Bug 1671514
| Summary: | Since nis_enabled is not turned on by default, it breaks deployments with custom service ports | |||
|---|---|---|---|---|
| Product: | Red Hat OpenStack | Reporter: | David Vallee Delisle <dvd> | |
| Component: | openstack-selinux | Assignee: | Julie Pichon <jpichon> | |
| Status: | CLOSED ERRATA | QA Contact: | Julie Pichon <jpichon> | |
| Severity: | urgent | Docs Contact: | ||
| Priority: | urgent | |||
| Version: | 10.0 (Newton) | CC: | dvd, jpichon, lhh, mgrepl | |
| Target Milestone: | zstream | Keywords: | Triaged, ZStream | |
| Target Release: | 10.0 (Newton) | |||
| Hardware: | x86_64 | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | openstack-selinux-0.8.17-2.el7ost | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | 1489863 | |||
| : | 1676446 (view as bug list) | Environment: | ||
| Last Closed: | 2019-04-30 16:59:39 UTC | Type: | --- | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | 1489863 | |||
| Bug Blocks: | ||||
|
Description
David Vallee Delisle
2019-01-31 19:11:39 UTC
Hi, could you confirm which openstack-selinux RPM version is installed? Thank you. Also, it would be useful to run the command again with SELinux in permissive mode and provide the audit.log, in case there are other AVCs we need to make sure are cleared. Thank you.
They have: openstack-selinux-0.8.14-13.el7ost.noarch
[1] If that can help, here's the infringed policy.
This is a very specific use case where they use port 13357 for keystone because they followed our recommendation [2]
~~~
# sepolicy network -a /usr/bin/glance-registry
glance_registry_t: tcp name_connect
111 (portmap_port_t) -- Allowed True [ nis_enabled=1 ]
11211 (memcache_port_t)
113 (auth_port_t) -- Allowed True [ daemons_use_tcp_wrapper=0 || nis_enabled=1 ]
389, 636, 3268, 3269, 7389 (ldap_port_t) -- Allowed True [ nis_enabled=1 || authlogin_nsswitch_use_ldap=0 ]
4444, 1186, 3306, 63132-63164 (mysqld_port_t)
32768-61000 (ephemeral_port_t)
32768-61000 (ephemeral_port_t)
35357 (keystone_port_t)
5000 (commplex_main_port_t)
53 (dns_port_t)
80, 81, 443, 488, 8008, 8009, 8443, 9000 (http_port_t)
88, 750, 4444 (kerberos_port_t) -- Allowed True [ nis_enabled=1 || kerberos_enabled=1 ]
8955 (dnssec_port_t)
9080 (ocsp_port_t) -- Allowed True [ kerberos_enabled=1 ]
all ports < 1024 (reserved_port_type) -- Allowed True [ nis_enabled=1 ]
all ports with out defined types (port_t) -- Allowed True [ nis_enabled=1 ]
glance_registry_t: tcp name_bind
32768-61000 (ephemeral_port_t) -- Allowed True [ nis_enabled=1 ]
9191 (glance_registry_port_t)
all ports with out defined types (port_t) -- Allowed True [ nis_enabled=1 ]
glance_registry_t: udp name_bind
32768-61000 (ephemeral_port_t) -- Allowed True [ nis_enabled=1 ]
all ports with out defined types (port_t) -- Allowed True [ nis_enabled=1 ]
~~~
Thank you for the reply and additional information. After investigating further, it looks like the issue that caused the booleans to not get picked up in some contexts was resolved, so reenabling this one for now should be ok. https://github.com/redhat-openstack/openstack-selinux/commit/282e8a1e450703e7c9f78121c9b0d2e00228fb55 Sanity-check: $ rpm -q openstack-selinux openstack-selinux-0.8.18-1.el7ost.noarch $ ls /usr/share/openstack-selinux/0.8.18/tests/ | grep 1671514 bz1671514 $ sudo /usr/share/openstack-selinux/0.8.18/tests/check_all Results: 797 total, 0 failed Overall result: PASS Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:0922 |