Updating a machine account password with *adcli* in some cases fails with SELinux error
When attempting to update the machine account password using the *adcli* tool in Red Hat Enterprise Linux 6.10, the system security services daemon (SSSD) sometimes tries to update an internal Samba database that contains also the machine account password. As a consequence, the SELinux access vector cache (AVC) states that SSSD and its subprocesses are not allowed to run Samba's `net` command to update the internal Samba database.
To work around this problem, you can add a local SELinux policy by creating a `sssd_samba.te` file with the following content:
module sssd_samba 1.0;
require {
type sssd_t;
type samba_net_exec_t;
class file execute;
}
#============= sssd_t ==============
allow sssd_t samba_net_exec_t:file execute;
And then enter the following commands:
# yum install selinux-policy-devel
# make -f /usr/share/selinux/devel/Makefile sssd_samba.pp
# semodule -i sssd_samba.pp
As a result, SSSD with *adcli* can update Samba's internal database without an SELinux AVC error.
Description of problem:
Observed AVC denials during the recent rhel-6.10 regression runs of ad_parameter test suite. The "adcli" process was denied execution of file "/usr/bin/net" on a file system hosted on the "dm-0" device. This file has inode number "949886" and has the security context "system_u:object_r:samba_net_exec_t:s0" assigned to it. The "adcli" process is running with security context "unconfined_u:system_r:sssd_t:s0".
ERROR:
- type=SYSCALL msg=audit(1521532221.642:731): arch=c000003e syscall=21 success=no exit=-13 a0=111e450 a1=1 a2=0 a3=3637373838333337 items=0 ppid=4695 pid=14877 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=7 comm="adcli" exe="/usr/sbin/adcli" subj=unconfined_u:system_r:sssd_t:s0 key=(null)
- type=AVC msg=audit(1521532231.099:732): avc: denied { execute } for pid=14969 comm="adcli" name="net" dev=dm-0 ino=949886 scontext=unconfined_u:system_r:sssd_t:s0 tcontext=system_u:object_r:samba_net_exec_t:s0 tclass=file
I reproduced this error by:
- Adding "ad_machine_account_password_renewal_opts = 10:30" to the domain section of SSSD.conf file.
- Restart SSSD service and monitor /var/log/audit/audit.log file.
Version-Release number of selected component (if applicable):
sssd-1.13.3-60.el6.x86_64
How reproducible:
Always
Steps to Reproduce:
1. Configure sssd.conf as given below:
[sssd]
config_file_version = 2
services = nss, pam
domains = sssdad.com
user =
[nss]
filter_groups = root
filter_users = root
default_shell = /bin/bash
override_homedir = /home/%u
[domain/sssdad.com]
debug_level = 0xFFF0
id_provider = ad
ad_domain = sssdad.com
krb5_realm = SSSDAD
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
ldap_schema = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad
ad_machine_account_password_renewal_opts = 10:30
2. Clear the cache and restart sssd service.
3. Monitor /var/log/audit/audit.log for AVC denial errors.
Actual results:
Beaker job during regression run fails due to AVC denials.
x86_64 : https://beaker.engineering.redhat.com/jobs/2368015
x86_64 : https://beaker.engineering.redhat.com/jobs/2376288
Expected results:
Successful regression round without AVC denials.
Additional info:
Following is the analysis of "sealert" utility :
SELinux is preventing /usr/sbin/adcli from execute access on the file /usr/bin/net.
***** Plugin catchall (100. confidence) suggests ***************************
If you believe that adcli should be allowed execute access on the net file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep adcli /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp
Additional Information:
Source Context unconfined_u:system_r:sssd_t:s0
Target Context system_u:object_r:samba_net_exec_t:s0
Target Objects /usr/bin/net [ file ]
Source adcli
Source Path /usr/sbin/adcli
Port <Unknown>
Host <Unknown>
Source RPM Packages
Target RPM Packages samba-common-3.6.23-50.el6.x86_64
Policy RPM selinux-policy-3.7.19-312.el6.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name vm-idm-034.sssdad.com
Platform Linux vm-idm-034.sssdad.com 2.6.32-742.el6.x86_64
#1 SMP Fri Mar 2 22:40:54 EST 2018 x86_64 x86_64
Alert Count 2
First Seen Tue Mar 20 13:20:41 2018
Last Seen Tue Mar 20 13:20:41 2018
Local ID 9cb5ee0d-74e1-4e00-af3d-b06c8a98a5ae
Raw Audit Messages
type=AVC msg=audit(1521532241.20:735): avc: denied { execute } for pid=15061 comm="adcli" name="net" dev=dm-0 ino=949886 scontext=unconfined_u:system_r:sssd_t:s0 tcontext=system_u:object_r:samba_net_exec_t:s0 tclass=file
Hi,
would it still be possible to enhance the SELinux policy for RHEL-6.10 to allow sssd_t processes to execute samba_net_exec_t files? Or is there a work-arounf to make it work with the existing policy?
