Bug 1020391

To expand a little on what is happening here:

    # service openshift-iptables-port-proxy start
    Can't open /dev/fd/63: Permission denied
    Can't open /dev/fd/63: Permission denied

Here's the code that fails:

    #!/bin/bash
    # openshift-iptables-port-proxy
    #
    ### BEGIN INIT INFO
    # Short-Description:  Script to apply the openshift port proxy iptables rules.
    # Description: Script to apply the openshift port proxy iptables rules.
    ### END INIT INFO
    
    case "$1" in
        start)
            if [ -f /etc/openshift/iptables.filter.rules ]; then
               iptables-restore -n <(echo "*filter"; cat /etc/openshift/iptables.filter.rules; echo "COMMIT")

The iptables-restore executable has a context transition:

    # ls -lZlZH /sbin/iptables-restore
    -rwxr-xr-x. root root system_u:object_r:iptables_exec_t:s0 /sbin/iptables-restore

However, Bash creates the fifo from the command substitution in the context of the initscript (this can be verified using strace -f).  The <() command substitution expands to /dev/fd/63, which is passed to the iptables-restore process in its arguments list, iptables-restore tries to open /dev/fd/63, and it fails because iptables-restore has type iptables_t in its context whereas the pipe has type initrc_t  in its context:


    # ausearch -m avc -ts recent -i
    ----
    type=SYSCALL msg=audit(10/17/2013 16:15:29.601:131102) : arch=x86_64 syscall=open success=no exit=-13(Permission denied) a0=7fff73720f66 a1=80000 a2=1b6 a3=0 items=0 ppid=25304 pid=25306 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=2 comm=iptables-restor exe=/sbin/iptables-multi-1.4.7 subj=unconfined_u:system_r:iptables_t:s0 key=(null)
    type=AVC msg=audit(10/17/2013 16:15:29.601:131102) : avc:  denied  { open } for  pid=25306 comm=iptables-restor name= dev=pipefs ino=285957 scontext=unconfined_u:system_r:iptables_t:s0 tcontext=unconfined_u:system_r:initrc_t:s0 tclass=fifo_file
    ----
    type=SYSCALL msg=audit(10/17/2013 16:15:29.620:131103) : arch=x86_64 syscall=open success=no exit=-13(Permission denied) a0=7fff05cd1f66 a1=80000 a2=1b6 a3=0 items=0 ppid=25304 pid=25309 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=2 comm=iptables-restor exe=/sbin/iptables-multi-1.4.7 subj=unconfined_u:system_r:iptables_t:s0 key=(null)
    type=AVC msg=audit(10/17/2013 16:15:29.620:131103) : avc:  denied  { open } for  pid=25309 comm=iptables-restor name= dev=pipefs ino=285968 scontext=unconfined_u:system_r:iptables_t:s0 tcontext=unconfined_u:system_r:initrc_t:s0 tclass=fifo_file

Pull request:   https://github.com/openshift/origin-server/pull/3922

Commit pushed to master at https://github.com/openshift/origin-server

https://github.com/openshift/origin-server/commit/19156f6032dad670ab43550eae0d5601c8f50768
oo-admin-ctl-iptables-port-proxy: SELinux fix

Give input to iptables-restore on standard input instead of using command
substitution.

Bash was expanding the <(...) command-substitution to a fifo, which
oo-admin-ctl-iptables-port-proxy was then passing to the iptables-restore
command as a command-line argument.  If oo-admin-ctl-iptables-port-proxy
was being run from the /etc/init.d/openshift-iptables-port-proxy
initscript, then Bash would have an SELinux context with type initrc_t, and
it thus would create the fifo also with type initrc_t.  However,
iptables-restore transitions SELinux contexts so that it is running with
the iptables_t type.  The iptables-restore command would thus fail when it
tried to open the fifo because SELinux policy blocks processes with type
iptables_t from reading fifos with type initrc_t.

(Interestingly, the manpage for iptables-restore does not indicate that
iptables-restore is even supposed to take a filename as an argument.)

This commit fixes bug 1020391.

Verified this bug with rubygem-openshift-origin-node-1.16.2-1.git.31.04b2e87.el6op.noarch in 2.0/2013-10-23.2 puddle, and PASS.


# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain rhc-app-comm (0 references)
target     prot opt source               destination         
[root@node1 ~]# /etc/init.d/openshift-iptables-port-proxy start
[root@node1 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain rhc-app-comm (0 references)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             127.1.245.2         ctstate NEW tcp dpt:webcache /* 38042 */ 
ACCEPT     tcp  --  anywhere             127.1.245.2         tcp dpt:webcache /* 38042 */ 
ACCEPT     tcp  --  anywhere             127.1.245.1         ctstate NEW tcp dpt:webcache /* 38041 */ 
ACCEPT     tcp  --  anywhere             127.1.245.1         tcp dpt:webcache /* 38041 */ 
ACCEPT     tcp  --  anywhere             127.1.244.129       ctstate NEW tcp dpt:mysql /* 38036 */ 
ACCEPT     tcp  --  anywhere             127.1.244.129       tcp dpt:mysql /* 38036 */ 
ACCEPT     tcp  --  anywhere             127.1.244.2         ctstate NEW tcp dpt:webcache /* 38032 */ 
ACCEPT     tcp  --  anywhere             127.1.244.2         tcp dpt:webcache /* 38032 */ 
ACCEPT     tcp  --  anywhere             127.1.244.1         ctstate NEW tcp dpt:webcache /* 38031 */ 
ACCEPT     tcp  --  anywhere             127.1.244.1         tcp dpt:webcache /* 38031 */