set lock permissions to /proc/meminfo for /usr/share/dotnet/dotnet

[imma-cx]

Hi. I'm trying to run a service in RHEL 8.5 with SELinux enforcing security.
I was able to overcome some issues using Udica to set up volumes and network settings.

I'm facing now an issue where I get the following info:
SELinux is preventing /usr/share/dotnet/dotnet from lock access on the file /proc/meminfo

If I try to add this rule to SELinux using udica, I get the folllwing error:
XXX.process is an orphan.

Can you please help me setup permissions for { lock } or { execute} or read and write permissions to /proc/meminfo?

Thank you

[mheon]

@rhatdan PTAL

[rhatdan]

Could you please show the AVC messages?

[rhatdan]

@wrabcak FYI

[imma-cx]

@rhatdan Thank you very much for the answer.

There are many messages but similar to these two:

avc: denied { lock } for pid=3844 comm="dotnet" path="/proc/meminfo" dev="proc" ino=4026532024 scontext=system_u:system_r:engine_udica.process:s0:c161,c662 tcontext=system_u:object_r:proc_t:s0 tclass=file permissive=0

avc: denied { execute } for pid=3844 comm="dotnet" path="/dev/zero" dev="devtmpfs" ino=1030 scontext=system_u:system_r:engine_udica.process:s0:c161,c662 tcontext=system_u:object_r:zero_device_t:s0 tclass=chr_file permissive=0

This is one of the entire SYSCALL
type=SYSCALL msg=audit(1653077621.163:8891): arch=c000003e syscall=73 per=400000 success=no exit=-13 a0=18a a1=8 a2=7f187dd60670 a3=7f180be04328 items=0 ppid=1851 pid=3844 auid=1000 uid=100999 gid=100999 euid=100999 suid=100999 fsuid=100999 egid=100999 sgid=100999 fsgid=100999 tty=(none) ses=3 comm="dotnet" exe="/usr/share/dotnet/dotnet" subj=system_u:system_r:engine_udica.process:s0:c161,c662 key=(null)^]ARCH=x86_64 SYSCALL=flock AUID="ec2-user" UID="unknown(100999)" GID="unknown(100999)" EUID="unknown(100999)" SUID="unknown(100999)" FSUID="unknown(100999)" EGID="unknown(100999)" SGID="unknown(100999)" FSGID="unknown(100999)"
type=PROCTITLE msg=audit(1653077621.163:8891): proctitle=646F746E6574002F6170702F6378736173742D656E67696E652D7365727665722F656E67696E652D7365727665722F4378456E67696E654167656E742E646C6C0061316463366662362D353432342D346239372D383136622D333632666138613966316435005F5F686173685F5F007463703A2F2F736173742E696D6D612E63
type=AVC msg=audit(1653077621.165:8892): avc: denied { execute } for pid=3844 comm="dotnet" path="/dev/zero" dev="devtmpfs" ino=1030 scontext=system_u:system_r:engine_udica.process:s0:c161,c662 tcontext=system_u:object_r:zero_device_t:s0 tclass=chr_file permissive=0

[rhatdan]

Looks like a simple change to container-selinux would allow this access without requiring udica I belive.

Could you attempt to run this container with container_t and see if it generates the same AVCs?

[rhatdan]

https://github.com/containers/container-selinux/releases/tag/v2.187.0

[imma-cx]

When I run the container without using udica and without container-selinux, only with container_t I get the following message.

type=AVC msg=audit(1653485153.165:992): avc: denied { write } for pid=19776 comm="dotnet" name="Scans" dev="nvme0n1p2" ino=28181155 scontext=system_u:system_r:container_t:s0:c89,c560 tcontext=system_u:object_r:user_home_t:s0 tclass=dir permissive=0

I was able to overcome the issue with the volumes mount and the port for communication with ActiveMQ by using Udica.
I'm just having issues with the 'dotnet' permission for path="/dev/zero" and path="/proc/meminfo".
Can this be done using only udica?
Or using only container-selinux?

[rhatdan]

This looks like you are volume mounting content from the home dir into a container without doing :Z on the volume mount?

[imma-cx]

I'm running with :Z and this solution fixed the issue of the volume without using udica.
I was using :rw
Thank you.

Now I'm having only the issue with:
SELinux is preventing /usr/share/dotnet/dotnet from execute access on the chr_file /dev/zero.

type=AVC msg=audit(1653490294.588:2951): avc: denied { execute } for pid=20694 comm="dotnet" path="/dev/zero" dev="devtmpfs" ino=1030 scontext=system_u:system_r:container_t:s0:c238,c525 tcontext=system_u:object_r:zero_device_t:s0 tclass=chr_file permissive=0

If I try now to add the rule by using
ausearch -c 'dotnet' --raw | audit2allow -M my-dotnet `
I have an error related to the engine_udica so I think I have a previous config blocking me.
libsepol.hierarchy_add_type_callback: engine_udica doesn't exist, cxengine_udica.process is an orphan

can you help?
Thank you so much

[rhatdan]

The AVC will be fixed once you download a newer container-selinux. container-selinux-2.187.0-1.fc36

grep container_t /var/log/audit/audit.log | audit2allow -M my-dotnet `

[imma-cx]

This solution worked!!!
Without using udica and with the :Z instead of :rw.
More elegante and simpe!
Thank you very much.

[wrabcak]

@vmojzis please take a look.