SELINUX_ERR security_compute_sid invalid_context while running /etc/init.d script of my app
Doing this on a RHEL8.10 distro.
I've created a user with staff_u role:
# useradd -Z staff_u testadm
And provided this user elevated permissions, for which did following steps:
1. created: /etc/sudoers.d/mysudoers
2. added this: %testadm ALL=(ALL) TYPE=sysadm_t ROLE=sysadm_r ALL
Did reboot. Installed my app's selinux policy module(rpm). Then logged in with this testadm user, and ran command to elevate to sysadm_r:sysadm_t:
# sudo runcon -r sysadm_r -t sysadm_t -- su -
Now, on this console, with selinux Enforcing, I try running my application's executable (maconfig) and I'm getting this permission denied error:
[root@6H0RHEL810 ~]# /opt/McAfee/agent/bin/maconfig -stop
2025-04-25 11:43:12.768 (50811.50811) maconfig.Info: Stopping Trellix agent.
sh: /etc/init.d/ma: /bin/sh: bad interpreter: Permission denied
2025-04-25 11:43:12.770 (50811.50811) maconfig.Info: configuration finished
So naturally, I looked for denials in var/log/audit/audit.log but got this instead:type=SELINUX_ERR msg=audit(1745581392.769:2056): op=security_compute_sid invalid_context="staff_u:system_r:initrc_t:s0" scontext=staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:initrc_exec_t:s0 tclass=process type=SYSCALL msg=audit(1745581392.769:2056): arch=c000003e syscall=59 success=no exit=-13 a0=5587d7a7b540 a1=5587d7a7c700 a2=5587d7a79e40 a3=0 items=0 ppid=50811 pid=50812 auid=1001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=8 comm="sh" exe="/usr/bin/bash" subj=staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64 SYSCALL=execve AUID="testadm" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root" type=PROCTITLE msg=audit(1745581392.769:2056): proctitle=7368002D63002F6574632F696E69742E642F6D612073746F70
..which is not a straighforward avc denial. So searched for ways to tackle this.
Found the explanation for the log - a process running as sysadm_t (maconfig) tried to run a file labeled initrc_exec_t (/etc/init.d/ma - my application's script), and SELinux said "nope" because it would result in an invalid context transition to initrc_t.
So tried a couple of other things:
-Switched selinux to Permissive mode, got some user_avc denials. Added rules in policy for allowing those, but didn't work.
-Added this domain transition rule to my policy (didn't work):
domain_auto_trans(sysadm_t, initrc_exec_t, initrc_t);
-Tried adding these role-type statements in policy (which I thought would work for sure but nope):
require {
role system_r, sysadm_r
}
role system_r types initrc_t;
AND
role sysadm_r types initrc_t;
Also got to know some more stuff from these pages
https://wiki.gentoo.org/wiki/SELinux/Tutorials/Linux_services_and_the_system_u_SELinux_user#:~:text=warrants%20proper%20control.-,Linux%20service%20scripts,-Most%20Linux%20service
https://github.com/SELinuxProject/selinux-notebook/blob/main/src/auditing.md
..but still not sure how to proceed. Pls help out if u can. Thanks in advance!
Categories
- All Categories
- 242 LFX Mentorship
- 242 LFX Mentorship: Linux Kernel
- 815 Linux Foundation IT Professional Programs
- 366 Cloud Engineer IT Professional Program
- 165 Advanced Cloud Engineer IT Professional Program
- 83 DevOps Engineer IT Professional Program
- 131 Cloud Native Developer IT Professional Program
- 142 Express Training Courses & Microlearning
- 119 Express Courses - Discussion Forum
- Microlearning - Discussion Forum
- 6.6K Training Courses
- 40 LFC110 Class Forum - Discontinued
- 72 LFC131 Class Forum
- 49 LFD102 Class Forum
- 234 LFD103 Class Forum
- 16 LFD110 Class Forum
- 31 LFD121 Class Forum
- LFD123 Class Forum
- LFD125 Class Forum
- 16 LFD133 Class Forum
- 6 LFD134 Class Forum
- 17 LFD137 Class Forum
- 70 LFD201 Class Forum
- 3 LFD210 Class Forum
- 2 LFD210-CN Class Forum
- 2 LFD213 Class Forum - Discontinued
- 128 LFD232 Class Forum - Discontinued
- 2 LFD233 Class Forum
- 2 LFD237 Class Forum
- 24 LFD254 Class Forum
- 719 LFD259 Class Forum
- 109 LFD272 Class Forum
- 4 LFD272-JP クラス フォーラム
- 10 LFD273 Class Forum
- 233 LFS101 Class Forum
- 1 LFS111 Class Forum
- 2 LFS112 Class Forum
- 1 LFS116 Class Forum
- 3 LFS118 Class Forum
- LFS120 Class Forum
- 2 LFS142 Class Forum
- 2 LFS144 Class Forum
- 3 LFS145 Class Forum
- 1 LFS146 Class Forum
- 15 LFS148 Class Forum
- 8 LFS151 Class Forum
- 1 LFS157 Class Forum
- 63 LFS158 Class Forum
- LFS158-JP クラス フォーラム
- 4 LFS162 Class Forum
- 1 LFS166 Class Forum
- 5 LFS167 Class Forum
- 1 LFS170 Class Forum
- 2 LFS171 Class Forum
- 2 LFS178 Class Forum
- 2 LFS180 Class Forum
- 1 LFS182 Class Forum
- 5 LFS183 Class Forum
- 30 LFS200 Class Forum
- 737 LFS201 Class Forum - Discontinued
- 2 LFS201-JP クラス フォーラム
- 17 LFS203 Class Forum
- 135 LFS207 Class Forum
- 1 LFS207-DE-Klassenforum
- LFS207-JP クラス フォーラム
- 302 LFS211 Class Forum
- 55 LFS216 Class Forum
- 53 LFS241 Class Forum
- 50 LFS242 Class Forum
- 37 LFS243 Class Forum
- 13 LFS244 Class Forum
- 1 LFS245 Class Forum
- LFS246 Class Forum
- LFS248 Class Forum
- 80 LFS250 Class Forum
- 2 LFS250-JP クラス フォーラム
- LFS251 Class Forum
- 143 LFS253 Class Forum
- LFS254 Class Forum
- LFS255 Class Forum
- 6 LFS256 Class Forum
- LFS257 Class Forum
- 1.2K LFS258 Class Forum
- 9 LFS258-JP クラス フォーラム
- 135 LFS260 Class Forum
- 151 LFS261 Class Forum
- 41 LFS262 Class Forum
- 82 LFS263 Class Forum - Discontinued
- 15 LFS264 Class Forum - Discontinued
- 11 LFS266 Class Forum - Discontinued
- 22 LFS267 Class Forum
- 25 LFS268 Class Forum
- 29 LFS269 Class Forum
- 7 LFS270 Class Forum
- 199 LFS272 Class Forum
- 1 LFS272-JP クラス フォーラム
- 2 LFS147 Class Forum
- LFS274 Class Forum
- 3 LFS281 Class Forum
- 2 LFW111 Class Forum
- 257 LFW211 Class Forum
- 176 LFW212 Class Forum
- 12 SKF100 Class Forum
- SKF200 Class Forum
- 2 SKF201 Class Forum
- 789 Hardware
- 199 Drivers
- 68 I/O Devices
- 37 Monitors
- 98 Multimedia
- 174 Networking
- 91 Printers & Scanners
- 83 Storage
- 753 Linux Distributions
- 82 Debian
- 67 Fedora
- 17 Linux Mint
- 13 Mageia
- 23 openSUSE
- 147 Red Hat Enterprise
- 31 Slackware
- 13 SUSE Enterprise
- 350 Ubuntu
- 464 Linux System Administration
- 39 Cloud Computing
- 70 Command Line/Scripting
- Github systems admin projects
- 91 Linux Security
- 78 Network Management
- 101 System Management
- 47 Web Management
- 69 Mobile Computing
- 17 Android
- 28 Development
- 1.2K New to Linux
- 1K Getting Started with Linux
- 365 Off Topic
- 113 Introductions
- 176 Small Talk
- 26 Study Material
- 521 Programming and Development
- 291 Kernel Development
- 212 Software Development
- 1.1K Software
- 263 Applications
- 180 Command Line
- 3 Compiling/Installing
- 988 Games
- 311 Installation
- 79 All In Program
- 79 All In Forum
Upcoming Training
-
August 20, 2018
Kubernetes Administration (LFS458)
-
August 20, 2018
Linux System Administration (LFS301)
-
August 27, 2018
Open Source Virtualization (LFS462)
-
August 27, 2018
Linux Kernel Debugging and Security (LFD440)