local policy but it seems to
> make no difference.
>
> I've also looked at "misc/selinux/cfengine-enterprise.te" in the CFE
> source; my lines (such as that above) appear (eyeball) to have no overlap.
>
> Does this ring any bells with anyone?
>
> (By the way, I had thought about trying 3.18 on this RHEL8. but that had a
> completely separate problem even before installation... the topic of
> another message.)
>
--
You received this message because you are subscribed to the Google Groups "help-cfengine" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/624e3341-63d1-492b-b07a-b5e997120a86n%40googlegroups.com.