Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
DescriptionKaushik Banerjee
2013-09-05 09:15:46 UTC
Description of problem:
SELinux is preventing /usr/bin/net from block_suspend access on the capability2
Version-Release number of selected component (if applicable):
samba-common-4.1.0-0.5.rc2
selinux-policy-3.12.1-73
How reproducible:
Always
Steps to Reproduce:
1. Try to join a RHEL7 machine to the AD domain using the realmd tool as follows:
realm join -v -U Administrator --user-principal=host/clienthostname ad_domain.com
Actual results:
Join is successful, but avcs appear.
SELinux is preventing /usr/bin/net from block_suspend access on the capability2 .
Additional Information:
Source Context system_u:system_r:samba_net_t:s0-s0:c0.c1023
Target Context system_u:system_r:samba_net_t:s0-s0:c0.c1023
Target Objects [ capability2 ]
Source net
Source Path /usr/bin/net
Port <Unknown>
Host clienthostname
Source RPM Packages samba-common-4.1.0-0.5.rc2.el7.x86_64
Target RPM Packages
Policy RPM selinux-policy-3.12.1-73.el7.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name clienthostname
Platform Linux clienthostname
3.10.0-2.el7.x86_64 #1 SMP Fri Jul 19 14:41:08 EDT
2013 x86_64 x86_64
Alert Count 455
First Seen 2013-08-12 19:26:53 IST
Last Seen 2013-09-05 14:35:47 IST
Local ID 4be69344-e3b6-4550-92e1-60f3ba2521b4
Raw Audit Messages
type=AVC msg=audit(1378371947.682:48194): avc: denied { block_suspend } for pid=2408 comm="net" capability=36 scontext=system_u:system_r:samba_net_t:s0-s0:c0.c1023 tcontext=system_u:system_r:samba_net_t:s0-s0:c0.c1023 tclass=capability2
type=SYSCALL msg=audit(1378371947.682:48194): arch=x86_64 syscall=epoll_ctl success=yes exit=0 a0=3 a1=2 a2=5 a3=7ffff98cb290 items=0 ppid=2333 pid=2408 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm=net exe=/usr/bin/net subj=system_u:system_r:samba_net_t:s0-s0:c0.c1023 key=(null)
Hash: net,samba_net_t,samba_net_t,capability2,block_suspend
Expected results:
No avc should appear.
Description of problem: SELinux is preventing /usr/bin/net from block_suspend access on the capability2 Version-Release number of selected component (if applicable): samba-common-4.1.0-0.5.rc2 selinux-policy-3.12.1-73 How reproducible: Always Steps to Reproduce: 1. Try to join a RHEL7 machine to the AD domain using the realmd tool as follows: realm join -v -U Administrator --user-principal=host/clienthostname ad_domain.com Actual results: Join is successful, but avcs appear. SELinux is preventing /usr/bin/net from block_suspend access on the capability2 . Additional Information: Source Context system_u:system_r:samba_net_t:s0-s0:c0.c1023 Target Context system_u:system_r:samba_net_t:s0-s0:c0.c1023 Target Objects [ capability2 ] Source net Source Path /usr/bin/net Port <Unknown> Host clienthostname Source RPM Packages samba-common-4.1.0-0.5.rc2.el7.x86_64 Target RPM Packages Policy RPM selinux-policy-3.12.1-73.el7.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name clienthostname Platform Linux clienthostname 3.10.0-2.el7.x86_64 #1 SMP Fri Jul 19 14:41:08 EDT 2013 x86_64 x86_64 Alert Count 455 First Seen 2013-08-12 19:26:53 IST Last Seen 2013-09-05 14:35:47 IST Local ID 4be69344-e3b6-4550-92e1-60f3ba2521b4 Raw Audit Messages type=AVC msg=audit(1378371947.682:48194): avc: denied { block_suspend } for pid=2408 comm="net" capability=36 scontext=system_u:system_r:samba_net_t:s0-s0:c0.c1023 tcontext=system_u:system_r:samba_net_t:s0-s0:c0.c1023 tclass=capability2 type=SYSCALL msg=audit(1378371947.682:48194): arch=x86_64 syscall=epoll_ctl success=yes exit=0 a0=3 a1=2 a2=5 a3=7ffff98cb290 items=0 ppid=2333 pid=2408 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm=net exe=/usr/bin/net subj=system_u:system_r:samba_net_t:s0-s0:c0.c1023 key=(null) Hash: net,samba_net_t,samba_net_t,capability2,block_suspend Expected results: No avc should appear.