Bug 1419957

Summary: selinux prevents iptables.init from reading modprobe.d directory
Product: Red Hat Enterprise Linux 7 Reporter: Zdenek Pytela <zpytela>
Component: selinux-policyAssignee: Lukas Vrabec <lvrabec>
Status: CLOSED DUPLICATE QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: medium Docs Contact:
Priority: medium    
Version: 7.3CC: iptables-maint-list, lvrabec, mgrepl, mmalik, plautrba, pvrabec, ssekidde
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-02-08 14:38:38 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Comment 1 Zdenek Pytela 2017-02-07 14:05:05 UTC
Description of problem:
SELinux policy prevents legacy commands iptables.init and ip6tables.init from accessing /etc/modprobe.d directory.

Version-Release number of selected component (if applicable):
selinux-policy-3.13.1-102.el7_3.13.noarch
iptables-services-1.4.21-17.el7.x86_64


How reproducible:
always


Steps to Reproduce:
1. systemctl start ip6tables
2. systemctl status ip6tables
3. ausearch -i -ts recent

Actual results:
----
type=SYSCALL msg=audit(02/07/17 14:55:51.092:2378) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=0xffffffffffffff9c a1=0x1b76e50 a2=O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC a3=0x0 items=0 ppid=1 pid=9434 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=ip6tables.init exe=/usr/bin/bash subj=system_u:system_r:iptables_t:s0 key=(null)
type=AVC msg=audit(02/07/17 14:55:51.092:2378) : avc:  denied  { read } for  pid=9434 comm=ip6tables.init name=modprobe.d dev="dm-0" ino=512041 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:modules_conf_t:s0 tclass=dir
----


Expected results:
<no avc>

Additional info:
seems similar to #1373220

Comment 2 Milos Malik 2017-02-07 15:00:40 UTC
Already seen in https://bugzilla.redhat.com/show_bug.cgi?id=1367520#c8.

Comment 3 Lukas Vrabec 2017-02-08 14:38:38 UTC

*** This bug has been marked as a duplicate of bug 1418391 ***