SELINUX_ERR op=security_compute_sid invalid_context while running /etc/init.d script of my app

[chirag032001]

Doing this on a RHEL8.10 distro.

I've created a user with staff_u role:

useradd -Z staff_u testadm

And provided this user elevated permissions, for which did following steps:
1. created mysudoers file: /etc/sudoers.d/mysudoers
2. added this in it: %testadm ALL=(ALL) TYPE=sysadm_t ROLE=sysadm_r ALL

Did reboot. Installed my app's selinux policy module(rpm). Then logged in with this testadm user, and ran command to elevate to sysadm_r:sysadm_t:

sudo runcon -r sysadm_r -t sysadm_t -- su -

Now, on this console, with selinux Enforcing, I try running my application's executable (maconfig, which is internally running /etc/init.d/ma) and I'm getting this permission denied error:

[root@6H0RHEL810 ~]# /opt/McAfee/agent/bin/maconfig -stop
2025-04-25 11:43:12.768 (50811.50811) maconfig.Info: Stopping Trellix agent.
sh: /etc/init.d/ma: /bin/sh: bad interpreter: Permission denied
2025-04-25 11:43:12.770 (50811.50811) maconfig.Info: configuration finished

So naturally, I looked for denials in /var/log/audit/audit.log but got this instead:

type=SELINUX_ERR msg=audit(1745581392.769:2056): op=security_compute_sid invalid_context="staff_u:system_r:initrc_t:s0" scontext=staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:initrc_exec_t:s0 tclass=process
type=SYSCALL msg=audit(1745581392.769:2056): arch=c000003e syscall=59 success=no exit=-13 a0=5587d7a7b540 a1=5587d7a7c700 a2=5587d7a79e40 a3=0 items=0 ppid=50811 pid=50812 auid=1001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=8 comm="sh" exe="/usr/bin/bash" subj=staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64 SYSCALL=execve AUID="testadm" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root"
type=PROCTITLE msg=audit(1745581392.769:2056): proctitle=7368002D63002F6574632F696E69742E642F6D612073746F70

..which is not a straighforward avc denial. So searched for ways to tackle this.

Found the explanation for the log - a process running as sysadm_t (maconfig) tried to run a file labeled initrc_exec_t (/etc/init.d/ma), and SELinux said "nope" because it would result in an invalid context transition to initrc_t.

So tried a couple of other things:

1. Switched selinux to Permissive mode, got some user_avc denials. Added rules in policy for allowing those, but didn't work.
2. Added this domain transition rule to my policy (didn't work):

   domain_auto_trans(sysadm_t, initrc_exec_t, initrc_t);

3. Tried adding these role-type statements in policy (which I thought would work for sure but nope):

   require {
       role system_r, sysadm_r;
       type initrc_t;
   }
   role system_r types initrc_t;
   #AND
   role sysadm_r types initrc_t;

Also got to know some more stuff from these pages:
https://wiki.gentoo.org/wiki/SELinu...l.-,Linux service scripts,-Most Linux service
https://github.com/SELinuxProject/s.../src/auditing.md#general-selinux-audit-events

..but still not sure how to proceed. Pls help out if u can. Thanks in advance!

 

[dos2unix]

We generally try not to use rc.inint files anymore. But here are some things you can try.
You might need to enable allow_execmod or other related booleans.

getsebool -a | grep exec

Create a file named custom_policy.te

module custom_policy 1.0;
require {
    type sysadm_t;
    type initrc_exec_t;
    type initrc_t;
    class process transition;
}
allow sysadm_t initrc_exec_t:process transition;

Load the new policy

checkmodule -M -m -o custom_policy.mod custom_policy.te
semodule_package -o custom_policy.pp -m custom_policy.mod
semodule -i custom_policy.pp

Make sure all the contexts look correct

semanage fcontext -a -t initrc_exec_t /etc/init.d/ma
restorecon -v /etc/init.d/ma

Check the logs

grep denied /var/log/audit/audit.log | audit2allow -m mypol
semodule -i mypol.pp

If you temporarily set it to permissive, does it work?

setenforce 0

 

[chirag032001]

Thanks @dos2unix for replying! I'll try with ur mentioned steps and get back.

If you temporarily set it to permissive, does it work?

And yes, setting it permissive makes it work.

 

[chirag032001]

@dos2unix:

Here's the output of getsebool command:

[root@6H0RHEL810 ~]# getsebool -a | grep exec
auditadm_exec_content --> on
boinc_execmem --> on
cluster_use_execmem --> off
container_user_exec_content --> on
cups_execmem --> off
dbadm_exec_content --> on
deny_execmem --> off
dhcpc_exec_iptables --> off
glance_use_execmem --> off
guest_exec_content --> on
httpd_execmem --> off
httpd_ssi_exec --> off
httpd_tmp_exec --> off
logadm_exec_content --> on
mcelog_exec_scripts --> on
mplayer_execstack --> off
secadm_exec_content --> on
selinuxuser_execheap --> off
selinuxuser_execmod --> on
selinuxuser_execstack --> on
staff_exec_content --> on
sysadm_exec_content --> on
tomcat_use_execmem --> off
user_exec_content --> on
virt_use_execmem --> off
xdm_exec_bootloader --> off
xguest_exec_content --> on
xserver_execmem --> off

which doesn't have 'allow_execmod'. It does have 'selinuxuser_execmod' which is on.

Context of /etc/init.d/ma:

[root@6H0RHEL810 tmp2]# ls -Z /etc/init.d/ma
system_u:object_r:initrc_exec_t:s0 /etc/init.d/ma

Loaded the custom_policy,

[root@6H0RHEL810 ~]# semodule -l | grep custom_policy
custom_policy

but still getting the same SELINUX_ERR after running my app's command.
Command output:

[root@6H0RHEL810 ~]# /opt/McAfee/agent/bin/maconfig -stop
2025-04-27 01:53:18.782 (3131.3131) maconfig.Info: Stopping Trellix agent.
sh: /etc/init.d/ma: /bin/sh: bad interpreter: Permission denied
2025-04-27 01:53:18.786 (3131.3131) maconfig.Info: configuration finished

/var/log/audit/audit.log:

type=SELINUX_ERR msg=audit(1745718798.784:318): op=security_compute_sid invalid_context="staff_u:system_r:initrc_t:s0" scontext=staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:initrc_exec_t:s0 tclass=process
type=SYSCALL msg=audit(1745718798.784:318): arch=c000003e syscall=59 success=no exit=-13 a0=55b41f14a540 a1=55b41f14b700 a2=55b41f148e40 a3=0 items=0 ppid=3131 pid=3132 auid=1001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=6 comm="sh" exe="/usr/bin/bash" subj=staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64 SYSCALL=execve AUID="testadm" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root"
type=PROCTITLE msg=audit(1745718798.784:318): proctitle=7368002D63002F6574632F696E69742E642F6D612073746F70

No avc denials still.

Then I did this:

grep denied /var/log/audit/audit.log | audit2allow -m mypol

and loaded its policy as well

[root@6H0RHEL810 tmp3]# semodule -l | grep mypol
mypol

but still the issue persists.

Pls let me know if there's anything else I can try.

 

[dos2unix]

sh: /etc/init.d/ma: /bin/sh: bad interpreter: Permission denied

Does /bin/sh exist?
Do you have permission to run it?
Does the testadm account have permission?[/code]

 

[chirag032001]

Does /bin/sh exist?

Yes, it does:

[root@6H0RHEL810 tmp3]# ls -lZ /bin/sh
lrwxrwxrwx. 1 root root system_u:object_r:bin_t:s0 4 Feb 10  2024 /bin/sh -> bash

[root@6H0RHEL810 tmp3]# ls -lZ /bin/bash
-rwxr-xr-x. 1 root root system_u:object_r:shell_exec_t:s0 1150584 Feb 10  2024 /bin/bash

So seems like testadm would be able to execute it with these permissions.

 

[dos2unix]

Does testadm have a login shell?