Bug 1012109
| Summary: | RHEL7 ipa-adtrust-install AVC denials for winbind_t read and write key | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Scott Poore <spoore> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Milos Malik <mmalik> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.0 | CC: | mkosek, mmalik, riehecky, sbose |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-3.12.1-85.el7 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2014-06-13 13:27:35 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Milos, any chance are you getting it for more domains? #============= winbind_t ============== #!!!! This avc is allowed in the current policy allow winbind_t self:key read; Has been fixed. *** Bug 1012051 has been marked as a duplicate of this bug. *** *** Bug 1009177 has been marked as a duplicate of this bug. *** I can confirm I was able to install IPA with enforced SELinux with the new version of selinux-policy. Thanks Mirek! This request was resolved in Red Hat Enterprise Linux 7.0. Contact your manager or support representative in case you have further questions about the request. |
Description of problem: After running ipa-adtrust-install, I see AVC denials for winbind: time->Wed Sep 25 12:38:16 2013 type=SYSCALL msg=audit(1380130696.038:610): arch=c000003e syscall=248 success=yes exit=328706324 a0=7f1f35139b2e a1=7f1f3bed3910 a2=0 a3=0 items=0 ppid=18147 pid=18150 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="winbindd" exe="/usr/sbin/winbindd" subj=system_u:system_r:winbind_t:s0 key=(null) type=AVC msg=audit(1380130696.038:610): avc: denied { write } for pid=18150 comm="winbindd" scontext=system_u:system_r:winbind_t:s0 tcontext=system_u:system_r:winbind_t:s0 tclass=key ---- time->Wed Sep 25 12:38:16 2013 type=SYSCALL msg=audit(1380130696.038:611): arch=c000003e syscall=250 success=yes exit=4 a0=b a1=1397a914 a2=0 a3=0 items=0 ppid=18147 pid=18150 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="winbindd" exe="/usr/sbin/winbindd" subj=system_u:system_r:winbind_t:s0 key=(null) type=AVC msg=audit(1380130696.038:611): avc: denied { read } for pid=18150 comm="winbindd" scontext=system_u:system_r:winbind_t:s0 tcontext=system_u:system_r:winbind_t:s0 tclass=key Version-Release number of selected component (if applicable): selinux-policy-3.12.1-80.el7.noarch How reproducible: unknown at the moment. expected always Steps to Reproduce: 1. Install IPA server 2. ipa-adtrust-install Actual results: AVCs above. Expected results: non AVC denials. Additional info: