Bug 1385641
| Summary: | sssd process are running in docker_t context instead of spc_t context | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Niranjan Mallapadi Raghavender <mniranja> |
| Component: | docker | Assignee: | Lokesh Mandvekar <lsm5> |
| Status: | CLOSED ERRATA | QA Contact: | atomic-bugs <atomic-bugs> |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.3 | CC: | amurdaca, cevich, ddarrah, dwalsh, imcleod, jhonce, jhrozek, jpazdziora, lslebodn, lsm5, mjenner, ndehadra |
| Target Milestone: | rc | Keywords: | Extras, Regression |
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | docker-1.10.3-57.el7 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2016-11-04 09:09:33 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
The retrieving data from sssd as root works
-bash-4.2# systemctl start sssd
-bash-4.2# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
497c49b57eb8 rhel7/sssd "/bin/run.sh" 3 minutes ago Up 8 seconds sssd
-bash-4.2# id Administrator
uid=1827400500(administrator) gid=1827400513(domain users) groups=1827400513(domain users),1827400518(schema admins),1827400512(domain admins),1827400520(group policy creator owners),1827400519(enterprise admins),1827400572(denied rodc password replication group)
But other services (sshd) cannot due to AVCs
-bash-4.2# ssh -l Administrator localhost
Administrator@localhost's password:
Permission denied, please try again.
Administrator@localhost's password:
-bash-4.2# dmesg | tail
[ 4135.804800] type=1400 audit(1476781785.109:11): avc: denied { connectto } for pid=18731 comm="sshd" path="/var/lib/sss/pipes/nss" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:docker_t:s0 tclass=unix_stream_socket
[ 4135.807039] type=1400 audit(1476781785.111:12): avc: denied { connectto } for pid=18731 comm="sshd" path="/var/lib/sss/pipes/nss" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:docker_t:s0 tclass=unix_stream_socket
[ 4199.591077] XFS (dm-4): Unmounting Filesystem
[ 4273.082839] XFS (dm-4): Mounting V4 Filesystem
[ 4273.090218] XFS (dm-4): Ending clean mount
[ 4324.828861] type=1400 audit(1476781974.133:14): avc: denied { connectto } for pid=18934 comm="sshd" path="/var/lib/sss/pipes/nss" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:docker_t:s0 tclass=unix_stream_socket
[ 4329.784784] type=1400 audit(1476781979.089:15): avc: denied { connectto } for pid=18934 comm="sshd" path="/var/lib/sss/pipes/nss" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:docker_t:s0 tclass=unix_stream_socket
[ 4329.792861] type=1400 audit(1476781979.097:16): avc: denied { connectto } for pid=18934 comm="sshd" path="/var/lib/sss/pipes/nss" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:docker_t:s0 tclass=unix_stream_socket
[ 4329.797139] type=1400 audit(1476781979.102:17): avc: denied { connectto } for pid=18934 comm="sshd" path="/var/lib/sss/pipes/nss" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:docker_t:s0 tclass=unix_stream_socket
Moving to rhel-server-docker because privileged container based on base image does not run as spc_t.
But it's possible that the bug is not in base image but in selinux-policy or docker-selinux. Feel free to reassign
-bash-4.2# atomic host status
State: idle
Deployments:
● rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard
Version: 7.3 (2016-10-06 18:32:58)
Commit: bd5ac48f6195637c0230d9b0ab0a2e5fb843764f85bc64757106238bdf31e757
OSName: rhel-atomic-host
-bash-4.2# rpm -qa | grep selinux
libselinux-utils-2.5-6.el7.x86_64
selinux-policy-targeted-3.13.1-102.el7.noarch
libselinux-2.5-6.el7.x86_64
docker-selinux-1.10.3-55.el7.x86_64
selinux-policy-3.13.1-102.el7.noarch
libselinux-python-2.5-6.el7.x86_64
BTW authentication works well in permissive mode. -bash-4.2# setenforce 1 -bash-4.2# ssh -l Administrator localhost Administrator@localhost's password: Permission denied, please try again. Administrator@localhost's password: -bash-4.2# setenforce 0 -bash-4.2# ssh -l Administrator localhost Administrator@localhost's password: Last failed login: Tue Oct 18 09:32:20 UTC 2016 from localhost on ssh:notty There were 2 failed login attempts since the last successful login. Last login: Tue Oct 18 09:31:29 2016 from localhost Could not chdir to home directory /home/administrator: No such file or directory -bash-4.2$ logout Connection to localhost closed. -bash-4.2# This looks like docker-selinux did not get installed correctly? dnf reinstall docker-selinux (In reply to Daniel Walsh from comment #7) > This looks like docker-selinux did not get installed correctly? > How is it possible in ostree? @see comment 5 > dnf reinstall docker-selinux dnf is not not atomic host. (In reply to Lukas Slebodnik from comment #8) > (In reply to Daniel Walsh from comment #7) > > This looks like docker-selinux did not get installed correctly? > > > How is it possible in ostree? @see comment 5 > > > dnf reinstall docker-selinux > ehm dnf is not on rhel atomic host 7.3 Of this is happening on Atomic Host, then I would guess something went wrong on the server build. ps -eZ | grep docker Make sure these are running with the correct label. rpm -q container-selinux -bash-4.2# atomic host status
State: idle
Deployments:
● rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard
Version: 7.3 (2016-10-06 18:32:58)
Commit: bd5ac48f6195637c0230d9b0ab0a2e5fb843764f85bc64757106238bdf31e757
OSName: rhel-atomic-host
GPGSignature: (unsigned)
rhel7-atomic:rhel-atomic-host/7/x86_64/standard
Version: 7.2.7 (2016-09-09 18:43:35)
Commit: 347c3f5eb641e69fc602878c646cf42c4bcd5d9f36847a1f24ff8f3ec80f17b1
OSName: rhel-atomic-host
-bash-4.2# ps -eZ | grep docker
system_u:system_r:docker_t:s0 12136 ? 00:00:00 docker-current
-bash-4.2# rpm -qa "*selinux*"
libselinux-utils-2.5-6.el7.x86_64
selinux-policy-targeted-3.13.1-102.el7.noarch
libselinux-2.5-6.el7.x86_64
docker-selinux-1.10.3-55.el7.x86_64
selinux-policy-3.13.1-102.el7.noarch
libselinux-python-2.5-6.el7.x86_64
-bash-4.2# rpm -q docker
docker-1.10.3-55.el7.x86_64
What is the output of? docker run fedora cat /proc/self/attr/current docker run --privileged fedora cat /proc/self/attr/current -bash-4.2# docker run --rm fedora:24 cat /proc/self/attr/current system_u:system_r:svirt_lxc_net_t:s0:c369,c616 -bash-4.2# -bash-4.2# -bash-4.2# docker run --rm --privileged fedora:24 cat /proc/self/attr/current system_u:system_r:docker_t:s0 -bash-4.2# That is wrong. Does restorecon -R -v /var/lib/docker Change labels? -bash-4.2# restorecon -R -v /var/lib/docker restorecon reset /var/lib/docker/containers/62be8d908dbc1531889e4f9fddaecb2be670a8ef9723ac7f8adfd1d9dde5f335/hosts context system_u:object_r:docker_var_lib_t:s0->system_u:object_r:docker_share_t:s0 restorecon reset /var/lib/docker/containers/62be8d908dbc1531889e4f9fddaecb2be670a8ef9723ac7f8adfd1d9dde5f335/hostname context system_u:object_r:docker_var_lib_t:s0->system_u:object_r:docker_share_t:s0 restorecon reset /var/lib/docker/containers/6192c9e5b08be21af3856a4a89be924898803eb42ffd1d4c421f00dc3d11064d/hosts context system_u:object_r:docker_var_lib_t:s0->system_u:object_r:docker_share_t:s0 restorecon reset /var/lib/docker/containers/6192c9e5b08be21af3856a4a89be924898803eb42ffd1d4c421f00dc3d11064d/hostname context system_u:object_r:docker_var_lib_t:s0->system_u:object_r:docker_share_t:s0 -bash-4.2# docker run --rm fedora:24 cat /proc/self/attr/current system_u:system_r:svirt_lxc_net_t:s0:c535,c769 -bash-4.2# -bash-4.2# docker run --rm --privileged fedora:24 cat /proc/self/attr/current system_u:system_r:docker_t:s0 -bash-4.2# Do I use right rhel AH 7.3 ostree?
