Bug 1303709
| Summary: | coolkey modules wants to access files in /var/cache/coolkey/ and p11_child is currently not allowed to access those files | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Roshni <rpattath> | |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> | |
| Status: | CLOSED ERRATA | QA Contact: | Eva Mrakova <emrakova> | |
| Severity: | high | Docs Contact: | ||
| Priority: | high | |||
| Version: | 7.2 | CC: | aakkiang, emrakova, lvrabec, mgrepl, mmalik, plautrba, pvrabec, rpattath, ssekidde | |
| Target Milestone: | rc | |||
| Target Release: | --- | |||
| Hardware: | All | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | selinux-policy-3.13.1-60.el7_2.3 | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1330983 (view as bug list) | Environment: | ||
| Last Closed: | 2016-11-04 02:41:38 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | 1303214 | |||
| Bug Blocks: | 1330983 | |||
|
Description
Roshni
2016-02-01 17:42:47 UTC
Please attach AVCs that you see when reproducing this scenario. I have not yet reproduced this issue on RHEL 7 but once https://bugzilla.redhat.com/show_bug.cgi?id=1303214 is fixed we will be running into this issue. The same happened on RHEL 6.8, the AVC's on RHEl 6.8 can be found here https://bugzilla.redhat.com/show_bug.cgi?id=1299066#c7 Some of the AVCs listed in BZ#1299066 contain "success=no", which means they appeared in enforcing mode. The selinux-policy developers need to see all AVCs triggered by the scenario to fix it properly in policy. Could you switch the sssd_t type to permissive and repeat your scenario? # setenforce 1 # semanage permissive -a sssd_t (repeat your scenario) # semanage permissive -d sssd_t AVC messages on RHEL 6.8 based on the instructions in comment 4: [root@dhcp123-129 ~]# ausearch -ts recent -m AVC time->Mon Feb 8 17:35:12 2016 type=SYSCALL msg=audit(1454970912.959:15): arch=40000003 syscall=5 success=yes exit=12 a0=8ded6d0 a1=20002 a2=180 a3=8ded6b8 items=0 ppid=1847 pid=3538 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="p11_child" exe="/usr/libexec/sssd/p11_child" subj=system_u:system_r:sssd_t:s0 key=(null) type=AVC msg=audit(1454970912.959:15): avc: denied { read write } for pid=3538 comm="p11_child" name=636F6F6C6B6579706B3131734F6D6E694B657920436172644D616E20333132312030302030302D30 dev=dm-0 ino=654671 scontext=system_u:system_r:sssd_t:s0 tcontext=unconfined_u:object_r:auth_cache_t:s0 tclass=file Roshini, This is rhel7 bug and AVC si fixed in: [root@hp-dl380pgen8-02-vm-5 ~]# rpm -q selinux-policy selinux-policy-3.13.1-60.el7_2.3.noarch Can we close this for RHEL7? Lukas, Can you change this bug to ON_QA status? I will verify it and close. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-2283.html |