| Summary: |
Update SELinux policy for SSSD (for Fedora 24+) |
| Product: |
[Fedora] Fedora
|
Reporter: |
Fabiano Fidêncio <fidencio> |
| Component: |
selinux-policy | Assignee: |
Lukas Vrabec <lvrabec> |
| Status: |
CLOSED
CURRENTRELEASE
|
QA Contact: |
Fedora Extras Quality Assurance <extras-qa> |
| Severity: |
unspecified
|
Docs Contact: |
|
| Priority: |
unspecified
|
|
|
| Version: |
25 | CC: |
dominick.grift, dwalsh, jhrozek, lslebodn, lvrabec, mgrepl, plautrba, pmoore, sgallagh, ssekidde
|
| Target Milestone: |
--- | |
|
| Target Release: |
--- | |
|
| Hardware: |
Unspecified | |
|
| OS: |
Unspecified | |
|
| Whiteboard: |
|
|
Fixed In Version:
|
|
Doc Type:
|
If docs needed, set a value
|
|---|
|
Doc Text:
|
|
Story Points:
|
---
|
|---|
|
Clone Of:
|
|
|---|
|
:
|
1416780
(view as bug list) |
Environment:
|
|
|
Last Closed:
|
2017-07-04 06:59:17 UTC
|
Type:
|
Bug
|
|---|
|
Regression:
|
---
|
Mount Type:
|
---
|
|---|
|
Documentation:
|
---
|
CRM:
|
|
|---|
|
Verified Versions:
|
|
Category:
|
---
|
|---|
|
oVirt Team:
|
---
|
RHEL 7.3 requirements from Atomic Host:
|
|
|---|
|
Cloudforms Team:
|
---
|
Target Upstream Version:
|
|
|---|
|
Embargoed:
|
|
| |
|---|
| Bug Depends On: |
|
|
|
| Bug Blocks: |
1416780
|
|
|
Due to some changes in SSSD code I've been hitting the following AVC: Jan 09 14:31:50 client1.ipa.example audit[11625]: AVC avc: denied { setpgid } for pid=11625 comm="sssd_be" scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:system_r:sssd_t:s0 tclass=process permissive=0 Jan 09 14:31:50 client1.ipa.example audit[11629]: AVC avc: denied { setpgid } for pid=11629 comm="sssd_ssh" scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:system_r:sssd_t:s0 tclass=process permissive=0 Jan 09 14:31:50 client1.ipa.example audit[11627]: AVC avc: denied { setpgid } for pid=11627 comm="sssd_sudo" scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:system_r:sssd_t:s0 tclass=process permissive=0 Jan 09 14:31:50 client1.ipa.example audit[11628]: AVC avc: denied { setpgid } for pid=11628 comm="sssd_pam" scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:system_r:sssd_t:s0 tclass=process permissive=0 Jan 09 14:31:50 client1.ipa.example audit[11626]: AVC avc: denied { setpgid } for pid=11626 comm="sssd_nss" scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:system_r:sssd_t:s0 tclass=process permissive=0 Jan 09 14:31:50 client1.ipa.example audit[11630]: AVC avc: denied { setpgid } for pid=11630 comm="sssd_pac" scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:system_r:sssd_t:s0 tclass=process permissive=0 So, the policy has to be updated for the following binaries: - sssd_autofs - sssd_be - sssd_ifp - sssd_nss - sssd_pac - sssd_pam - sssd_secrets - sssd_ssh - sssd_sudo