"avc: denied { open }" on /var/log/insights-client/insights-client.log for command "chronyc" when executing insights-client

Solution Verified - Updated -

Issue

  • When executing insights-client on systems that have Sophos Anti-Virus (sav-protect.service) installed, the following AVC is seen

    type=AVC msg=audit(...): avc:  denied  { open } for  pid=XXX comm="chronyc" path="/var/log/insights-client/insights-client.log" ... scontext=system_u:system_r:chronyc_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file permissive=0
    
  • The following messages are seen in the journal at the time the AVC is displayed

    kernel: [...] talpa-vetting: [intercepted XXX-PID-PID] Open failed (-13), will have no stream
    kernel: [...] talpa-deny: Error occurred while closing /var/log/insights-client/insights-client.log on behalf of process chronyc[PID/PID] owned by 0(0)/0(0) <60>
    kernel: [...] talpa-vetting: [intercepted XXX-PID-PID] Open failed (-13), will have no stream
    kernel: [...] talpa-deny: Error occurred while closing /var/log/insights-client/insights-client.log on behalf of process chronyc[PID/PID] owned by 0(0)/0(0) <60>
    kernel: [...] talpa-vetting: [intercepted XXX-PID-PID] Open failed (-13), will have no stream
    kernel: [...] talpa-deny: Error occurred while closing /var/log/insights-client/insights-client.log on behalf of process chronyc[PID/PID] owned by 0(0)/0(0) <60>
    savd: Error detected: 0x3c: Unable to write to talpa socket in /var/log/insights-client/insights-client.log
    savd: Error detected: 0x3c: Unable to write to talpa socket in /var/log/insights-client/insights-client.log
    savd: Error detected: 0x3c: Unable to write to talpa socket in /var/log/insights-client/insights-client.log
    

Environment

  • Red Hat Enterprise Linux 7 and later
    • Sophos Anti-Virus
    • insights-client
    • chronyc

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content