-bash-4.2# rpm-ostree status
State: idle
Deployments:
● rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard
Version: 7.3 (2016-10-06 18:32:58)
Commit: bd5ac48f6195637c0230d9b0ab0a2e5fb843764f85bc64757106238bdf31e757
OSName: rhel-atomic-host
Explicit usage of spc_t did not help either -bash-4.2# docker run --rm --privileged --security-opt=label:type:spc_t fedora:24 cat /proc/self/attr/current system_u:system_r:docker_t:s0 -bash-4.2# For rhel7.3.0 we need to add these two rules to the docker.te file before we ship. kernel_unlabeled_domtrans(docker_t, spc_t) kernel_unlabeled_entry_type(spc_t) Currently privileged containers are not running as spc_t, they are running as docker_t, these rules will fix the issue. We need this added until we get to docker-1.12 I believe. I think it would be easiest to just add a patch in the spec file to handle this. Rather then playing with github. This is a blocker issue, as it will break layered products like the sssd container. On RHEL 7.3 w/ a docker 1.10.3-57 build, I get: [root@ ~]# docker run --rm fedora:24 cat /proc/self/attr/current system_u:system_r:svirt_lxc_net_t:s0:c718,c1015 [root@ ~]# [root@ ~]# docker run --rm --privileged fedora:24 cat /proc/self/attr/current system_u:system_r:spc_t:s0 [root@ ~]# Excellent. Docker version: docker-1.10.3-57.el7.x86_64 IPA server version: ipa-server-4.4.0-12.el7.x86_64 IPA client inside sssd-container: ipa-client-4.4.0-12.el7.x86_64 IPA server inside sssd-container: ipa-server is not installed Tested the bug with following observations and the issue mentioned w.r.t IPA in Comment#12 is no more observed: -bash-4.2# atomic install rhel7/sssd docker run --rm=true --privileged --net=host -v /:/host -e NAME=sssd -e IMAGE=rhel7/sssd -e HOST=/host rhel7/sssd /bin/install.sh Initializing configuration context from host ... Client hostname: rhel73atomic.testrelm.test Realm: TESTRELM.TEST DNS Domain: testrelm.test IPA Server: vm37.testrelm.test BaseDN: dc=testrelm,dc=test Skipping synchronizing time with NTP server. Successfully retrieved CA cert Subject: CN=Certificate Authority,O=TESTRELM.TEST Issuer: CN=Certificate Authority,O=TESTRELM.TEST Valid From: Tue Oct 25 11:38:16 2016 UTC Valid Until: Sat Oct 25 11:38:16 2036 UTC Enrolled in IPA realm TESTRELM.TEST Created /etc/ipa/default.conf New SSSD config will be created Configured sudoers in /etc/nsswitch.conf Configured /etc/sssd/sssd.conf Configured /etc/krb5.conf for IPA realm TESTRELM.TEST trying https://vm37.testrelm.test/ipa/json Forwarding 'schema' to json server 'https://vm37.testrelm.test/ipa/json' trying https://vm37.testrelm.test/ipa/json Forwarding 'ping' to json server 'https://vm37.testrelm.test/ipa/json' Forwarding 'ca_is_enabled' to json server 'https://vm37.testrelm.test/ipa/json' Systemwide CA database updated. Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub Forwarding 'host_mod' to json server 'https://vm37.testrelm.test/ipa/json' SSSD enabled Configured /etc/openldap/ldap.conf Configured /etc/ssh/ssh_config Configured /etc/ssh/sshd_config Configuring testrelm.test as NIS domain. Client configuration complete. Copying new configuration to host ... Full path required for exclude: net:[4026531956]. Service sssd.service configured to run SSSD container. -bash-4.2# systemctl restart sssd -bash-4.2# systemctl status sssd ● sssd.service - System Security Services Daemon in container Loaded: loaded (/etc/systemd/system/sssd.service; disabled; vendor preset: disabled) Drop-In: /etc/systemd/system/sssd.service.d └─journal.conf Active: active (exited) since Wed 2016-10-26 05:54:46 EDT; 5s ago Process: 13815 ExecStart=/usr/bin/atomic run --name=sssd rhel7/sssd (code=exited, status=0/SUCCESS) Main PID: 13815 (code=exited, status=0/SUCCESS) Oct 26 05:54:43 rhel73atomic.testrelm.test systemd[1]: Starting System Security Services Daemon in container... Oct 26 05:54:44 rhel73atomic.testrelm.test atomic[13815]: docker run -d --restart=always --privileged --net=host...etc/ Oct 26 05:54:44 rhel73atomic.testrelm.test atomic[13815]: This container uses privileged security switches: Oct 26 05:54:44 rhel73atomic.testrelm.test atomic[13815]: INFO: --net=host Oct 26 05:54:44 rhel73atomic.testrelm.test atomic[13815]: Processes in this container can listen to ports (and p...ork. Oct 26 05:54:44 rhel73atomic.testrelm.test atomic[13815]: INFO: --privileged Oct 26 05:54:44 rhel73atomic.testrelm.test atomic[13815]: This container runs without separation and should be c...tem. Oct 26 05:54:45 rhel73atomic.testrelm.test atomic[13815]: fae74c772224f70c39ffe2510aa2766cc0c010d8099bb312ad9bf7...a873 Oct 26 05:54:46 rhel73atomic.testrelm.test atomic[13815]: For more information on these switches and their secur...un'. Oct 26 05:54:46 rhel73atomic.testrelm.test systemd[1]: Started System Security Services Daemon in container. Hint: Some lines were ellipsized, use -l to show in full. -bash-4.2# docker exec -i sssd kinit admin Password for admin: ****** -bash-4.2# docker exec -i sssd klist Ticket cache: KEYRING:persistent:0:0 Default principal: admin Valid starting Expires Service principal 10/26/16 05:55:22 10/27/16 05:55:19 krbtgt/TESTRELM.TEST -bash-4.2# docker exec -i sssd kdestroy -bash-4.2# docker exec -i sssd klist klist: Credentials cache keyring 'persistent:0:0' not found -bash-4.2# docker exec -i sssd kinit admin Password for admin: ****** -bash-4.2# docker exec -i sssd klist Ticket cache: KEYRING:persistent:0:0 Default principal: admin Valid starting Expires Service principal 10/26/16 05:55:47 10/27/16 05:55:44 krbtgt/TESTRELM.TEST -bash-4.2# ssh -o GSSAPIAuthentication=yes admin.test Last login: Wed Oct 26 05:32:59 2016 from rhel73atomic.testrelm.test Could not chdir to home directory /home/admin: No such file or directory -bash-4.2$ whoami admin -bash-4.2$ exit logout Connection to rhel73atomic.testrelm.test closed. -bash-4.2# sestatus SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: enforcing Mode from config file: enforcing Policy MLS status: enabled Policy deny_unknown status: allowed Max kernel policy version: 28 -bash-4.2# systemctl stop sssd -bash-4.2# systemctl status sssd ● sssd.service - System Security Services Daemon in container Loaded: loaded (/etc/systemd/system/sssd.service; disabled; vendor preset: disabled) Drop-In: /etc/systemd/system/sssd.service.d └─journal.conf Active: inactive (dead) Oct 26 05:54:44 rhel73atomic.testrelm.test atomic[13815]: Processes in this container can listen to ports (and p...ork. Oct 26 05:54:44 rhel73atomic.testrelm.test atomic[13815]: INFO: --privileged Oct 26 05:54:44 rhel73atomic.testrelm.test atomic[13815]: This container runs without separation and should be c...tem. Oct 26 05:54:45 rhel73atomic.testrelm.test atomic[13815]: fae74c772224f70c39ffe2510aa2766cc0c010d8099bb312ad9bf7...a873 Oct 26 05:54:46 rhel73atomic.testrelm.test