Bug 1532079

Summary: SELinux is preventing dnsmasq from updating the nameserver list via dbus
Product: [Fedora] Fedora Reporter: Pablo Hess <phess>
Component: selinux-policy-targetedAssignee: Lukas Vrabec <lvrabec>
Status: CLOSED ERRATA QA Contact: Ben Levenson <benl>
Severity: low Docs Contact:
Priority: unspecified    
Version: 27CC: dwalsh
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-02-27 17:21:36 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Pablo Hess 2018-01-07 21:51:23 UTC
Description of problem:
SELinux policy targeted as provided on Fedora 27 prevents dnsmasq from sending messages over dbus to (as far as I understand) acknowledge changes in the nameserver list.  When connecting to a VPN, dnsmasq will not update the nameserver list and will keep using the old nameservers.

Typical AVC under Permissive mode:
type=USER_AVC msg=audit(1515355945.646:1293): pid=939 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.333 spid=9390 tpid=16945 scontext=system_u:system_r:dnsmasq_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=dbus permissive=1  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'


Version-Release number of selected component (if applicable):
Fedora 27
selinux-policy-targeted-3.13.1-283.17.fc27.noarch
dnsmasq-2.78-1.fc27.x86_64
NetworkManager-1.8.4-7.fc27.x86_64
NetworkManager-openvpn-1.8.0-3.fc27.x86_64
openvpn-2.4.4-1.fc27.x86_64
NetworkManager-openvpn-gnome-1.8.0-3.fc27.x86_64

How reproducible:
Every time.


Steps to Reproduce:
1. Set NetworkManager to use dnsmasq as DNS manager (dns=dnsmasq in NetworkManager.conf) and restart NetworkManager
2. Connect to a VPN on OpenVPN
3. Try to resolve a hostname on the VPN without manually setting your nameservers to include the VPN's.


Actual results:
Internal VPN hostname will fail to resolve -- VPN's nameserver won't be queried at all.


Expected results:
Internal VPN hostname should be resolved by the VPN nameserver.


Additional info:
Confirmed failure to even get a version number from dnsmasq through dbus using gdbus CLI utility:
$ sudo setenforce 1
$ sudo gdbus call -y -d org.freedesktop.NetworkManager.dnsmasq -o  /uk/org/thekelleys/dnsmasq -m uk.org.thekelleys.dnsmasq.GetVersion
   (FAILURE MESSAGE)

$ sudo setenforce 0
$ sudo gdbus call -y -d org.freedesktop.NetworkManager.dnsmasq -o  /uk/org/thekelleys/dnsmasq -m uk.org.thekelleys.dnsmasq.GetVersion
('2.78',)


In addition, "audit2allow -M dnsmasq-selinux-dbus" produced a TE module with this content:
~~~
module dnsmasq-selinux-dbus 1.0;

require {
        type dnsmasq_t;
        type unconfined_t;
        class dbus send_msg;
}

#============= dnsmasq_t ==============
allow dnsmasq_t unconfined_t:dbus send_msg;
~~~

Curiously enough, NetworkManager is *not* running with unconfined_t but NetworkManager_t as expected.

I loaded the new module and the problem is now fixed.

Comment 1 Fedora Update System 2018-02-20 11:14:40 UTC
selinux-policy-3.13.1-283.26.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2018-a9711c96b2

Comment 2 Fedora Update System 2018-02-20 18:19:10 UTC
selinux-policy-3.13.1-283.26.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-a9711c96b2

Comment 3 Fedora Update System 2018-02-27 17:21:36 UTC
selinux-policy-3.13.1-283.26.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.