Bug 1432115
| Summary: | AVCs caused by FreeIPA code change | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Martin Bašti <mbasti> | ||||||||
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> | ||||||||
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> | ||||||||
| Severity: | medium | Docs Contact: | |||||||||
| Priority: | medium | ||||||||||
| Version: | 7.4 | CC: | dominick.grift, dwalsh, extras-qa, lvrabec, mbasti, mgrepl, mmalik, plautrba, pmoore, pvrabec, rharwood, spoore, ssekidde | ||||||||
| Target Milestone: | rc | ||||||||||
| Target Release: | --- | ||||||||||
| Hardware: | All | ||||||||||
| OS: | Linux | ||||||||||
| Whiteboard: | |||||||||||
| Fixed In Version: | selinux-policy-3.13.1-145.el7 | Doc Type: | If docs needed, set a value | ||||||||
| Doc Text: | Story Points: | --- | |||||||||
| Clone Of: | 1426646 | Environment: | |||||||||
| Last Closed: | 2017-08-01 15:24:23 UTC | Type: | Bug | ||||||||
| Regression: | --- | Mount Type: | --- | ||||||||
| Documentation: | --- | CRM: | |||||||||
| Verified Versions: | Category: | --- | |||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||
| Embargoed: | |||||||||||
| Attachments: |
|
||||||||||
|
Comment 3
Scott Poore
2017-03-29 21:21:37 UTC
I extracted a new set of AVC from our test suites, majority of AVCs is caused by dogtag component. Created attachment 1270740 [details]
IdM sealert AVCs
Martin, It looks like you tested it with old version of selinux-policy rpm package. (-139.el7), please test it with -141.el7 release. Thanks. Created attachment 1271193 [details]
IdM sealert AVCs 2
Hello, re-tested with selinux-policy-3.13.1-141 ipa-server-4.5.0-5.el7.x86_64 please see attachment. Martin New AVCs found by additional test run Created attachment 1272910 [details]
IdM sealert AVCs3
Please also note following AVC that is not reproducible in permissive mode
type=AVC msg=audit(1491941544.278:552): avc: denied { dac_read_search } for pid=6803 comm="gssproxy" capability=2 scontext=system_u:system_r:gssproxy_t:s0 tcontext=system_u:system_r:gssproxy_t:s0 tclass=capability
*** Bug 1441376 has been marked as a duplicate of this bug. *** Fixed issue with /tmp/ca.p12 file. Could you re-run your scenario after installing the latest selinux-policy packages (3.13.1-164.el7)? Do you still see SELinux denials? IMO fixes are tested by our QE, and AFAIK no critical AVCs were found. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:1861 |