Welcome to the Linux Foundation Forum!

SELINUX_ERR security_compute_sid invalid_context while running /etc/init.d script of my app

Doing this on a RHEL8.10 distro.

I've created a user with staff_u role:
# useradd -Z staff_u testadm

And provided this user elevated permissions, for which did following steps:
1. created: /etc/sudoers.d/mysudoers
2. added this: %testadm ALL=(ALL) TYPE=sysadm_t ROLE=sysadm_r ALL

Did reboot. Installed my app's selinux policy module(rpm). Then logged in with this testadm user, and ran command to elevate to sysadm_r:sysadm_t:
# sudo runcon -r sysadm_r -t sysadm_t -- su -

Now, on this console, with selinux Enforcing, I try running my application's executable (maconfig) and I'm getting this permission denied error:
[root@6H0RHEL810 ~]# /opt/McAfee/agent/bin/maconfig -stop
2025-04-25 11:43:12.768 (50811.50811) maconfig.Info: Stopping Trellix agent.
sh: /etc/init.d/ma: /bin/sh: bad interpreter: Permission denied
2025-04-25 11:43:12.770 (50811.50811) maconfig.Info: configuration finished

So naturally, I looked for denials in var/log/audit/audit.log but got this instead:
type=SELINUX_ERR msg=audit(1745581392.769:2056): op=security_compute_sid invalid_context="staff_u:system_r:initrc_t:s0" scontext=staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:initrc_exec_t:s0 tclass=process type=SYSCALL msg=audit(1745581392.769:2056): arch=c000003e syscall=59 success=no exit=-13 a0=5587d7a7b540 a1=5587d7a7c700 a2=5587d7a79e40 a3=0 items=0 ppid=50811 pid=50812 auid=1001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=8 comm="sh" exe="/usr/bin/bash" subj=staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64 SYSCALL=execve AUID="testadm" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root" type=PROCTITLE msg=audit(1745581392.769:2056): proctitle=7368002D63002F6574632F696E69742E642F6D612073746F70

..which is not a straighforward avc denial. So searched for ways to tackle this.

Found the explanation for the log - a process running as sysadm_t (maconfig) tried to run a file labeled initrc_exec_t (/etc/init.d/ma - my application's script), and SELinux said "nope" because it would result in an invalid context transition to initrc_t.

So tried a couple of other things:
-Switched selinux to Permissive mode, got some user_avc denials. Added rules in policy for allowing those, but didn't work.
-Added this domain transition rule to my policy (didn't work):
domain_auto_trans(sysadm_t, initrc_exec_t, initrc_t);
-Tried adding these role-type statements in policy (which I thought would work for sure but nope):
require {
role system_r, sysadm_r
}
role system_r types initrc_t;
AND
role sysadm_r types initrc_t;

Also got to know some more stuff from these pages
https://wiki.gentoo.org/wiki/SELinux/Tutorials/Linux_services_and_the_system_u_SELinux_user#:~:text=warrants%20proper%20control.-,Linux%20service%20scripts,-Most%20Linux%20service
https://github.com/SELinuxProject/selinux-notebook/blob/main/src/auditing.md
..but still not sure how to proceed. Pls help out if u can. Thanks in advance!

Welcome!

It looks like you're new here. Sign in or register to get started.
Sign In

Welcome!

It looks like you're new here. Sign in or register to get started.
Sign In

Categories

Upcoming Training