atomic[13815]: For more information on these switches and their secur...un'. Oct 26 05:54:46 rhel73atomic.testrelm.test systemd[1]: Started System Security Services Daemon in container. Oct 26 06:08:17 rhel73atomic.testrelm.test systemd[1]: Stopping System Security Services Daemon in container... Oct 26 06:08:18 rhel73atomic.testrelm.test atomic[14044]: sssd Oct 26 06:08:18 rhel73atomic.testrelm.test atomic[14044]: docker kill -s TERM sssd Oct 26 06:08:18 rhel73atomic.testrelm.test systemd[1]: Stopped System Security Services Daemon in container. Hint: Some lines were ellipsized, use -l to show in full. -bash-4.2# atomic uninstall rhel7/sssd docker run --rm=true --privileged --net=host -v /:/host -e NAME=sssd -e IMAGE=rhel7/sssd -e HOST=/host rhel7/sssd /bin/uninstall.sh Initializing configuration context from host ... Unenrolling client from IPA server Removing Kerberos service principals from /etc/krb5.keytab Disabling client Kerberos and LDAP configurations Redundant SSSD configuration file /etc/sssd/sssd.conf was moved to /etc/sssd/sssd.conf.deleted Restoring client configuration files Unconfiguring the NIS domain. nscd daemon is not installed, skip configuration nslcd daemon is not installed, skip configuration Client uninstall complete. Copying new configuration to host ... Removing /etc/ipa/nssdb/pwdfile.txt Removing /etc/ipa/nssdb/secmod.db Removing /etc/ipa/nssdb/cert8.db Removing /etc/ipa/nssdb/key3.db Removing /etc/ipa/ca.crt Removing /etc/ipa/default.conf Removing /etc/sssd/systemctl-lite-enabled/sssd.service Removing /etc/sssd/systemctl-lite-enabled/rhel-domainname.service Removing /etc/sssd/sssd.conf Removing /var/lib/ipa-client/sysrestore/ecbbfbe9acaf4214-nsswitch.conf Removing /var/lib/ipa-client/sysrestore/sysrestore.index Removing /var/lib/ipa-client/sysrestore/5daa1cc1c5db890f-krb5.conf Removing /var/lib/ipa-client/sysrestore/sysrestore.state Removing /var/lib/ipa-client/sysrestore/32619519e6946e4d-ldap.conf Removing /var/lib/ipa-client/sysrestore/4d52da414ab5cf48-ssh_config Removing /var/lib/ipa-client/sysrestore/eb936dcc8626f8e0-sshd_config Removing /var/lib/sss/pipes/private/sbus-dp_testrelm.test.125 Removing /var/lib/sss/pipes/private/sbus-monitor Removing /var/lib/sss/pipes/private/sbus-dp_testrelm.test.14 Removing /var/lib/sss/pipes/private/sbus-dp_testrelm.test Removing /var/lib/sss/pipes/private/pam Removing /var/lib/sss/db/cache_testrelm.test.ldb Removing /var/lib/sss/db/ccache_TESTRELM.TEST Removing /var/lib/sss/mc/passwd Removing /var/lib/sss/mc/group Versions:
========
[root@atomic-1 sssd]# atomic host status
State: idle
Deployments:
● rhel-atomic-host:rhel-atomic-host/7/x86_64/standard
Version: 7.3 (2016-10-26 14:24:09)
Commit: 90c9735becfff1c55c8586ae0f2c904bc0928f042cd4d016e9e0e2edd16e5e97
OSName: rhel-atomic-host
[root@atomic-1 sssd]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
lslebodn/sssd-docker extras-rhel-7.3-docker-candidate-20161028173817 76f8fba288aa 4 days ago 357.3 MB
rhel7/sssd latest 76f8fba288aa 4 days ago 357.3 MB
Docker Version:
==============
docker-1.10.3-57.el7.x86_64
1. Join atomic host to Windows AD 2012R2
[root@atomic-1 sssd]# atomic install rhel7/sssd realm join CENTAUR.TEST -v
docker run --rm=true --privileged --net=host -v /:/host -e NAME=sssd -e IMAGE=rhel7/sssd -e HOST=/host rhel7/sssd /bin/install.sh realm join CENTAUR.TEST -v
Initializing configuration context from host ...
