{"action":"closed","issue":{"url":"https://api.github.com/repos/dfinity-lab/hs-dfinity-crypto/issues/4","repository_url":"https://api.github.com/repos/dfinity-lab/hs-dfinity-crypto","labels_url":"https://api.github.com/repos/dfinity-lab/hs-dfinity-crypto/issues/4/labels{/name}","comments_url":"https://api.github.com/repos/dfinity-lab/hs-dfinity-crypto/issues/4/comments","events_url":"https://api.github.com/repos/dfinity-lab/hs-dfinity-crypto/issues/4/events","html_url":"https://github.com/dfinity-lab/hs-dfinity-crypto/issues/4","id":342941433,"node_id":"MDU6SXNzdWUzNDI5NDE0MzM=","number":4,"title":"Tests fail on Red Hat Enterprise Linux with default USGCB security policy.","user":{"login":"enzoh","id":6695519,"node_id":"MDQ6VXNlcjY2OTU1MTk=","avatar_url":"https://avatars3.githubusercontent.com/u/6695519?v=4","gravatar_id":"","url":"https://api.github.com/users/enzoh","html_url":"https://github.com/enzoh","followers_url":"https://api.github.com/users/enzoh/followers","following_url":"https://api.github.com/users/enzoh/following{/other_user}","gists_url":"https://api.github.com/users/enzoh/gists{/gist_id}","starred_url":"https://api.github.com/users/enzoh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/enzoh/subscriptions","organizations_url":"https://api.github.com/users/enzoh/orgs","repos_url":"https://api.github.com/users/enzoh/repos","events_url":"https://api.github.com/users/enzoh/events{/privacy}","received_events_url":"https://api.github.com/users/enzoh/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2018-07-20T01:25:00Z","updated_at":"2018-07-31T16:18:05Z","closed_at":"2018-07-31T16:18:05Z","author_association":"CONTRIBUTOR","body":"```\r\nSELinux is preventing /tmp/nix-build-dfinity-crypto-0.0.0.drv-0/hs-dfinity-crypto/dist/build/bls-unit-tests/bls-unit-tests from using the execheap access on a process.\r\n\r\n*****  Plugin allow_execheap (53.1 confidence) suggests   ********************\r\n\r\nIf you do not think /tmp/nix-build-dfinity-crypto-0.0.0.drv-0/hs-dfinity-crypto/dist/build/bls-unit-tests/bls-unit-tests should need to map heap memory that is both writable and executable.\r\nThen you need to report a bug. This is a potentially dangerous access.\r\nDo\r\ncontact your security administrator and report this issue.\r\n\r\n*****  Plugin catchall_boolean (42.6 confidence) suggests   ******************\r\n\r\nIf you want to allow selinuxuser to execheap\r\nThen you must tell SELinux about this by enabling the 'selinuxuser_execheap' boolean.\r\n\r\nDo\r\nsetsebool -P selinuxuser_execheap 1\r\n\r\n*****  Plugin catchall (5.76 confidence) suggests   **************************\r\n\r\nIf you believe that bls-unit-tests should be allowed execheap access on processes labeled unconfined_t by default.\r\nThen you should report this as a bug.\r\nYou can generate a local policy module to allow this access.\r\nDo\r\nallow this access for now by executing:\r\n# ausearch -c 'bls-unit-tests' --raw | audit2allow -M my-blsunittests\r\n# semodule -i my-blsunittests.pp\r\n\r\nAdditional Information:\r\nSource Context                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1\r\n                              023\r\nTarget Context                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1\r\n                              023\r\nTarget Objects                Unknown [ process ]\r\nSource                        bls-unit-tests\r\nSource Path                   /tmp/nix-build-dfinity-crypto-0.0.0.drv-0/hs-\r\n                              dfinity-crypto/dist/build/bls-unit-tests/bls-unit-\r\n                              tests\r\nPort                          <Unknown>\r\nHost                          sovereign\r\nSource RPM Packages           \r\nTarget RPM Packages           \r\nPolicy RPM                    selinux-policy-3.13.1-192.el7_5.4.noarch\r\nSelinux Enabled               True\r\nPolicy Type                   targeted\r\nEnforcing Mode                Enforcing\r\nHost Name                     sovereign\r\nPlatform                      Linux sovereign 3.10.0-862.9.1.el7.x86_64 #1 SMP\r\n                              Wed Jun 27 04:30:39 EDT 2018 x86_64 x86_64\r\nAlert Count                   1\r\nFirst Seen                    2018-07-19 17:21:09 PDT\r\nLast Seen                     2018-07-19 17:21:09 PDT\r\nLocal ID                      24f3cf64-e531-4798-bc67-2f51382cfdda\r\n\r\nRaw Audit Messages\r\ntype=AVC msg=audit(1532046069.847:85769): avc:  denied  { execheap } for  pid=4458 comm=\"bls-unit-tests\" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process\r\n\r\n\r\ntype=SYSCALL msg=audit(1532046069.847:85769): arch=x86_64 syscall=mprotect per=40000 success=no exit=EACCES a0=74f000 a1=8000 a2=7 a3=fff items=0 ppid=4453 pid=4458 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm=bls-unit-tests exe=/tmp/nix-build-dfinity-crypto-0.0.0.drv-0/hs-dfinity-crypto/dist/build/bls-unit-tests/bls-unit-tests subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)\r\n\r\nHash: bls-unit-tests,unconfined_t,unconfined_t,process,execheap\r\n```"}}
{"actor":{"display_login":"enzoh"}}