Re: Re: CFE 3.15 (community): RHEL8/SELinux oddity... but not always

Excellent detective work, and thank you for sharing your solution.

I've gone through similar "code archeology" activities -- there is no
substitute for going through _all of the code_, from A to Z, and knowing
exactly what's running where. Especially for something so critical to IT
operations like CFEngine.




On Thu, Mar 24, 2022 at 1:03 PM [email protected] <
[email protected]> wrote:

> [SOLVED]
>
> I believe I have tracked this down and fixed it.  So this self-reply is
> really "for the record" just in case someone else stumbles across it or
> something similar in years to come.
>
> Our "/var/log/messages" file had massive amounts of:
>
>     setroubleshoot[2406242]: SELinux is preventing /usr/bin/pgrep from
> getattr access on the directory /proc/<pid> ...
>
> It turns out our local policy had an ancient clause that executed
> "pgrep".  This was in a generic, global "classes:", in an attempt to
> determine if a particular process was running.  So when above I said "*I've
> tried stripping out almost all of our local policy but it seems to make no
> difference*" that particular clause had unintentionally remained because
> it was in our generic stuff.  Sigh.   Firstly, it turns out we didn't need
> it, not even on existing systems.  Secondly, under RHEL8 it wouldn't have
> worked anyway (a difference between our use of RHEL7 and RHEL8).  Thirdly,
> of course, if we did still need it, then "processes:" would have been by
> far the better way to do it.  (I rather suspect this particular clause was
> very, very ancient...)
>
> Once I removed that old cruft, the problem vanished.  My
> "/var/log/messages" file for the last week dropped in size to a mere 1% of
> its size for previous weeks, and all trace of any troubling "pgrep" line
> had vanished.
>
> -- David Lee
>
> On Wednesday, 16 February 2022 at 16:55:09 UTC [email protected]
> wrote:
>
>> Background: We're doing a sizeable project to pull our CFE installations
>> up from 3.10 and non-MPF towards something higher and MPF.    Overall, it's
>> going reasonably well.  On our main installation we are at 3.12/RHEL7 and
>> 3.15/RHEL8. with the hub also on 3.15/RHEL8.  We had a few interesting
>> little adventures with SELinux, but we've now got that stabilised, with
>> just a minimal amount of additional rules to handle things.
>>
>> The issue.  We have a separate installation (gitlab repo; hub).  Our
>> local policy for that broadly resembles the main installation in structure,
>> although with a lot of differences in detail.  I've just started the
>> equivalent exercise of trying to pull that also up from 3.10/non-MPF.  But
>> my RHEL8/3.15 machines are seeing a big new SELinux problem that we never
>> saw on the main installation: lots of SELinux errors for cf_serverd
>> relating to "pgrep" (and, on the client, a similar set for "ps").  The
>> resulting ".te" file that I generate (using the recommended "ausearch ... |
>> audit2allow ..." is nearly 90 lines in length: so nearly 40 lines all of
>> the form:
>>
>>     allow cfengine_serverd_t NetworkManager_t:dir getattr;
>>
>> (with the variation among the lines being in that "NetworkManager_t"
>> component).
>>
>> I've tried stripping out almost all of our local policy but it seems to
>> make no difference.
>>
>> I've also looked at "misc/selinux/cfengine-enterprise.te" in the CFE
>> source; my lines (such as that above) appear (eyeball) to have no overlap.
>>
>> Does this ring any bells with anyone?
>>
>> (By the way, I had thought about trying 3.18 on this RHEL8. but that had
>> a completely separate problem even before installation... the topic of
>> another message.)
>>
> --
> You received this message because you are subscribed to the Google Groups
> "help-cfengine" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [email protected].
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/help-cfengine/624e3341-63d1-492b-b07a-b5e997120a86n%40googlegroups.com
> <https://groups.google.com/d/msgid/help-cfengine/624e3341-63d1-492b-b07a-b5e997120a86n%40googlegroups.com?utm_medium=email&utm_source=footer>
> .
>

-- 
You received this message because you are subscribed to the Google Groups "help-cfengine" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/CANNWuVWSzf5O92Tez2unxPmeQo6T%3DuBQCa%3DqZVPh7mz%3DpkOE_g%40mail.gmail.com.