Bug 1153083

Summary: krb5_home_t context also for .k5users
Product: [Fedora] Fedora Reporter: František Dvořák <valtri>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 21CC: dominick.grift, dwalsh, lvrabec, mgrepl, plautrba
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: selinux-policy-3.13.1-90.fc21 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-10-28 21:49:49 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description František Dvořák 2014-10-15 15:16:49 UTC
Description of problem:

There should be set context (krb5_home_t?) also for .k5users file in user home directories, similary to .k5login.


Version-Release number of selected component (if applicable):

selinux-policy-targeted-3.13.1-85.fc21.noarch


How reproducible:

Always.


Steps to Reproduce:

0. you need machine with openssh-server and working Kerberos:
  - machine has keytab
  - machine has proper krb5.conf

2. on server: mv ~/.k5login /tmp; echo "YOU_PRINCIPAL@YOUR_REALM" >> ~/.k5users

3. on client: kinit YOU_PRINCIPAL@YOUR_REALM

4. on client: ssh root@SERVER


Actual results:

type=AVC msg=audit(1413385025.383:250): avc:  denied  { read } for  pid=1015 comm="sshd" name=".k5users" dev="sda1" ino=38138 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system
_u:object_r:admin_home_t:s0 tclass=file permissive=1
type=AVC msg=audit(1413385025.384:251): avc:  denied  { open } for  pid=1015 comm="sshd" path="/root/.k5users" dev="sda1" ino=38138 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=
system_u:object_r:admin_home_t:s0 tclass=file permissive=1
type=AVC msg=audit(1413385025.384:252): avc:  denied  { getattr } for  pid=1015 comm="sshd" path="/root/.k5users" dev="sda1" ino=38138 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tconte
xt=system_u:object_r:admin_home_t:s0 tclass=file permissive=1


Expected results:

No AVC denied messages, happy open() calls in strace, non-interactive logging in.


Additional info:

Non-interactive logging passed OK, when switching SELinux to permissive mode.

Comment 1 Miroslav Grepl 2014-10-16 14:58:21 UTC
commit 7ad8fc6cde4677112672d71a4dd513c6c6b47ce7
Author: Miroslav Grepl <mgrepl>
Date:   Thu Oct 16 16:57:55 2014 +0200

    Add support for ~/.k5sers.

Comment 2 Fedora Update System 2014-10-22 07:50:12 UTC
selinux-policy-3.13.1-88.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/selinux-policy-3.13.1-88.fc21

Comment 3 Fedora Update System 2014-10-22 19:13:14 UTC
Package selinux-policy-3.13.1-88.fc21:
* should fix your issue,
* was pushed to the Fedora 21 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.13.1-88.fc21'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-13454/selinux-policy-3.13.1-88.fc21
then log in and leave karma (feedback).

Comment 4 Fedora Update System 2014-10-23 16:20:53 UTC
Package selinux-policy-3.13.1-90.fc21:
* should fix your issue,
* was pushed to the Fedora 21 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.13.1-90.fc21'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-13454/selinux-policy-3.13.1-90.fc21
then log in and leave karma (feedback).

Comment 5 Fedora Update System 2014-10-28 21:49:49 UTC
selinux-policy-3.13.1-90.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.