Bug 1304723
| Summary: | Allow {ip|ip6|eb}tables-restore to use read and getattr on files in (/var)/run/firewalld | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Thomas Woerner <twoerner> | |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> | |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> | |
| Severity: | medium | Docs Contact: | ||
| Priority: | medium | |||
| Version: | 7.3 | CC: | bgalvani, dominick.grift, dwalsh, extras-qa, lvrabec, mcepl, mgrepl, mmalik, plautrba, pvrabec, ssekidde, szidek, todoleza | |
| Target Milestone: | rc | |||
| Target Release: | --- | |||
| Hardware: | All | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | selinux-policy-3.13.1-89.el7 | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | 1291243 | |||
| : | 1332123 (view as bug list) | Environment: | ||
| Last Closed: | 2016-11-04 02:42:01 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | 1291243 | |||
| Bug Blocks: | 1302802, 1332123 | |||
|
Description
Thomas Woerner
2016-02-04 13:13:47 UTC
This will be needed for the firewalld rebase to 0.4.x in RHEL-7.3. I am getting the following AVCs on RHEL-7.2 with firewalld-0.4.1.2:
#============= firewalld_t ==============
allow firewalld_t var_log_t:file open;
allow firewalld_t var_run_t:dir create;
#============= iptables_t ==============
allow iptables_t firewalld_var_run_t:file { read getattr };
Test packages are available here:
http://people.redhat.com/twoerner/firewalld/0.4.1.2-1.el7/
For the fix for #1066037, there is an additional change required: allow firewalld_t net_conf_t:dir write; Firewalld is trying to change the ZONE setting in the ifcfg file that is using the interface, for which the zone binding has been requested. Only if there is an ifcfg file using this interface. There is a new te file for RHEL-7: http://people.redhat.com/twoerner/firewalld/0.4.2-1.el7/firewalld-0.4.te *** Bug 1342587 has been marked as a duplicate of this bug. *** It seems that there is an additional rule needed for this:
type=AVC msg=audit(1465486509.538:13194): avc: denied { add_name } for pid=6273 comm="firewalld" name="ifcfg-enp0s25.NdcLYC" scontext=system_u:system_r:firewalld_t:s0 tcontext=system_u:object_r:net_conf_t:s0 tclass=dir
type=SYSCALL msg=audit(1465486509.538:13194): arch=x86_64 syscall=open success=no exit=EACCES a0=2bb1840 a1=200c2 a2=180 a3=4 items=0 ppid=1 pid=6273 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=firewalld exe=/usr/bin/python2.7 subj=system_u:system_r:firewalld_t:s0 key=(null)
Hash: firewalld,firewalld_t,net_conf_t,dir,add_name
What is the meaning of add_name here? It seems only to happen while restarting the firewalld service - but not if the code is used while firewalld is running already. After a relabel of /etc it seems to be gone. (In reply to Thomas Woerner from comment #8) > What is the meaning of add_name here? > > It seems only to happen while restarting the firewalld service - but not if > the code is used while firewalld is running already. > > After a relabel of /etc it seems to be gone. No, still happening... This means that firewalld is adding content to a directory labeled net_conf_t firewalld is creating a temporary file that will be renamed when complete. Is there a better way in the case of modifying ifcfg-X files in /etc/sysconfig/network-scripts/ ? That is fine, and SELinux policy should be adjusted. Only problem I see would be potentially from a security point of view, in that all other domains that can read net_conf_t could read the file. But if the file has nothing that needs to be protected from other domains, it seems like a good place to store it. firewalld is not adding secrets to this file. Only the ZONE settings is adjusted to make sure that they match in firewalld and in the ifcfg file. It seems that this is missing:
allow firewalld_t net_conf_t:file { write rename create unlink setattr };
*** Bug 1358217 has been marked as a duplicate of this bug. *** Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-2283.html |