| Summary: | enabling MLS policy per RHEL7 SELinux Admin's Guide denies root login via tty, serial, ssh | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Ryan Sawhill <rsawhill> | ||||
| Component: | initscripts | Assignee: | initscripts Maintenance Team <initscripts-maint-list> | ||||
| Status: | CLOSED DUPLICATE | QA Contact: | qe-baseos-daemons | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | 7.2 | CC: | deekej, jjaburek, lvrabec, mgrepl, mmalik, plautrba, pvrabec, ssekidde | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2016-09-08 08:59:52 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Attachments: |
|
||||||
|
Description
Ryan Sawhill
2016-09-07 03:01:52 UTC
One last note: at the suggestion of plautrba in the mailthread, I did `setsebool -P ssh_sysadm_login=on`, prior to capturing the audit.log. While it might have made a difference, it didn't clear everything else up.
Also, to be CRYSTAL CLEAR, my kickstart does NOTHING ELSE with semanage. No user/role nonsense. Nothing has been customized.
[root@selinux72 ~]# semanage user -l
Labeling MLS/ MLS/
SELinux User Prefix MCS Level MCS Range SELinux Roles
guest_u user s0 s0 guest_r
root user s0 s0-s15:c0.c1023 auditadm_r staff_r secadm_r sysadm_r system_r
staff_u user s0 s0-s15:c0.c1023 auditadm_r staff_r secadm_r sysadm_r system_r
sysadm_u user s0 s0-s15:c0.c1023 sysadm_r
system_u user s0 s0-s15:c0.c1023 system_r
user_u user s0 s0 user_r
xguest_u user s0 s0 xguest_r
[root@selinux72 ~]# semanage login -l
Login Name SELinux User MLS/MCS Range Service
__default__ user_u s0 *
root root s0-s15:c0.c1023 *
system_u system_u s0-s15:c0.c1023 *
This is an initscripts bug #1353975 which will be fixed in RHEL-7.3 and we should probably propose it for rhel-7.2.z as well. The problem is that /etc directory is mislabeled after reboot: # ls -ldZ /etc drwxr-xr-x. root root system_u:object_r:etc_t:s15:c0.c1023 /etc The fix is to add -F option to restorecon in /usr/lib/systemd/rhel-import-state: # diff -u /usr/lib/systemd/rhel-import-state.bug /usr/lib/systemd/rhel-import-state --- /usr/lib/systemd/rhel-import-state.bug 2016-09-07 04:44:45.413231227 -0400 +++ /usr/lib/systemd/rhel-import-state 2016-09-07 04:44:51.645274588 -0400 @@ -7,5 +7,5 @@ # run restorecon on the copied files if [ -e /sys/fs/selinux/enforce -a -x /usr/sbin/restorecon ]; then - find . -mindepth 1 -print0 | { cd / && xargs --null restorecon -i; } + find . -mindepth 1 -print0 | { cd / && xargs --null restorecon -i -F; } fi We can close this as a duplicate to that bug #1353975 if you guys like. Up to you. Of course I agree that there should be a 7.2.z initscripts release ASAP, since this is a total blocker, but I don't currently have any non-RH customers asking about MLS in RHEL 7.2. |