Re: SELINUX_ERR op=security_compute_sid invalid_context while running /etc/init.d script of my app

--===============1202678819307424611==
Content-Type: multipart/alternative; boundary="000000000000a4bbbe0633d23d3a"

--000000000000a4bbbe0633d23d3a
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi,

answers inline below.

On Sun, Apr 27, 2025 at 1:49=E2=80=AFAM chaitanya singh via selinux <
[email protected]> wrote:

> Doing this on a RHEL8.10 distro.
>
> I've created a user with staff_u role:
> # useradd -Z staff_u testadm
>
> And provided this user elevated permissions, for which did following step=
s:
> 1. created: /etc/sudoers.d/mysudoers
> 2. added this: %testadm ALL=3D(ALL) TYPE=3Dsysadm_t ROLE=3Dsysadm_r ALL
>
This is the correct step if you want to set it for users in the testadm
group, for the testadm user it would be
testadm ALL=3D(ALL) TYPE=3Dsysadm_t ROLE=3Dsysadm_r ALL


>
> Did reboot. Installed my app's selinux policy module(rpm). Then logged in
> with this testadm user, and ran command to elevate to sysadm_r:sysadm_t:
> # sudo runcon -r sysadm_r -t sysadm_t -- su -
>
This is not needed, just as the testadm user run

$ sudo -i

and then confirm the current context with

# id -Z


>
> Now, on this console, with selinux Enforcing, I try running my
> application's executable (maconfig) and I'm getting this permission denie=
d
> error:
>
> [root@6H0RHEL810 ~]# /opt/McAfee/agent/bin/maconfig -stop
> 2025-04-25 11:43:12.768 (50811.50811) maconfig.Info: Stopping Trellix
> agent.
> sh: /etc/init.d/ma: /bin/sh: bad interpreter: Permission denied
> 2025-04-25 11:43:12.770 (50811.50811) maconfig.Info: configuration finish=
ed
>
>
> So naturally, I looked for denials in var/log/audit/audit.log but got thi=
s
> instead:
>
> type=3DSELINUX_ERR msg=3Daudit(1745581392.769:2056): op=3Dsecurity_comput=
e_sid
> invalid_context=3D"staff_u:system_r:initrc_t:s0"
> scontext=3Dstaff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023
> tcontext=3Dsystem_u:object_r:initrc_exec_t:s0 tclass=3Dprocess
> type=3DSYSCALL msg=3Daudit(1745581392.769:2056): arch=3Dc000003e syscall=
=3D59
> success=3Dno exit=3D-13 a0=3D5587d7a7b540 a1=3D5587d7a7c700 a2=3D5587d7a7=
9e40 a3=3D0
> items=3D0 ppid=3D50811 pid=3D50812 auid=3D1001 uid=3D0 gid=3D0 euid=3D0 s=
uid=3D0 fsuid=3D0
> egid=3D0 sgid=3D0 fsgid=3D0 tty=3Dpts1 ses=3D8 comm=3D"sh" exe=3D"/usr/bi=
n/bash"
> subj=3Dstaff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 key=3D(null)ARCH=3Dx86_64
> SYSCALL=3Dexecve AUID=3D"testadm" UID=3D"root" GID=3D"root" EUID=3D"root"=
 SUID=3D"root"
> FSUID=3D"root" EGID=3D"root" SGID=3D"root" FSGID=3D"root"
> type=3DPROCTITLE msg=3Daudit(1745581392.769:2056):
> proctitle=3D7368002D63002F6574632F696E69742E642F6D612073746F70
>
>
> ..which is not a straighforward avc denial. So searched for ways to tackl=
e
> this.
>
> Found the explanation for the log - a process running as sysadm_t
> (maconfig) tried to run a file labeled initrc_exec_t (/etc/init.d/ma - my
> application's script), and SELinux said "nope" because it would result in
> an invalid context transition to initrc_t.
>
> So tried a couple of other things:
> -Switched selinux to Permissive mode, got some user_avc denials. Added
> rules in policy for allowing those, but didn't work.
> -Added this domain transition rule to my policy (didn't work):
> domain_auto_trans(sysadm_t, initrc_exec_t, initrc_t);
> -Tried adding these role-type statements in policy (which I thought would
> work for sure but nope):
>   require {
>       role system_r, sysadm_r
>   }
>   role system_r types initrc_t;
>   #AND
>   role sysadm_r types initrc_t;
>
>
> Also got to know some more stuff from these pages :
>
>
> https://wiki.gentoo.org/wiki/SELinux/Tutorials/Linux_services_and_the_sys=
tem.
> ..
>
> https://github.com/SELinuxProject/selinux-notebook/blob/main/src/auditing=
.md
>
> ..but still not sure how to proceed. Pls help out if u can. Thanks in
> advance!
> --
> _______________________________________________
> selinux mailing list -- [email protected]
> To unsubscribe send an email to [email protected]
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedoraproject.org/archives/list/[email protected]=
.org
> Do not reply to spam, report it:
> https://pagure.io/fedora-infrastructure/new_issue
>


