Bug 1671644
| Summary: | SELinux is preventing pkla-check-auth from 'connectto' accesses on the unix_stream_socket /var/lib/sss/pipes/nss. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Sandro Bonazzola <sbonazzo> |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
| Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 29 | CC: | dwalsh, lvrabec, mgrepl, plautrba, zpytela |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:a8d0ece62026ecd1e70a97af073ea983ac433e6b9b8bda0ea5c5ffb7def82d50;VARIANT_ID=workstation; | ||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-02-01 10:12:22 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
*** This bug has been marked as a duplicate of bug 1401128 *** |
Description of problem: SELinux is preventing pkla-check-auth from 'connectto' accesses on the unix_stream_socket /var/lib/sss/pipes/nss. ***** Plugin catchall (100. confidence) suggests ************************** Se ci credi pkla-check-auth dovrebbe essere consentito connectto accesso al nss unix_stream_socket per impostazione predefinita. Then si dovrebbe riportare il problema come bug. E' possibile generare un modulo di politica locale per consentire questo accesso. Do consentire questo accesso per ora eseguendo: # ausearch -c 'pkla-check-auth'--raw | audit2allow -M my-$MODULE_NOME # semodule -X 300 -i miei-pklacheckauth.pp Additional Information: Source Context system_u:system_r:policykit_auth_t:s0 Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Target Objects /var/lib/sss/pipes/nss [ unix_stream_socket ] Source pkla-check-auth Source Path pkla-check-auth Port <Sconosciuto> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.14.2-47.fc29.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 4.20.5-200.fc29.x86_64 #1 SMP Mon Jan 28 19:29:17 UTC 2019 x86_64 x86_64 Alert Count 2 First Seen 2019-02-01 08:05:41 CET Last Seen 2019-02-01 08:10:51 CET Local ID 79fe6f31-c369-47af-b0dd-d7ea47733361 Raw Audit Messages type=AVC msg=audit(1549005051.319:351): avc: denied { connectto } for pid=13679 comm="pkla-check-auth" path="/var/lib/sss/pipes/nss" scontext=system_u:system_r:policykit_auth_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=1 Hash: pkla-check-auth,policykit_auth_t,unconfined_t,unix_stream_socket,connectto Version-Release number of selected component: selinux-policy-3.14.2-47.fc29.noarch Additional info: component: selinux-policy reporter: libreport-2.9.7 hashmarkername: setroubleshoot kernel: 4.20.5-200.fc29.x86_64 type: libreport Potential duplicate: bug 1401128