| Summary: | babeld runs as init_t | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Milos Malik <mmalik> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Milos Malik <mmalik> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 7.0 | ||
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-3.12.1-101.el7 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2014-06-13 10:57:17 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Bug Depends On: | 877026 | ||
| Bug Blocks: | 848829, 1041394 | ||
babeld should run as zebra_t, which is used by other quagga daemons. If we decide to run babeld as zebra_t then the definition of zebra_port_t must be extended - it must include port 2609. Otherwise following AVC appears:
----
type=SOCKADDR msg=audit(11/14/2013 08:22:47.294:700) : saddr=inet host:127.0.0.1 serv:2609
type=SYSCALL msg=audit(11/14/2013 08:22:47.294:700) : arch=x86_64 syscall=bind success=no exit=-13(Permission denied) a0=0x5 a1=0x7f6b9a9f5d20 a2=0x10 a3=0x7fffee09969c items=0 ppid=1 pid=20264 auid=unset uid=quagga gid=quagga euid=quagga suid=quagga fsuid=quagga egid=quagga sgid=quagga fsgid=quagga tty=(none) ses=unset comm=babeld exe=/usr/sbin/babeld subj=system_u:system_r:zebra_t:s0 key=(null)
type=AVC msg=audit(11/14/2013 08:22:47.294:700) : avc: denied { name_bind } for pid=20264 comm=babeld src=2609 scontext=system_u:system_r:zebra_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
----
commit 0edc4223a97b26e26b91f02d2a39bd2f1a450825
Author: Miroslav Grepl <mgrepl>
Date: Thu Nov 14 11:21:17 2013 +0100
Add support for new zebra services:isisd,babeld. Add systemd support for zebra services.
commit 638a64f9f836d265a487467792a1dd87cf66d7a8
Author: Miroslav Grepl <mgrepl>
Date: Thu Nov 14 11:22:59 2013 +0100
Add support for 2608-2609 tcp/udp ports
This request was resolved in Red Hat Enterprise Linux 7.0. Contact your manager or support representative in case you have further questions about the request. |
Description of problem: Version-Release number of selected component (if applicable): quagga-0.99.22.4-1.el7.x86_64 selinux-policy-targeted-3.12.1-99.el7.noarch selinux-policy-minimum-3.12.1-99.el7.noarch selinux-policy-3.12.1-99.el7.noarch selinux-policy-doc-3.12.1-99.el7.noarch selinux-policy-devel-3.12.1-99.el7.noarch selinux-policy-mls-3.12.1-99.el7.noarch How reproducible: always Steps to Reproduce: # touch /etc/quagga/babeld.conf # service babeld start Redirecting to /bin/systemctl start babeld.service # service babeld status Redirecting to /bin/systemctl status babeld.service babeld.service - Babel routing daemon Loaded: loaded (/usr/lib/systemd/system/babeld.service; disabled) Active: active (running) since Wed 2013-11-13 22:09:38 CET; 2s ago Process: 3724 ExecStart=/usr/sbin/babeld -d $BABELD_OPTS -f /etc/quagga/babeld.conf (code=exited, status=0/SUCCESS) Main PID: 3725 (babeld) CGroup: /system.slice/babeld.service └─3725 /usr/sbin/babeld -d -A 127.0.0.1 -f /etc/quagga/babeld.conf Nov 13 22:09:38 rhel70 systemd[1]: Starting Babel routing daemon... Nov 13 22:09:38 rhel70 systemd[1]: Started Babel routing daemon. # ps -efZ | grep babeld system_u:system_r:init_t:s0 quagga 3725 1 0 22:09 ? 00:00:00 /usr/sbin/babeld -d -A 127.0.0.1 -f /etc/quagga/babeld.conf unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 3738 3451 0 22:09 pts/0 00:00:00 grep --color=auto babeld # Actual results: * babeld runs as init_t Expected results: * babeld runs in its own SELinux domain