Bug 1647493
| Summary: | bind: denied { map } for named | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Petr Menšík <pemensik> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 31 | CC: | dwalsh, goeran, lvrabec, nknazeko, pemensik, plautrba |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-3.14.4-44.fc31 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-01-21 01:38:36 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
PR merged. This bug appears to have been reported against 'rawhide' during the Fedora 31 development cycle. Changing version to '31'. This bug appears to have been reported against 'rawhide' during the Fedora 31 development cycle. Changing version to 31. FEDORA-2019-ebfc4df1ad has been submitted as an update to Fedora 31. https://bodhi.fedoraproject.org/updates/FEDORA-2019-ebfc4df1ad selinux-policy-3.14.4-32.fc31 has been pushed to the Fedora 31 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-ebfc4df1ad FEDORA-2019-8169f4e6b7 has been submitted as an update to Fedora 31. https://bodhi.fedoraproject.org/updates/FEDORA-2019-8169f4e6b7 selinux-policy-3.14.4-33.fc31 has been pushed to the Fedora 31 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-8169f4e6b7 I see what I believe is the same problem with selinux-policy-3.14.4-39.fc31, a higher release number than the one sent to testing above. After upgrading to the latest _bind_, I get an error trying to start _named_:
dec 02 15:27:59 mimmi named[3105457]: mdb_env_open of 'localnet.nzd' failed: Permission denied
dec 02 15:27:59 mimmi named[3105457]: loading configuration: failure
dec 02 15:27:59 mimmi named[3105457]: exiting (due to fatal error)
If starting named in permissive mode, I get the same error when trying "rndc reload".
Adding a module with the following allow rule, I don't see any (immediate) issues any more.
allow named_t named_zone_t:file map;
commit 07b21cf3a9fc1f2872a401f94e762ba12e885c48 (HEAD -> rawhide)
Author: Lukas Vrabec <lvrabec>
Date: Tue Dec 3 12:38:51 2019 +0100
Allow named_t domain to mmap named_zone_t files BZ(1647493)
selinux-policy-3.14.4-44.fc31 has been pushed to the Fedora 31 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2020-397eea28b7 selinux-policy-3.14.4-44.fc31 has been pushed to the Fedora 31 stable repository. If problems still persist, please make note of it in this bug report. |
Description of problem: I was playing with different types of zone files, I found memory mapping is not allowed to bind. Even if it is not default, it should be possible. Version-Release number of selected component (if applicable): selinux-policy-3.14.1-40.fc28.noarch bind-9.11.4-10.P2.fc28.x86_64 How reproducible: always Steps to Reproduce: 1. dnf install bind bind-utils 2. named-compilezone -F map -o /var/named/dynamic/named.map test /var/named/named.empty 3. Append into /etc/named.conf: zone "test" IN { type master; file "dynamic/named.map"; masterfile-format map; }; 4. systemctl restart named Actual results: failed. $ ausearch -ts recent -i -sv no type=AVC msg=audit(7.11.2018 10:17:01.705:372) : avc: denied { map } for pid=2005 comm=named-checkconf path=/var/named/dynamic/named.map dev="vda1" ino=264015 scontext=system_u:system_r:named_t:s0 tcontext=unconfined_u:object_r:named_cache_t:s0 tclass=file permissive=0 Expected results: success, no AVC denials Additional info: I would like to add support of lmdb into named by default. It is memory-mapped database that is used by default. If it is enabled, service will not even start with default configuration, because it uses memory mapping by default. both named_zone_t and named_cache_t types should be able to map into memory for faster access.