freeipa

#8512 Import of psutil can trigger SELinux violation
Closed: fixed by cheimes. Opened by cheimes.

Closed: fixed
Reopen Issue

Issue

Commit cfad7af35dd5a2cdd4081d1e9ac7c245f47f1dce added a check to ensure a system has sufficient amount of memory. The feature uses psutil to get available memory. On import psutil opens files in /proc which can result in SELinux violations:

Steps to Reproduce

  1. installer server with DNSSEC support
  2. Check logs

Actual behavior

ipa-ods-exporter[170326]: ipalib.plugable: DEBUG    importing plugin module ipaserver.plugins.group
ipa-ods-exporter[170326]: Traceback (most recent call last):
ipa-ods-exporter[170326]:   File "/usr/lib64/python3.9/site-packages/psutil/_common.py", line 405, in wrapper
ipa-ods-exporter[170326]:     return cache[key]
ipa-ods-exporter[170326]: KeyError: (('/proc',), frozenset())
ipa-ods-exporter[170326]: During handling of the above exception, another exception occurred:
ipa-ods-exporter[170326]: Traceback (most recent call last):
ipa-ods-exporter[170326]:   File "/usr/lib64/python3.9/site-packages/psutil/_pslinux.py", line 309, in <module>
ipa-ods-exporter[170326]:     set_scputimes_ntuple("/proc")
ipa-ods-exporter[170326]:   File "/usr/lib64/python3.9/site-packages/psutil/_common.py", line 407, in wrapper
ipa-ods-exporter[170326]:     ret = cache[key] = fun(*args, **kwargs)
ipa-ods-exporter[170326]:   File "/usr/lib64/python3.9/site-packages/psutil/_pslinux.py", line 276, in set_scputimes_ntuple
ipa-ods-exporter[170326]:     with open_binary('%s/stat' % procfs_path) as f:
ipa-ods-exporter[170326]:   File "/usr/lib64/python3.9/site-packages/psutil/_common.py", line 713, in open_binary
ipa-ods-exporter[170326]:     return open(fname, "rb", **kwargs)
ipa-ods-exporter[170326]: PermissionError: [Errno 13] Permission denied: '/proc/stat'
ipa-ods-exporter[170326]: ipalib.plugable: DEBUG    importing plugin module ipaserver.plugins.hbac

Expected behavior

No AVCs

Version/Release/Distribution

Latest 4.9-dev builds from master

See issue might be related to #8513, too.

Metadata Update from @cheimes:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/5132
- Issue assigned to cheimes

master:

  • 80fca8d7010ab8ed2190ef8fb57d882c61e89723 Delay import of psutil to avoid AVC

ipa-4-8:

  • 202d7da8df37b9e5fb58d4546ef996825021137a Delay import of psutil to avoid AVC

Metadata Update from @cheimes:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
Low
https://github.com/freeipa/freeipa/pull/5132
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.