Bug 1576913
Summary: | SELinux is preventing lpqd from 'sendto' accesses on the unix_dgram_socket /var/lib/samba/private/msg.sock/1966. | ||
---|---|---|---|
Product: | [Fedora] Fedora | Reporter: | Douglas Marques <dgsmarques> |
Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
Severity: | unspecified | Docs Contact: | |
Priority: | unspecified | ||
Version: | 28 | CC: | al.dunsmuir, dan, dwalsh, jjq, lvrabec, mgrepl, mstuff, ol+redhat, plautrba, pmoore |
Target Milestone: | --- | ||
Target Release: | --- | ||
Hardware: | x86_64 | ||
OS: | Unspecified | ||
Whiteboard: | abrt_hash:cd967aa6312f9ab5985b5ede18011e0d9084c1355bee68c50878cbe28e0560e0;VARIANT_ID=workstation; | ||
Fixed In Version: | selinux-policy-3.14.1-29.fc28 | Doc Type: | If docs needed, set a value |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2018-05-26 20:44:51 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: |
Description
Douglas Marques
2018-05-10 17:03:08 UTC
Confirm here as well: SELinux is preventing lpqd from 'sendto' accesses on the unix_dgram_socket /var/lib/samba/private/msg.sock/9515. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that lpqd should be allowed sendto access on the 9515 unix_dgram_socket by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'lpqd' --raw | audit2allow -M my-lpqd # semodule -X 300 -i my-lpqd.pp Additional Information: Source Context system_u:system_r:smbd_t:s0 Target Context system_u:system_r:nmbd_t:s0 Target Objects /var/lib/samba/private/msg.sock/9515 [ unix_dgram_socket ] Source lpqd Source Path lpqd Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.14.1-24.fc28.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 4.16.8-300.fc28.x86_64 #1 SMP Wed May 9 20:23:40 UTC 2018 x86_64 x86_64 Alert Count 856 First Seen 2018-05-17 12:00:11 EDT Last Seen 2018-05-19 08:04:45 EDT Local ID 2227904f-200b-440f-af62-07029de139f9 Raw Audit Messages type=AVC msg=audit(1526731485.445:10459): avc: denied { sendto } for pid=9498 comm="lpqd" path="/var/lib/samba/private/msg.sock/9515" scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:system_r:nmbd_t:s0 tclass=unix_dgram_socket permissive=0 Hash: lpqd,smbd_t,nmbd_t,unix_dgram_socket,sendto selinux-policy-3.14.1-29.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-a74875b364 selinux-policy-3.14.1-29.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-a74875b364 selinux-policy-3.14.1-29.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report. Description of problem: This might be related to bugs #1563791 and #1576913, but note different tcontext: system_u:system_r:winbind_t:s0 instead of system_u:system_r:nmbd_t:s0. selinux-policy package is 3.14.1-32.fc28. Version-Release number of selected component: selinux-policy-3.14.1-32.fc28.noarch Additional info: reporter: libreport-2.9.5 hashmarkername: setroubleshoot kernel: 4.16.14-300.fc28.x86_64 type: libreport Please reopen this bug. It's not fixed in selinux-policy-3.14.1-32.fc28.noarch. Different bug with tcontext=system_u:system_r:nmbd_t:s0 was fixed. Description of problem: Trying to start samba (perhaps) Version-Release number of selected component: selinux-policy-3.14.1-32.fc28.noarch Additional info: reporter: libreport-2.9.5 hashmarkername: setroubleshoot kernel: 4.16.15-300.fc28.x86_64 type: libreport Comments 5 & 7 would seem to suggest that selinux-policy-3.14.1-29.fc28 does not fix this bug Please reopen May be of interest - ... If you believe that lpqd should be allowed sendto access on the 9895 unix_dgram_socket by default. You should report this as a bug. You can generate a local policy module to allow this access. Allow this access for now by executing: # ausearch -c 'lpqd' --raw | audit2allow -M my-lpqd # semodule -X 300 -i my-lpqd.pp # ausearch -c 'lpqd' --raw | audit2allow -M my-lpqd could not write output file: [Errno 5] Input/output error: 'my-lpqd.te' (In reply to morgan read from comment #9) > # ausearch -c 'lpqd' --raw | audit2allow -M my-lpqd > could not write output file: [Errno 5] Input/output error: 'my-lpqd.te' The generated te file is quite trivial: module lpqd-winbind 1.0; require { type winbind_t; type smbd_t; class unix_dgram_socket sendto; } #============= smbd_t ============== allow smbd_t winbind_t:unix_dgram_socket sendto; Of course, everybody can generate a policy module to allow smbd_t to perform sendto to winbind_t:unix_dgram_socket and then load it. but we are interesting in a solution for everybody using Fedora. Hence, this rule should be included in selinux-policy-targeted. Description of problem: Sorry, same as last time I guess... Version-Release number of selected component: selinux-policy-3.14.1-32.fc28.noarch Additional info: reporter: libreport-2.9.5 hashmarkername: setroubleshoot kernel: 4.16.15-300.fc28.x86_64 type: libreport Description of problem: I think this might be connected to winbind - trying to get samba working, I started winbind, stopped it, and started it again over the course of a few hours - these bugs seemed to conincide with when it's running... Just a wild guess Version-Release number of selected component: selinux-policy-3.14.1-32.fc28.noarch Additional info: reporter: libreport-2.9.5 hashmarkername: setroubleshoot kernel: 4.16.15-300.fc28.x86_64 type: libreport Description of problem: Ditto last time, I'll turn winbind off and see if you hear from me again... Version-Release number of selected component: selinux-policy-3.14.1-32.fc28.noarch Additional info: reporter: libreport-2.9.5 hashmarkername: setroubleshoot kernel: 4.16.15-300.fc28.x86_64 type: libreport Description of problem: Fresh update from F27 to F28. Version-Release number of selected component: selinux-policy-3.14.1-32.fc28.noarch Additional info: reporter: libreport-2.9.5 hashmarkername: setroubleshoot kernel: 4.17.6-200.fc28.x86_64 type: libreport |