Confined user mapped to SELinux sysadm_r, cannot run subscription-manager commands even after sudo'ing
Issue
When a user is running as SELinux role sysadm_r sysadm_t, subscription-manager commands do not work.
$ sudo -r sysadm_r -t sysadm_t subscription-manager repos --list
ERROR:dbus.proxies:Introspect error on :1.2209:/EntitlementStatus: dbus.exceptions.DBusException: org.freedesktop.DBus.Error.AccessDenied: An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_call", sender=":1.2208" (uid=0 pid=20422 comm="/usr/bin/python2 /sbin/subscription-manager repos ") interface="org.freedesktop.DBus.Introspectable" member="Introspect" error name="(unset)" requested_reply="0" destination=":1.2209" (uid=0 pid=20434 comm="/usr/bin/python2 /usr/libexec/rhsmd ")
ERROR:subscription_manager.dbus_interface:org.freedesktop.DBus.Error.AccessDenied: An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_call", sender=":1.2208" (uid=0 pid=20422 comm="/usr/bin/python2 /sbin/subscription-manager repos ") interface="com.redhat.SubscriptionManager.EntitlementStatus" member="update_status" error name="(unset)" requested_reply="0" destination=":1.2209" (uid=0 pid=20434 comm="/usr/bin/python2 /usr/libexec/rhsmd ")
Traceback (most recent call last):
File "/usr/lib64/python2.7/site-packages/subscription_manager/dbus_interface.py", line 64, in _update
ignore_reply=self.has_main_loop)
File "/usr/lib64/python2.7/site-packages/dbus/proxies.py", line 70, in __call__
return self._proxy_method(*args, **keywords)
File "/usr/lib64/python2.7/site-packages/dbus/proxies.py", line 145, in __call__
**keywords)
File "/usr/lib64/python2.7/site-packages/dbus/connection.py", line 651, in call_blocking
message, timeout)
DBusException: org.freedesktop.DBus.Error.AccessDenied: An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_call", sender=":1.2208" (uid=0 pid=20422 comm="/usr/bin/python2 /sbin/subscription-manager repos ") interface="com.redhat.SubscriptionManager.EntitlementStatus" member="update_status" error name="(unset)" requested_reply="0" destination=":1.2209" (uid=0 pid=20434 comm="/usr/bin/python2 /usr/libexec/rhsmd ")
WARNING:subscription_manager.logutil:logging already initialized
+----------------------------------------------------------+
Available Repositories in /etc/yum.repos.d/redhat.repo
+----------------------------------------------------------+
Repo ID: rhel-7-server-v2vwin-1-debug-rpms
[snip]
Environment
- Red Hat Enterprise Linux 7
- confined user mapped to sysadm_u or transitioning to sysadm_r
- subscription-manager
- SELinux
- /etc/sudoers
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.