Bug 1349791
| Summary: | nsd runs openssl which triggers a SELinux denial | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Milos Malik <mmalik> |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 7.3 | CC: | lvrabec, mgrepl, mmalik, plautrba, pvrabec, ssekidde |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-3.13.1-84.el7 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2016-11-04 02:32:37 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Caught in enforcing mode:
----
time->Fri Jun 24 09:38:14 2016
type=PATH msg=audit(1466753894.914:799): item=1 name="nsd_server.key" objtype=CREATE
type=PATH msg=audit(1466753894.914:799): item=0 name="/etc/nsd" inode=101382461 dev=fd:00 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:nsd_conf_t:s0 objtype=PARENT
type=CWD msg=audit(1466753894.914:799): cwd="/etc/nsd"
type=SYSCALL msg=audit(1466753894.914:799): arch=c000003e syscall=2 success=no exit=-13 a0=7ffc74b06f5a a1=241 a2=1b6 a3=24 items=2 ppid=17010 pid=17011 auid=4294967295 uid=0 gid=984 euid=0 suid=0 fsuid=0 egid=984 sgid=984 fsgid=984 tty=(none) ses=4294967295 comm="openssl" exe="/usr/bin/openssl" subj=system_u:system_r:nsd_t:s0 key=(null)
type=AVC msg=audit(1466753894.914:799): avc: denied { write } for pid=17011 comm="openssl" name="nsd" dev="dm-0" ino=101382461 scontext=system_u:system_r:nsd_t:s0 tcontext=system_u:object_r:nsd_conf_t:s0 tclass=dir
----
Caught in permissive mode:
----
time->Fri Jun 24 09:40:23 2016
type=PATH msg=audit(1466754023.019:814): item=1 name="nsd_server.key" inode=101234802 dev=fd:00 mode=0100640 ouid=0 ogid=984 rdev=00:00 obj=system_u:object_r:nsd_conf_t:s0 objtype=CREATE
type=PATH msg=audit(1466754023.019:814): item=0 name="/etc/nsd" inode=101382461 dev=fd:00 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:nsd_conf_t:s0 objtype=PARENT
type=CWD msg=audit(1466754023.019:814): cwd="/etc/nsd"
type=SYSCALL msg=audit(1466754023.019:814): arch=c000003e syscall=2 success=yes exit=3 a0=7fff78493f5a a1=241 a2=1b6 a3=24 items=2 ppid=2440 pid=2441 auid=4294967295 uid=0 gid=984 euid=0 suid=0 fsuid=0 egid=984 sgid=984 fsgid=984 tty=(none) ses=4294967295 comm="openssl" exe="/usr/bin/openssl" subj=system_u:system_r:nsd_t:s0 key=(null)
type=AVC msg=audit(1466754023.019:814): avc: denied { write } for pid=2441 comm="openssl" path="/etc/nsd/nsd_server.key" dev="dm-0" ino=101234802 scontext=system_u:system_r:nsd_t:s0 tcontext=system_u:object_r:nsd_conf_t:s0 tclass=file
type=AVC msg=audit(1466754023.019:814): avc: denied { create } for pid=2441 comm="openssl" name="nsd_server.key" scontext=system_u:system_r:nsd_t:s0 tcontext=system_u:object_r:nsd_conf_t:s0 tclass=file
type=AVC msg=audit(1466754023.019:814): avc: denied { add_name } for pid=2441 comm="openssl" name="nsd_server.key" scontext=system_u:system_r:nsd_t:s0 tcontext=system_u:object_r:nsd_conf_t:s0 tclass=dir
type=AVC msg=audit(1466754023.019:814): avc: denied { write } for pid=2441 comm="openssl" name="nsd" dev="dm-0" ino=101382461 scontext=system_u:system_r:nsd_t:s0 tcontext=system_u:object_r:nsd_conf_t:s0 tclass=dir
----
time->Fri Jun 24 09:40:24 2016
type=PATH msg=audit(1466754024.320:815): item=0 name="nsd_server.pem" inode=101234805 dev=fd:00 mode=0100640 ouid=0 ogid=984 rdev=00:00 obj=system_u:object_r:nsd_conf_t:s0 objtype=NORMAL
type=CWD msg=audit(1466754024.320:815): cwd="/etc/nsd"
type=SYSCALL msg=audit(1466754024.320:815): arch=c000003e syscall=268 success=yes exit=0 a0=ffffffffffffff9c a1=159e0f0 a2=1a0 a3=7ffc61d47470 items=1 ppid=2440 pid=2449 auid=4294967295 uid=0 gid=984 euid=0 suid=0 fsuid=0 egid=984 sgid=984 fsgid=984 tty=(none) ses=4294967295 comm="chmod" exe="/usr/bin/chmod" subj=system_u:system_r:nsd_t:s0 key=(null)
type=AVC msg=audit(1466754024.320:815): avc: denied { setattr } for pid=2449 comm="chmod" name="nsd_server.pem" dev="dm-0" ino=101234805 scontext=system_u:system_r:nsd_t:s0 tcontext=system_u:object_r:nsd_conf_t:s0 tclass=file
----
time->Fri Jun 24 09:40:24 2016
type=PATH msg=audit(1466754024.321:816): item=1 name="request.cfg" inode=101234804 dev=fd:00 mode=0100640 ouid=0 ogid=984 rdev=00:00 obj=system_u:object_r:nsd_conf_t:s0 objtype=DELETE
type=PATH msg=audit(1466754024.321:816): item=0 name="/etc/nsd" inode=101382461 dev=fd:00 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:nsd_conf_t:s0 objtype=PARENT
type=CWD msg=audit(1466754024.321:816): cwd="/etc/nsd"
type=SYSCALL msg=audit(1466754024.321:816): arch=c000003e syscall=263 success=yes exit=0 a0=ffffffffffffff9c a1=15240c0 a2=0 a3=7fff7fe82f90 items=2 ppid=2440 pid=2450 auid=4294967295 uid=0 gid=984 euid=0 suid=0 fsuid=0 egid=984 sgid=984 fsgid=984 tty=(none) ses=4294967295 comm="rm" exe="/usr/bin/rm" subj=system_u:system_r:nsd_t:s0 key=(null)
type=AVC msg=audit(1466754024.321:816): avc: denied { unlink } for pid=2450 comm="rm" name="request.cfg" dev="dm-0" ino=101234804 scontext=system_u:system_r:nsd_t:s0 tcontext=system_u:object_r:nsd_conf_t:s0 tclass=file
type=AVC msg=audit(1466754024.321:816): avc: denied { remove_name } for pid=2450 comm="rm" name="request.cfg" dev="dm-0" ino=101234804 scontext=system_u:system_r:nsd_t:s0 tcontext=system_u:object_r:nsd_conf_t:s0 tclass=dir
----
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-2283.html |
Description of problem: Version-Release number of selected component (if applicable): nsd-4.1.8-1.el7.x86_64 selinux-policy-3.13.1-81.el7.noarch selinux-policy-mls-3.13.1-81.el7.noarch selinux-policy-targeted-3.13.1-81.el7.noarch openssl-libs-1.0.1e-58.el7.x86_64 openssl-1.0.1e-58.el7.x86_64 How reproducible: * always Steps to Reproduce: 1. get a RHEL-7.3 machine with active targeted policy 2. service nsd start 3. service nsd status 4. search for SELinux denials Actual results (enforcing mode): ---- time->Fri Jun 24 09:31:48 2016 type=SYSCALL msg=audit(1466753508.910:776): arch=c000003e syscall=2 success=no exit=-13 a0=7fff858f7f5a a1=241 a2=1b6 a3=24 items=0 ppid=31467 pid=31468 auid=4294967295 uid=0 gid=984 euid=0 suid=0 fsuid=0 egid=984 sgid=984 fsgid=984 tty=(none) ses=4294967295 comm="openssl" exe="/usr/bin/openssl" subj=system_u:system_r:nsd_t:s0 key=(null) type=AVC msg=audit(1466753508.910:776): avc: denied { write } for pid=31468 comm="openssl" name="nsd" dev="dm-0" ino=101382461 scontext=system_u:system_r:nsd_t:s0 tcontext=system_u:object_r:nsd_conf_t:s0 tclass=dir ---- # ls -ild /etc/nsd/ 101382461 drwxr-xr-x. 4 root root 52 Jun 24 08:26 /etc/nsd/ # Expected results: * no SELinux denials