In 6.10 adcli is able to update the host account password in Samba's internal tdb files with the help of the net command. This was added to allow RHEL6 clients to join AD domains where SMB1 is disabled. When SSSD calls adcli to update an old host account password Samba's internal tdbs must be updated with the new password as well.
bye,
Sumit
Description of problem: Observed AVC denials during the recent rhel-6.10 regression runs of ad_parameter test suite. The "adcli" process was denied execution of file "/usr/bin/net" on a file system hosted on the "dm-0" device. This file has inode number "949886" and has the security context "system_u:object_r:samba_net_exec_t:s0" assigned to it. The "adcli" process is running with security context "unconfined_u:system_r:sssd_t:s0". ERROR: - type=SYSCALL msg=audit(1521532221.642:731): arch=c000003e syscall=21 success=no exit=-13 a0=111e450 a1=1 a2=0 a3=3637373838333337 items=0 ppid=4695 pid=14877 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=7 comm="adcli" exe="/usr/sbin/adcli" subj=unconfined_u:system_r:sssd_t:s0 key=(null) - type=AVC msg=audit(1521532231.099:732): avc: denied { execute } for pid=14969 comm="adcli" name="net" dev=dm-0 ino=949886 scontext=unconfined_u:system_r:sssd_t:s0 tcontext=system_u:object_r:samba_net_exec_t:s0 tclass=file I reproduced this error by: - Adding "ad_machine_account_password_renewal_opts = 10:30" to the domain section of SSSD.conf file. - Restart SSSD service and monitor /var/log/audit/audit.log file. Version-Release number of selected component (if applicable): sssd-1.13.3-60.el6.x86_64 How reproducible: Always Steps to Reproduce: 1. Configure sssd.conf as given below: [sssd] config_file_version = 2 services = nss, pam domains = sssdad.com user = [nss] filter_groups = root filter_users = root default_shell = /bin/bash override_homedir = /home/%u [domain/sssdad.com] debug_level = 0xFFF0 id_provider = ad ad_domain = sssdad.com krb5_realm = SSSDAD realmd_tags = manages-system joined-with-adcli cache_credentials = True ldap_schema = ad krb5_store_password_if_offline = True default_shell = /bin/bash use_fully_qualified_names = True fallback_homedir = /home/%u@%d access_provider = ad ad_machine_account_password_renewal_opts = 10:30 2. Clear the cache and restart sssd service. 3. Monitor /var/log/audit/audit.log for AVC denial errors. Actual results: Beaker job during regression run fails due to AVC denials. x86_64 : https://beaker.engineering.redhat.com/jobs/2368015 x86_64 : https://beaker.engineering.redhat.com/jobs/2376288 Expected results: Successful regression round without AVC denials. Additional info: Following is the analysis of "sealert" utility : SELinux is preventing /usr/sbin/adcli from execute access on the file /usr/bin/net. ***** Plugin catchall (100. confidence) suggests *************************** If you believe that adcli should be allowed execute access on the net file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep adcli /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context unconfined_u:system_r:sssd_t:s0 Target Context system_u:object_r:samba_net_exec_t:s0 Target Objects /usr/bin/net [ file ] Source adcli Source Path /usr/sbin/adcli Port <Unknown> Host <Unknown> Source RPM Packages Target RPM Packages samba-common-3.6.23-50.el6.x86_64 Policy RPM selinux-policy-3.7.19-312.el6.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name vm-idm-034.sssdad.com Platform Linux vm-idm-034.sssdad.com 2.6.32-742.el6.x86_64 #1 SMP Fri Mar 2 22:40:54 EST 2018 x86_64 x86_64 Alert Count 2 First Seen Tue Mar 20 13:20:41 2018 Last Seen Tue Mar 20 13:20:41 2018 Local ID 9cb5ee0d-74e1-4e00-af3d-b06c8a98a5ae Raw Audit Messages type=AVC msg=audit(1521532241.20:735): avc: denied { execute } for pid=15061 comm="adcli" name="net" dev=dm-0 ino=949886 scontext=unconfined_u:system_r:sssd_t:s0 tcontext=system_u:object_r:samba_net_exec_t:s0 tclass=file