Bug 1154742

Here is the only AVC that appeared in permissive mode:
----
type=PATH msg=audit(10/20/2014 19:13:33.150:833) : item=1 name=(null) inode=33658149 dev=fd:02 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL 
type=PATH msg=audit(10/20/2014 19:13:33.150:833) : item=0 name=/usr/sbin/sserver inode=35800899 dev=fd:02 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL 
type=CWD msg=audit(10/20/2014 19:13:33.150:833) :  cwd=/ 
type=EXECVE msg=audit(10/20/2014 19:13:33.150:833) : argc=1 a0=sserver 
type=SYSCALL msg=audit(10/20/2014 19:13:33.150:833) : arch=x86_64 syscall=execve success=yes exit=0 a0=0x7f459ade8890 a1=0x7f459addd8d0 a2=0x7f459ade3230 a3=0x353a383965663a66 items=2 ppid=9066 pid=9214 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=sserver exe=/usr/sbin/sserver subj=system_u:system_r:inetd_child_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(10/20/2014 19:13:33.150:833) : avc:  denied  { entrypoint } for  pid=9214 comm=xinetd path=/usr/sbin/sserver dev="vda2" ino=35800899 scontext=system_u:system_r:inetd_child_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=file 
----

# rpm -qf /usr/sbin/sserver 
krb5-server-1.12.2-8.el7.x86_64
# matchpathcon /usr/sbin/sserver 
/usr/sbin/sserver	system_u:object_r:bin_t:s0
#

Yes, this is caused by changes related to unconfined_services_t.

And now we have

corecmd_bin_domtrans(inetd_t, inetd_child_t)

optional_policy(`
    unconfined_domain(inetd_child_t)
').

Either we confine sserver 

or we add general rule

corecmd_bin_entry_type(inetd_child_t)

for these cases.

QA guys,
could you try to test it with this rule to see how it works.

Relabelling the sserver to inetd_child_exec_t helped; i.e. after 

# chcon -v --type inetd_child_exec_t /usr/sbin/sserver 

sserver was successfully started by xinetd and no AVC denials appeared.

Should I do a different test, please let me know.

I meant a local policy with


corecmd_bin_entry_type(inetd_child_t)


# chcon -v --type inetd_child_exec_t /usr/sbin/sserver 

is not a good label for sserver. It should be more something related to kerberos.

(In reply to Miroslav Grepl from comment #7)
> I meant a local policy with
> 
> 
> corecmd_bin_entry_type(inetd_child_t)
> 
Could you please specify exactly what policy should tested? Building a custom policy module just with the line above is failing. So it probably need something else, but I do not know what exactly.

$ cat mypol.te
policy_module(mypol, 1.0)

require{
 type inetd_child_t;
}

corecmd_bin_entry_type(inetd_child_t)



and 

# make -f /usr/share/selinux/devel/Makefile mypol.pp
# semodule -i mypol.pp

This policy module helped. The daemon sserver started and no AVC denials appeared.

commit 0ae616507aa951f641b1362a91aee7df2e1f0cb9
Author: Miroslav Grepl <mgrepl>
Date:   Wed Nov 5 10:55:01 2014 +0100

    Allow inetd service without own policy to run in inetd_child_t which is unconfined domain.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-0458.html