Auto-Protect kernel modules fail to load with SELinux set to enforcing.
Article ID: 184910
Updated On:
Products
Issue/Introduction
When attempting to install Endpoint Protection (SEP) client on a Linux system, the Auto-Protect kernel modules fail to load.
Mon Jan 27 21:40:19 CAT 2020: Build succeeded
Stopping smcd (via systemctl): [ OK ]
Stopping rtvscand (via systemctl): [ OK ]
Stopping symcfgd (via systemctl): [ OK ]
CONFIG_RETPOLINE=y
insmod: ERROR: could not insert module /opt/Symantec/autoprotect/.symevrm-custom-4.14.35-1902.7.3.1.el7uek-x86_64.ko: Permission denied
.symevrm: unable to load kernel support module (UNSUPPORTED-OS-or-UNK-UNK-4.14.35-1902.7.3.1.el7uek-x86_64)
Restarting autoprotect (via systemctl): Job for autoprotect.service failed because the control process exited with error code. See "systemctl status autoprotect.service" and "journalctl -xe" for details.
[FAILED]
kernel drivers are not loaded.
Starting symcfgd (via systemctl).
Environment
Oracle Linux 7
Cause
The default SELinux Policy will prevent the Auto-Protect kernel modules from loading.
Resolution
To allow the the Auto-Protect kernel modules to load, you can either disable enforcement of the SELinux policy or create a custom SELinux policy to allow the Auto-Protect kernel modules.
To disable SELinux enforcement:
- Open the following file in a text editor: /etc/selinux/config
- Change SELINUX=enforcing to either SELINUX=disabled or SELINUX=permissive
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=disabled
# SELINUXTYPE= can take one of these two values:
# targeted - Targeted processes are protected,
# mls - Multi Level Security protection.
SELINUXTYPE=targeted
- Restart the computer.
To create a custom SELinux policy, you can use the audit2allow utility.
- Install audit2allow. (On Red-Hat based distros this is usually yum install policycoreutils-python)
- Run the following command:
ausearch -c 'insmod' --raw
You should see entries similar to the following:
type=AVC msg=audit(1580151264.883:178): avc: denied { module_load } for pid=3871 comm="insmod" path="/opt/Symantec/autoprotect/symev-custom-4.14.35-1902.7.3.1.el7uek-x86_64.ko" dev="dm-0" ino=134307803 scontext=system_u:system_r:insmod_t:s0 tcontext=unconfined_u:object_r:usr_t:s0 tclass=system permissive=0
type=SYSCALL msg=audit(1580151264.883:178): arch=c000003e syscall=313 success=no exit=-13 a0=3 a1=41a9ee a2=0 a3=3 items=0 ppid=3807 pid=3871 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="insmod" exe="/usr/bin/kmod" subj=system_u:system_r:insmod_t:s0 key=(null)
type=PROCTITLE msg=audit(1580151264.883:178): proctitle=2F7362696E2F696E736D6F64002F6F70742F53796D616E7465632F6175746F70726F746563742F73796D65762D637573746F6D2D342E31342E33352D313930322E372E332E312E656C3775656B2D7838365F36342E6B6F
type=AVC msg=audit(1580151264.764:177): avc: denied { module_load } for pid=3793 comm="insmod" path="/opt/Symantec/autoprotect/.symevrm-custom-4.14.35-1902.7.3.1.el7uek-x86_64.ko" dev="dm-0" ino=134307804 scontext=unconfined_u:system_r:insmod_t:s0 tcontext=unconfined_u:object_r:usr_t:s0 tclass=system permissive=0
type=SYSCALL msg=audit(1580151264.764:177): arch=c000003e syscall=313 success=no exit=-13 a0=3 a1=41a9ee a2=0 a3=3 items=0 ppid=3727 pid=3793 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="insmod" exe="/usr/bin/kmod" subj=unconfined_u:system_r:insmod_t:s0 key=(null)
type=PROCTITLE msg=audit(1580151264.764:177): proctitle=2F7362696E2F696E736D6F64002F6F70742F53796D616E7465632F6175746F70726F746563742F2E73796D6576726D2D637573746F6D2D342E31342E33352D313930322E372E332E312E656C3775656B2D7838365F36342E6B6F
- Now pull the file path for symev-custom and .symevrm-custom and run the following commands:
ausearch -c 'insmod' -f '/opt/Symantec/autoprotect/symev-custom-4.14.35-1902.7.3.1.el7uek-x86_64.ko' --raw | audit2allow -M symev-insmod
semodule -i symev-insmod.pp
ausearch -c 'insmod' -f '/opt/Symantec/autoprotect/.symevrm-custom-4.14.35-1902.7.3.1.el7uek-x86_64.ko' --raw | audit2allow -M symevrm-insmod
semodule -i symevrm-insmod.pp
Feedback
