Bug 1660116
| Summary: | oddjob-mkhomedir fails to create home dir when executed from cron daemon | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Renaud Métrich <rmetrich> |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
| Status: | CLOSED WONTFIX | QA Contact: | Milos Malik <mmalik> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 7.6 | CC: | lvrabec, mgrepl, mkolbas, mmalik, plautrba, ssekidde, vmojzis, zpytela |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-02-28 19:04:16 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
This issue was not selected to be included in Red Hat Enterprise Linux 7.7 because it is seen either as low or moderate impact to a small number of use-cases. The next release will be in Maintenance Support 1 Phase, which means that qualified Critical and Important Security errata advisories (RHSAs) and Urgent Priority Bug Fix errata advisories (RHBAs) may be released as they become available. We will now close this issue, but if you believe that it qualifies for the Maintenance Support 1 Phase, please re-open; otherwise, we recommend moving the request to Red Hat Enterprise Linux 8 if applicable. |
Description of problem: When oddjob-mkhomedir is executed from the cron daemon, it fails to create the user's home directory. The following AVC and USER_AVC are seen: -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- type=USER_AVC msg=audit(1545054661.514:262): pid=612 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=error error_name=com.redhat.oddjob.Error.Exec dest=:1.37 spid=26993 tpid=26994 scontext=system_u:system_r:oddjob_t:s0-s0:c0.c1023 tcontext=system_u:system_r:crond_t:s0-s0:c0.c1023 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- type=PROCTITLE msg=audit(1545054661.511:261): proctitle=2F7573722F7362696E2F6F64646A6F6264002D6E002D70002F7661722F72756E2F6F64646A6F62642E706964002D7400333030 type=SYSCALL msg=audit(1545054661.511:261): arch=c000003e syscall=59 success=no exit=-13 a0=55fb5d3800a0 a1=55fb5d381b90 a2=55fb5d390340 a3=3a30732d30733a74 items=0 ppid=26993 pid=26996 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="oddjobd" exe="/usr/sbin/oddjobd" subj=system_u:system_r:oddjob_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1545054661.511:261): avc: denied { transition } for pid=26996 comm="oddjobd" path="/usr/libexec/oddjob/mkhomedir" dev="dm-0" ino=8703477 scontext=system_u:system_r:oddjob_t:s0-s0:c0.c1023 tcontext=system_u:system_r:crond_t:s0-s0:c0.c1023 tclass=process -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- audit2allow proposes to add the following and prints an odd message related to mislabeling: -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- #============= oddjob_t ============== allow oddjob_t crond_t:dbus send_msg; #!!!! The file '/usr/libexec/oddjob/mkhomedir' is mislabeled on your system. #!!!! Fix with $ restorecon -R -v /usr/libexec/oddjob/mkhomedir allow oddjob_t crond_t:process transition; -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- If I add the latter to a custom policy, then oddjob will continue to fail with the following AVC: -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- type=PROCTITLE msg=audit(1545056341.770:510): proctitle=2F7573722F7362696E2F6F64646A6F6264002D6E002D70002F7661722F72756E2F6F64646A6F62642E706964002D7400333030 type=SYSCALL msg=audit(1545056341.770:510): arch=c000003e syscall=59 success=no exit=-13 a0=55fb5d3800a0 a1=55fb5d38d680 a2=55fb5d38a770 a3=3a30732d30733a74 items=0 ppid=26993 pid=29759 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="oddjobd" exe="/usr/sbin/oddjobd" subj=system_u:system_r:oddjob_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1545056341.770:510): avc: denied { entrypoint } for pid=29759 comm="oddjobd" path="/usr/libexec/oddjob/mkhomedir" dev="dm-0" ino=8703477 scontext=system_u:system_r:crond_t:s0-s0:c0.c1023 tcontext=system_u:object_r:oddjob_mkhomedir_exec_t:s0 tclass=file -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- Version-Release number of selected component (if applicable): selinux-policy-3.13.1-192.el7_5.7.noarch and selinux-policy-3.13.1-229.el7_6.6.100.noarch How reproducible: Always Steps to Reproduce: 1. Install and enable oddjob-mkhomedir yum -y install oddjob-mkhomedir authconfig --update --enablemkhomedir 2. Create a user without home dir useradd -M renaud 3. Add a cron entry to the user crontab -u renaud -e <vi opens> * * * * * ls -l 4. Wait for 1 minute and check audit Actual results: - AVC + USER_AVC - no /home/renaud created Expected results: - /home/renaud created Additional info: Doesn't happen on RHEL8