* Resolving: _ldap._tcp.centaur.test
* Performing LDAP DSE lookup on: 192.168.122.187
* Successfully discovered: CENTAUR.TEST
Password for Administrator: * Required files: /usr/sbin/oddjobd, /usr/libexec/oddjob/mkhomedir, /usr/sbin/sssd, /usr/bin/net
* LANG=C LOGNAME=root /usr/bin/net -s /var/cache/realmd/realmd-smb-conf.ZWGIQY -U Administrator ads join CENTAUR.TEST
Enter Administrator's password:DNS update failed: NT_STATUS_INVALID_PARAMETER
Using short domain name -- CENTAUR
Joined 'ATOMIC-1' to dns domain 'CENTAUR.TEST'
No DNS domain configured for atomic-1. Unable to perform DNS Update.
* LANG=C LOGNAME=root /usr/bin/net -s /var/cache/realmd/realmd-smb-conf.ZWGIQY -U Administrator ads keytab create
Enter Administrator's password:
* /usr/bin/systemctl enable sssd.service
* /usr/bin/systemctl restart sssd.service
* /usr/bin/sh -c /usr/sbin/authconfig --update --enablesssd --enablesssdauth --enablemkhomedir --nostart && /usr/bin/systemctl enable oddjobd.service && /usr/bin/systemctl start oddjobd.service
* Successfully enrolled machine in realm
Copying new configuration to host ...
Full path required for exclude: net:[4026531956].
Service sssd.service configured to run SSSD container.
2.Restart sssd process
[root@atomic-1 sssd]# ps -efZ | grep sssd
system_u:system_r:spc_t:s0 root 12750 12738 0 06:40 ? 00:00:00 tail -f /var/log/sssd/systemctl.log
system_u:system_r:spc_t:s0 root 12755 12738 0 06:40 ? 00:00:00 /usr/sbin/sssd -D -f
system_u:system_r:spc_t:s0 root 12756 12755 0 06:40 ? 00:00:00 /usr/libexec/sssd/sssd_be --domain CENTAUR.TEST --uid 0 --gid 0 --debug-to-files
system_u:system_r:spc_t:s0 root 12758 12755 0 06:40 ? 00:00:00 /usr/libexec/sssd/sssd_nss --uid 0 --gid 0 --debug-to-files
system_u:system_r:spc_t:s0 root 12759 12755 0 06:40 ? 00:00:00 /usr/libexec/sssd/sssd_pam --uid 0 --gid 0 --debug-to-files
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 12802 12260 0 06:42 pts/0 00:00:00 grep --color=auto sssd
3.Id and login as AD user successfull
[root@atomic-1 sssd]# id Administrator
uid=1993600500(administrator) gid=1993600513(domain users) groups=1993600513(domain users),1993600520(group policy creator owners),1993600519(enterprise admins),1993600572(denied rodc password replication group),1993601671(testgroup1),1993600512(domain admins),1993600518(schema admins),1993601669(myunixgroup)
[root@atomic-1 sssd]# ssh Administrator@localhost
The authenticity of host 'localhost (::1)' can't be established.