--=20

Zdenek Pytela
Security SELinux team

--000000000000a4bbbe0633d23d3a
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hi,</div><div><br></div><div>answers inline below.</d=
iv><br><div class=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" cl=
ass=3D"gmail_attr">On Sun, Apr 27, 2025 at 1:49=E2=80=AFAM chaitanya singh =
via selinux &lt;<a href=3D"mailto:[email protected]">selinux@=
lists.fedoraproject.org</a>&gt; wrote:<br></div><blockquote class=3D"gmail_=
quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,=
204);padding-left:1ex">Doing this on a RHEL8.10 distro.<br>
<br>
I&#39;ve created a user with staff_u role:<br>
# useradd -Z staff_u testadm<br>
<br>
And provided this user elevated permissions, for which did following steps:=
<br>
1. created: /etc/sudoers.d/mysudoers<br>
2. added this: %testadm ALL=3D(ALL) TYPE=3Dsysadm_t ROLE=3Dsysadm_r ALL<br>=
</blockquote><div>This is the correct step if you want to set it for users =
in the testadm group, for the testadm user it would be</div><div>testadm AL=
L=3D(ALL) TYPE=3Dsysadm_t ROLE=3Dsysadm_r ALL</div><div>=C2=A0<br></div><bl=
ockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-lef=
t:1px solid rgb(204,204,204);padding-left:1ex">
<br>
Did reboot. Installed my app&#39;s selinux policy module(rpm). Then logged =
in with this testadm user, and ran command to elevate to sysadm_r:sysadm_t:=
<br>
# sudo runcon -r sysadm_r -t sysadm_t -- su -<br></blockquote><div>This is =
not needed, just as the testadm user run</div><div><br></div><div>$ sudo -i=
</div><div><br></div><div>and then confirm the current context with</div><d=
iv><br></div><div># id -Z</div><div><br></div><blockquote class=3D"gmail_qu=
ote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,20=
4);padding-left:1ex">
<br>
<br>
Now, on this console, with selinux Enforcing, I try running my application&=
#39;s executable (maconfig) and I&#39;m getting this permission denied erro=
r:<br>
<br>
[root@6H0RHEL810 ~]# /opt/McAfee/agent/bin/maconfig -stop<br>
2025-04-25 11:43:12.768 (50811.50811) maconfig.Info: Stopping Trellix agent=
.<br>
sh: /etc/init.d/ma: /bin/sh: bad interpreter: Permission denied<br>
2025-04-25 11:43:12.770 (50811.50811) maconfig.Info: configuration finished=
<br>
<br>
<br>
So naturally, I looked for denials in var/log/audit/audit.log but got this =
instead:<br>
<br>
type=3DSELINUX_ERR msg=3Daudit(1745581392.769:2056): op=3Dsecurity_compute_=
sid invalid_context=3D&quot;staff_u:system_r:initrc_t:s0&quot; scontext=3Ds=
taff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=3Dsystem_u:object_r:initrc=
_exec_t:s0 tclass=3Dprocess<br>
type=3DSYSCALL msg=3Daudit(1745581392.769:2056): arch=3Dc000003e syscall=3D=
59 success=3Dno exit=3D-13 a0=3D5587d7a7b540 a1=3D5587d7a7c700 a2=3D5587d7a=
79e40 a3=3D0 items=3D0 ppid=3D50811 pid=3D50812 auid=3D1001 uid=3D0 gid=3D0=
 euid=3D0 suid=3D0 fsuid=3D0 egid=3D0 sgid=3D0 fsgid=3D0 tty=3Dpts1 ses=3D8=
 comm=3D&quot;sh&quot; exe=3D&quot;/usr/bin/bash&quot; subj=3Dstaff_u:sysad=
m_r:sysadm_t:s0-s0:c0.c1023 key=3D(null)ARCH=3Dx86_64 SYSCALL=3Dexecve AUID=
=3D&quot;testadm&quot; UID=3D&quot;root&quot; GID=3D&quot;root&quot; EUID=
=3D&quot;root&quot; SUID=3D&quot;root&quot; FSUID=3D&quot;root&quot; EGID=
=3D&quot;root&quot; SGID=3D&quot;root&quot; FSGID=3D&quot;root&quot;<br>
type=3DPROCTITLE msg=3Daudit(1745581392.769:2056): proctitle=3D7368002D6300=
2F6574632F696E69742E642F6D612073746F70<br>
<br>
<br>
..which is not a straighforward avc denial. So searched for ways to tackle =
this.<br>
<br>
Found the explanation for the log - a process running as sysadm_t (maconfig=
) tried to run a file labeled initrc_exec_t (/etc/init.d/ma - my applicatio=
n&#39;s script), and SELinux said &quot;nope&quot; because it would result =
in an invalid context transition to initrc_t.<br>
<br>
So tried a couple of other things:<br>
-Switched selinux to Permissive mode, got some user_avc denials. Added rule=
s in policy for allowing those, but didn&#39;t work.<br>
-Added this domain transition rule to my policy (didn&#39;t work): domain_a=
uto_trans(sysadm_t, initrc_exec_t, initrc_t);<br>
-Tried adding these role-type statements in policy (which I thought would w=
ork for sure but nope):<br>
=C2=A0 require {<br>
=C2=A0 =C2=A0 =C2=A0 role system_r, sysadm_r<br>
=C2=A0 }<br>
=C2=A0 role system_r types initrc_t;<br>
=C2=A0 #AND<br>
=C2=A0 role sysadm_r types initrc_t;<br>
<br>
<br>
Also got to know some more stuff from these pages :<br>
<br>
<a href=3D"https://wiki.gentoo.org/wiki/SELinux/Tutorials/Linux_services_an=
d_the_system." rel=3D"noreferrer" target=3D"_blank">https://wiki.gentoo.org=
/wiki/SELinux/Tutorials/Linux_services_and_the_system.</a>..<br>
<a href=3D"https://github.com/SELinuxProject/selinux-notebook/blob/main/src=
/auditing.md" rel=3D"noreferrer" target=3D"_blank">https://github.com/SELin=
uxProject/selinux-notebook/blob/main/src/auditing.md</a><br>
<br>
..but still not sure how to proceed. Pls help out if u can. Thanks in advan=
ce!<br>
-- <br>
_______________________________________________<br>
selinux mailing list -- <a href=3D"mailto:[email protected]" =
target=3D"_blank">[email protected]</a><br>
To unsubscribe send an email to <a href=3D"mailto:[email protected]=
aproject.org" target=3D"_blank">[email protected]</a><b=
r>
Fedora Code of Conduct: <a href=3D"https://docs.fedoraproject.org/en-US/pro=
ject/code-of-conduct/" rel=3D"noreferrer" target=3D"_blank">https://docs.fe=
doraproject.org/en-US/project/code-of-conduct/</a><br>
List Guidelines: <a href=3D"https://fedoraproject.org/wiki/Mailing_list_gui=
delines" rel=3D"noreferrer" target=3D"_blank">https://fedoraproject.org/wik=
i/Mailing_list_guidelines</a><br>
List Archives: <a href=3D"https://lists.fedoraproject.org/archives/list/sel=
[email protected]" rel=3D"noreferrer" target=3D"_blank">https://=
lists.fedoraproject.org/archives/list/[email protected]</a><b=
r>
Do not reply to spam, report it: <a href=3D"https://pagure.io/fedora-infras=
tructure/new_issue" rel=3D"noreferrer" target=3D"_blank">https://pagure.io/=
fedora-infrastructure/new_issue</a><br>
</blockquote></div><div><br clear=3D"all"></div><br><span class=3D"gmail_si=
gnature_prefix">-- </span><br><div dir=3D"ltr" class=3D"gmail_signature"><d=
iv dir=3D"ltr"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><div><div dir=3D=
"ltr"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><br=
>
Zdenek Pytela</div><div dir=3D"ltr">Security SELinux team</div></div></div>=
</div></div></div></div></div></div></div></div></div></div></div></div>

--000000000000a4bbbe0633d23d3a--


--===============1202678819307424611==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

LS0gCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCnNlbGlu
dXggbWFpbGluZyBsaXN0IC0tIHNlbGludXhAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmcKVG8gdW5z
dWJzY3JpYmUgc2VuZCBhbiBlbWFpbCB0byBzZWxpbnV4LWxlYXZlQGxpc3RzLmZlZG9yYXByb2pl
Y3Qub3JnCkZlZG9yYSBDb2RlIG9mIENvbmR1Y3Q6IGh0dHBzOi8vZG9jcy5mZWRvcmFwcm9qZWN0
Lm9yZy9lbi1VUy9wcm9qZWN0L2NvZGUtb2YtY29uZHVjdC8KTGlzdCBHdWlkZWxpbmVzOiBodHRw
czovL2ZlZG9yYXByb2plY3Qub3JnL3dpa2kvTWFpbGluZ19saXN0X2d1aWRlbGluZXMKTGlzdCBB
cmNoaXZlczogaHR0cHM6Ly9saXN0cy5mZWRvcmFwcm9qZWN0Lm9yZy9hcmNoaXZlcy9saXN0L3Nl
bGludXhAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmcKRG8gbm90IHJlcGx5IHRvIHNwYW0sIHJlcG9y
dCBpdDogaHR0cHM6Ly9wYWd1cmUuaW8vZmVkb3JhLWluZnJhc3RydWN0dXJlL25ld19pc3N1ZQo=

--===============1202678819307424611==--