Bug 1030075

Summary: isisd runs as init_t
Product: Red Hat Enterprise Linux 7 Reporter: Milos Malik <mmalik>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED CURRENTRELEASE QA Contact: Milos Malik <mmalik>
Severity: medium Docs Contact:
Priority: medium    
Version: 7.0   
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: selinux-policy-3.12.1-101.el7 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-06-13 12:54:28 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 877026    
Bug Blocks: 848829, 1041388    

Description Milos Malik 2013-11-13 21:23:09 UTC
Description of problem:


Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 1 Milos Malik 2013-11-13 21:27:08 UTC
# touch /etc/quagga/isisd.conf
# service isisd start
Redirecting to /bin/systemctl start  isisd.service
# service isisd status
Redirecting to /bin/systemctl status  isisd.service
isisd.service - IS-IS routing daemon
   Loaded: loaded (/usr/lib/systemd/system/isisd.service; disabled)
   Active: active (running) since Wed 2013-11-13 22:24:13 CET; 2s ago
  Process: 4100 ExecStart=/usr/sbin/isisd -d $ISISD_OPTS -f /etc/quagga/isisd.conf (code=exited, status=0/SUCCESS)
 Main PID: 4101 (isisd)
   CGroup: /system.slice/isisd.service
           └─4101 /usr/sbin/isisd -d -A ::1 -f /etc/quagga/isisd.conf

Nov 13 22:24:13 rhel70 systemd[1]: Started IS-IS routing daemon.
# ps -efZ | grep isisd
system_u:system_r:init_t:s0     quagga    4101     1  0 22:24 ?        00:00:00 /usr/sbin/isisd -d -A ::1 -f /etc/quagga/isisd.conf
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 4114 3451  0 22:24 pts/0 00:00:00 grep --color=auto isisd
#

isisd should run as zebra_t, which is used by other quagga daemons.

# rpm -qa | grep -e quagga -e selinux-policy | sort
quagga-0.99.22.4-1.el7.x86_64
quagga-contrib-0.99.22.4-1.el7.x86_64
quagga-devel-0.99.22.4-1.el7.x86_64
selinux-policy-3.12.1-99.el7.noarch
selinux-policy-devel-3.12.1-99.el7.noarch
selinux-policy-doc-3.12.1-99.el7.noarch
selinux-policy-minimum-3.12.1-99.el7.noarch
selinux-policy-mls-3.12.1-99.el7.noarch
selinux-policy-targeted-3.12.1-99.el7.noarch
#

Comment 2 Milos Malik 2013-11-14 07:28:49 UTC
If we decide to run isisd as zebra_t then the definition of zebra_port_t must be extended - it must include port 2608. Otherwise following AVC appears:
----
type=SOCKADDR msg=audit(11/14/2013 08:27:31.147:723) : saddr=inet6 host:::1 serv:2608 
type=SYSCALL msg=audit(11/14/2013 08:27:31.147:723) : arch=x86_64 syscall=bind success=no exit=-13(Permission denied) a0=0x5 a1=0x7fb9bb871910 a2=0x1c a3=0x7fff130ab3bc items=0 ppid=1 pid=20798 auid=unset uid=quagga gid=quagga euid=quagga suid=quagga fsuid=quagga egid=quagga sgid=quagga fsgid=quagga tty=(none) ses=unset comm=isisd exe=/usr/sbin/isisd subj=system_u:system_r:zebra_t:s0 key=(null) 
type=AVC msg=audit(11/14/2013 08:27:31.147:723) : avc:  denied  { name_bind } for  pid=20798 comm=isisd src=2608 scontext=system_u:system_r:zebra_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket 
----

Comment 3 Miroslav Grepl 2013-11-14 10:26:51 UTC
commit 0edc4223a97b26e26b91f02d2a39bd2f1a450825
Author: Miroslav Grepl <mgrepl>
Date:   Thu Nov 14 11:21:17 2013 +0100

    Add support for new zebra services:isisd,babeld. Add systemd support for zebra services.

commit 638a64f9f836d265a487467792a1dd87cf66d7a8
Author: Miroslav Grepl <mgrepl>
Date:   Thu Nov 14 11:22:59 2013 +0100

    Add support for 2608-2609 tcp/udp ports

Comment 5 Ludek Smid 2014-06-13 12:54:28 UTC
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.