ECDSA key fingerprint is 10:f8:fb:28:d7:5f:46:f4:27:1f:61:56:a9:e3:d2:4a.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'localhost' (ECDSA) to the list of known hosts.
Administrator@localhost's password:
Could not chdir to home directory /home/administrator: No such file or directory
-bash-4.2$ logout
Connection to localhost closed.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2016-2634.html |
Description of problem: After installing sssd-docker container on Atomic host and joining the atomic host to Windows AD. sssd process of the container runs as docker_t instead of spc_t. This causes Active Directory user to unable to login. Oct 17 12:22:47 atomic-00.localdomain docker-current[3259]: [start sssd.service] Oct 17 12:22:47 atomic-00.localdomain docker-current[3259]: Service [sssd.service] defines PIDFile [/var/run/sssd.pid], unlinking it before start Oct 17 12:22:47 atomic-00.localdomain docker-current[3259]: Running [/usr/sbin/sssd -D -f] Oct 17 12:22:47 atomic-00.localdomain docker-current[3259]: Service [sssd.service] defines PIDFile [/var/run/sssd.pid], not marking pid Oct 17 12:23:03 atomic-00.localdomain kernel: type=1400 audit(1476706983.398:5): avc: denied { connectto } for pid=13775 comm="sshd" path="/var/lib/sss/pipes/nss" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:docker_t:s0 tclass=unix_stream_socket Oct 17 12:23:03 atomic-00.localdomain sshd[13775]: Invalid user Administrator from ::1 Oct 17 12:23:03 atomic-00.localdomain sshd[13775]: input_userauth_request: invalid user Administrator [preauth] Oct 17 12:23:03 atomic-00.localdomain sshd[13775]: PAM unable to dlopen(/usr/lib64/security/pam_oddjob_mkhomedir.so): /usr/lib64/security/pam_oddjob_mkhomedir.so: cannot open shared object file: No such file or directory Oct 17 12:23:03 atomic-00.localdomain sshd[13775]: PAM adding faulty module: /usr/lib64/security/pam_oddjob_mkhomedir.so Oct 17 12:23:05 atomic-00.localdomain kernel: type=1400 audit(1476706985.691:6): avc: denied { connectto } for pid=13775 comm="sshd" path="/var/lib/sss/pipes/nss" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:docker_t:s0 tclass=unix_stream_socket Oct 17 12:23:05 atomic-00.localdomain kernel: type=1400 audit(1476706985.695:7): avc: denied { connectto } for pid=13775 comm="sshd" path="/var/lib/sss/pipes/nss" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:docker_t:s0 tclass=unix_stream_socket Oct 17 12:23:05 atomic-00.localdomain kernel: type=1400 audit(1476706985.698:8): avc: denied { connectto } for pid=13775 comm="sshd" path="/var/lib/sss/pipes/nss" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:docker_t:s0 tclass=unix_stream_socket Oct 17 12:23:05 atomic-00.localdomain sshd[13775]: Failed password for invalid user Administrator from ::1 port 39240 ssh2 Oct 17 12:23:06 atomic-00.localdomain sshd[13775]: Connection closed by ::1 [preauth] Version-Release number of selected component (if applicable): [root@atomic-00 ~]# docker images REPOSITORY TAG IMAGE ID CREATED SIZE lslebodn/sssd-docker extras-rhel-7.3-docker-candidate-20161014123525 dfe44a22b633 2 days ago 369.9 MB rhel7/sssd latest dfe44a22b633 2 days ago 369.9 MB