Bug 1301854
Summary: | dhcpd selinux policy doesn't handle on-commit scripts | |||
---|---|---|---|---|
Product: | Red Hat Enterprise Linux 7 | Reporter: | Sten Spans <sspans> | |
Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> | |
Status: | CLOSED ERRATA | QA Contact: | Eva Mrakova <emrakova> | |
Severity: | medium | Docs Contact: | ||
Priority: | unspecified | |||
Version: | 7.2 | CC: | emrakova, jpopelka, lvrabec, mgrepl, mmalik, plautrba, psimerda, pvrabec, ssekidde, sspans, thozza | |
Target Milestone: | rc | |||
Target Release: | --- | |||
Hardware: | All | |||
OS: | Linux | |||
Whiteboard: | ||||
Fixed In Version: | selinux-policy-3.13.1-82.el7 | Doc Type: | Bug Fix | |
Doc Text: | Story Points: | --- | ||
Clone Of: | ||||
: | 1330976 1349044 (view as bug list) | Environment: | ||
Last Closed: | 2016-11-04 02:41:05 UTC | Type: | Bug | |
Regression: | --- | Mount Type: | --- | |
Documentation: | --- | CRM: | ||
Verified Versions: | Category: | --- | ||
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
Cloudforms Team: | --- | Target Upstream Version: | ||
Embargoed: | ||||
Bug Depends On: | ||||
Bug Blocks: | 1330976, 1349044 |
Description
Sten Spans
2016-01-26 07:42:22 UTC
What is the usual location for such scripts? There doesn't seem to be a default location, a subdir below /etc/dhcp would make sense I guess. I've opted for '/etc/dhcp/scripts' but am happy to change to a better option. Let's ask Jiri. +1 to something below /etc/dhcp/ We already have /etc/dhcp/dhclient.d/ for dhclient-related scripts, so my first thought was /etc/dhcp/dhcpd.d/ But then I realized that the execute() statement can be used not only with dhcpd but with dhclient as well, because the RELNOTES says: "This permits dhcpd or dhclient to execute a named external program with command line arguments specified from other configuration language." Also as dhclient-script(8) says the additional dhclient-{enter/exit/up/down}-hooks scripts that further extend dhclient-script's functionality should be placed into /etc/dhcp/ So maybe just the /etc/dhcp/ without any additional subdirectory ? Scripts should be labeled as bin_t located in /etc/dhcp. Sten, did you get AVCs for your case? The AVC I got is shown in my initial report:
type=AVC msg=audit(1453792866.181:11697): avc: denied { execute } for pid=3174 comm="dhcpd" name="myscript" dev="dm-0" ino=147660 scontext=system_u:system_r:dhcpd_t:s0 tcontext=unconfined_u:object_r:dhcp_etc_t:s0 tclass=file
However this does show that the file is labelled as dhcp_etc_t, which is the default for /etc/dhcp. When I change the context to bin_t the on-commit script indeed works.
> chcon -t bin_t /etc/dhcp/myscript.py
> ls -aZ /etc/dhcp/myscript.py
-rwxr-xr-x. root root unconfined_u:object_r:bin_t:s0 /etc/dhcp/myscript.py
Is this recommended type for dhcp script documented somewhere? Should it be?
OK, O overlooked. The problem is /etc/dhcp is a directory for config files. It would be great to have subdir for these scripts. We can define a generic labeling for /etc/dhcp to have bin_t as a default label and have more specific labels for config files. But I don't see it as a good solution. Then either '/etc/dhcp/scripts' (per comment #3) or '/etc/dhcp/on-commit-scripts'. Sten, which one do you like more ? /etc/dhcp/scripts would make the most sense. Running scripts is possible for expiry and release as well, so hard-coding "commit" in the directory name doesn't really seem logical. https://deepthought.isc.org/article/AA-01094/0/Adding-support-for-on-commit-on-expire-and-on-release-statements-in-DHCPv6.html (In reply to Sten Spans from comment #10) > /etc/dhcp/scripts would make the most sense. > > Running scripts is possible for expiry and release as well, so hard-coding > "commit" in the directory name doesn't really seem logical. > > https://deepthought.isc.org/article/AA-01094/0/Adding-support-for-on-commit- > on-expire-and-on-release-statements-in-DHCPv6.html Ok do you need a bug? I'll add bin_t label for /etc/dhcp/scripts. Jiri, what is state of this issue from your side? Thank you. Pavel Simerda is the new owner of DHCP component. (In reply to Lukas Vrabec from comment #12) > I'll add bin_t label for /etc/dhcp/scripts. OK > Jiri, what is state of this issue from your side? I haven't changed anything in dhcp. Pavel, I think we should add the /etc/dhcp/scripts/ with just README saying that it's a directory for on-commit scripts. I added label for it. From selinux-policy side is issue fixed. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-2283.html |