Bug 1154158

Cross-filed cases #01265630 (ourself), #01265635 (customer1), #01265639 
(customer2) on the Red Hat customer portal.

If you allow above AVC denied you will simply receive:

type=AVC msg=audit(1413565451.766:10787): avc:  denied  { execute_no_trans } for  pid=5811 comm="bacula-dir" path="/data/root/bin/bacula-mount.sh" dev=drbd0 ino=2228231 scontext=unconfined_u:system_r:bacula_t:s0 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file
type=SYSCALL msg=audit(1413565451.766:10787): arch=x86_64 syscall=execve success=no exit=EACCES a0=7fc8c4002b80 a1=7fc8ce403660 a2=7fff84d62428 a3=3236818240 items=0 ppid=2846 pid=5811 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=522 comm=bacula-dir exe=/usr/sbin/bacula-dir.sqlite subj=unconfined_u:system_r:bacula_t:s0 key=(null)

Robert, 

What does `ls -lZ /data/root/bin/bacula-mount.sh` show?

(In reply to Simon Sekidde from comment #4)
> Robert, 
> 
> What does `ls -lZ /data/root/bin/bacula-mount.sh` show?

Sorry that should have been

  `restorecon -Rv /data/root/bin/bacula-mount.sh`

Nothing, because /data/root should have the same labels like /root (in our
case at least, it is on DRBD in this case but we saw the same without DRBD).

We will need to add a new type

bacula_unconfined_script_t

for these scripts.

Any Idea when this is going to happen? We're really waiting for that, because right now we cannot upgrade to 6.6 due to this issue.

We just hit this same problem (well realized that we hit it back when we patched, bad times).

WORKAROUND:

* Proper Workaround:  Create a local selinux policy using audit2allow -M (using the AVC deny from above.
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security-Enhanced_Linux/sect-Security-Enhanced_Linux-Fixing_Problems-Allowing_Access_audit2allow.html


In my case, since I actually put the "script" into bacula's home directory (/var/spool/bacula), the "type" is bacula_spool_t, so I just need the following

```
#============= bacula_t ==============
allow bacula_t bacula_spool_t:file execute;
```



* Improper (easy) workaround: `semodule -d bacula` (which disables the bacula selinux module, but otherwise leaves selinux enabled on the server.

OK, I actually ended up with a bit more "advanced" policy file after my first and secon attempt :) ...


[root@deathstar ~]# cat mybacula.te 

module mybacula 1.0;

require {
	type ssh_exec_t;
	type bacula_exec_t;
	type port_t;
	type bacula_spool_t;
	type automount_var_run_t;
	type bacula_t;
	class tcp_socket name_bind;
	class fifo_file getattr;
	class file { execute execute_no_trans };
}

#============= bacula_t ==============
allow bacula_t automount_var_run_t:fifo_file getattr;
allow bacula_t bacula_exec_t:file execute_no_trans;
allow bacula_t bacula_spool_t:file execute;

#!!!! This avc can be allowed using the boolean 'allow_ypbind'
allow bacula_t port_t:tcp_socket name_bind;
allow bacula_t ssh_exec_t:file { execute execute_no_trans };


-----------


Now, our "script" executes "ssh" to create a port forward (tunnel) to allow bacula to work over the Internet, so that changes the policy above slightly (adds the ssh_exec_t part). What I mean to say is that once you have "allowed" your script to run, you will need to "allow" anything else it does too.

Here are the "steps" involved (at your own risk of course):

* setenforce 0
* tail -fn 0 /var/log/audit/audit.log | grep bacula > backup-audit.log
* (run a backup that has a pre-script)
* cat backup-audit.log | audit2allow -M mybacula
* REVIEW mybacula.te
* INSTALL: semodule -i mybacula.pp
* TEST: run another backup, ensure you get no more AVC DENIED messages in audit.log
* setenforce 1

commit 5fef7cd165f44d03892ec7cb21550a724f4052fb
Author: Miroslav Grepl <mgrepl>
Date:   Mon Mar 2 16:00:26 2015 +0100

    Add bacula fixes related to unconfined scripts based on ssekidde patch.

When is this going to reach the regular repositories?

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-1375.html

(In reply to errata-xmlrpc from comment #17)
> Since the problem described in this bug report should be
> resolved in a recent advisory, it has been closed with a
> resolution of ERRATA.
> 
> For information on the advisory, and where to find the updated
> files, follow the link below.
> 
> If the solution does not work for you, open a new bug report.
> 
> https://rhn.redhat.com/errata/RHBA-2015-1375.html

Will there be an selinux update containing the bugfixes with RHEL 7? We discovered same problems appearing in RHEL 7 as well. 

Even bacula_t is not able to write into tmp_t when it is a fifo file to write (makefifo). Reading fifos (getattr) is not possible, too. Refer to 1177051. I am curious why selinux updates containg major bugfixes for bacula are not released for rhel7 as well? 

Thx for help

(In reply to Alex Kruppa from comment #18)
> (In reply to errata-xmlrpc from comment #17)
> > Since the problem described in this bug report should be
> > resolved in a recent advisory, it has been closed with a
> > resolution of ERRATA.
> > 
> > For information on the advisory, and where to find the updated
> > files, follow the link below.
> > 
> > If the solution does not work for you, open a new bug report.
> > 
> > https://rhn.redhat.com/errata/RHBA-2015-1375.html
> 
> Will there be an selinux update containing the bugfixes with RHEL 7? We
> discovered same problems appearing in RHEL 7 as well. 
> 
> Even bacula_t is not able to write into tmp_t when it is a fifo file to
> write (makefifo). Reading fifos (getattr) is not possible, too. Refer to
> 1177051. I am curious why selinux updates containg major bugfixes for bacula
> are not released for rhel7 as well? 
> 
> Thx for help

Yes, it should be a part of RHEL-7.2.

First of all thank you for handling this issue.

However, I have no idea what to do to make this work again. Is there a selinux-type that the script needs?
*Any* kind of documentation would be really nice.

Thank you!

I usually use for a bacula script "/root/bin/bacula-mount.sh" this:

  semanage fcontext -a -f 'all files' \
    -t bacula_unconfined_script_exec_t '/root/bin/bacula-mount.sh'
  restorecon -v /root/bin/bacula-mount.sh