registry.access.redhat.com/rhel7 latest 98a88a8b722a 5 weeks ago 201.4 MB [root@atomic-00 ~]# atomic host status State: idle Deployments: ● rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard Version: 7.3 (2016-10-06 18:32:58) Commit: bd5ac48f6195637c0230d9b0ab0a2e5fb843764f85bc64757106238bdf31e757 OSName: rhel-atomic-host Docker image was downloaded from [1] How reproducible: Steps to Reproduce: 1. Download rhel-atomic-cloud-7.3.0-2.x86_64.qcow2 from brew http://download-node-02.eng.bos.redhat.com/brewroot/packages/rhel-atomic-cloud/7.3.0/2/images/rhel-atomic-cloud-7.3.0-2.x86_64.qcow2 2. Download sssd-docker image from above brew link. http://download-node-02.eng.bos.redhat.com/brewroot/packages/sssd-docker/7.3/8/images/ 3. Tag the docker image as rhel7/sssd $docker tag dfe44a22b633 rhel7/sssd 4. Join atomic host to Windows AD [root@atomic-00 ~]# atomic install rhel7/sssd realm join CENTAUR.TEST -v docker run --rm=true --privileged --net=host -v /:/host -e NAME=sssd -e IMAGE=rhel7/sssd -e HOST=/host rhel7/sssd /bin/install.sh realm join CENTAUR.TEST -v Initializing configuration context from host ... * Resolving: _ldap._tcp.centaur.test * Performing LDAP DSE lookup on: 192.168.122.187 Password for Administrator: * Successfully discovered: CENTAUR.TEST * Required files: /usr/sbin/oddjobd, /usr/libexec/oddjob/mkhomedir, /usr/sbin/sssd, /usr/bin/net * LANG=C LOGNAME=root /usr/bin/net -s /var/cache/realmd/realmd-smb-conf.SQ1HPY -U Administrator ads join CENTAUR.TEST Enter Administrator's password:DNS update failed: NT_STATUS_UNSUCCESSFUL Using short domain name -- CENTAUR Joined 'ATOMIC-00' to dns domain 'CENTAUR.TEST' DNS Update for atomic-00.localdomain failed: ERROR_DNS_UPDATE_FAILED * LANG=C LOGNAME=root /usr/bin/net -s /var/cache/realmd/realmd-smb-conf.SQ1HPY -U Administrator ads keytab create Enter Administrator's password: * /usr/bin/systemctl enable sssd.service * /usr/bin/systemctl restart sssd.service * /usr/bin/sh -c /usr/sbin/authconfig --update --enablesssd --enablesssdauth --enablemkhomedir --nostart && /usr/bin/systemctl enable oddjobd.service && /usr/bin/systemctl start oddjobd.service * Successfully enrolled machine in realm Copying new configuration to host ... Full path required for exclude: net:[4026531956]. Service sssd.service configured to run SSSD container. 5. Restart sssd process [root@atomic-00 ~]# ps auxZ | grep sssd system_u:system_r:docker_t:s0 root 13750 0.0 0.0 4348 348 ? S 12:22 0:00 tail -f /var/log/sssd/systemctl.log system_u:system_r:docker_t:s0 root 13755 0.0 0.1 153908 3108 ? Ss 12:22 0:00 /usr/sbin/sssd -D -f system_u:system_r:docker_t:s0 root 13756 1.0 0.5 363448 9856 ? S 12:22 0:00 /usr/libexec/sssd/sssd_be --domain CENTAUR.TEST --uid 0 --gid 0 --debug-to-files system_u:system_r:docker_t:s0 root 13758 0.1 1.5 159676 28336 ? S 12:22 0:00 /usr/libexec/sssd/sssd_nss --uid 0 --gid 0 --debug-to-files system_u:system_r:docker_t:s0 root 13759 0.0 0.1 139280 3684 ? S 12:22 0:00 /usr/libexec/sssd/sssd_pam --uid 0 --gid 0 --debug-to-files Actual results: selinux context of sssd processes is docker_t Expected results: selinux context of sssd process should be spc_t Additional info: