Bug 1740642
| Summary: | avc denied for sssd_be while searching kerberos keytab krb5_keytab_t | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | shridhar <sgadekar> |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
| Status: | CLOSED DUPLICATE | QA Contact: | BaseOS QE Security Team <qe-baseos-security> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 8.1 | CC: | lvrabec, mmalik, plautrba, ssekidde, zpytela |
| Target Milestone: | rc | ||
| Target Release: | 8.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-08-13 16:51:08 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
*** This bug has been marked as a duplicate of bug 1730144 *** |
Description of problem: SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: enforcing Mode from config file: enforcing Policy MLS status: enabled Policy deny_unknown status: allowed Memory protection checking: actual (secure) Max kernel policy version: 31 selinux-policy-3.14.3-13.el8.noarch ---- time->Tue Aug 13 02:19:39 2019 type=PROCTITLE msg=audit(1565642979.739:550): proctitle=2F7573722F6C6962657865632F737373642F737373645F6265002D2D646F6D61696E0061642E626173656F732E7165002D2D7569640030002D2D6769640030002D2D6C6F676765723D66696C6573 type=SYSCALL msg=audit(1565642979.739:550): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=5633a4ec57e0 a2=0 a3=0 items=0 ppid=11801 pid=11804 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sssd_be" exe="/usr/libexec/sssd/sssd_be" subj=system_u:system_r:sssd_t:s0 key=(null) type=AVC msg=audit(1565642979.739:550): avc: denied { search } for pid=11804 comm="sssd_be" name="krb5" dev="dm-0" ino=33723500 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:krb5_keytab_t:s0 tclass=dir permissive=0 ---- time->Tue Aug 13 02:19:47 2019 type=PROCTITLE msg=audit(1565642987.275:554): proctitle=2F7573722F62696E2F6E73757064617465002D67 type=SYSCALL msg=audit(1565642987.275:554): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7efda0200db0 a2=0 a3=0 items=0 ppid=11804 pid=11876 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="isc-worker0000" exe="/usr/bin/nsupdate" subj=system_u:system_r:sssd_t:s0 key=(null) type=AVC msg=audit(1565642987.275:554): avc: denied { search } for pid=11876 comm="isc-worker0000" name="krb5" dev="dm-0" ino=33723500 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:krb5_keytab_t:s0 tclass=dir permissive=0 ---- time->Tue Aug 13 02:19:50 2019 type=PROCTITLE msg=audit(1565642990.141:558): proctitle=2F7573722F62696E2F6E73757064617465002D67 type=SYSCALL msg=audit(1565642990.141:558): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7efda0201d00 a2=0 a3=0 items=0 ppid=11804 pid=11876 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="isc-worker0000" exe="/usr/bin/nsupdate" subj=system_u:system_r:sssd_t:s0 key=(null) type=AVC msg=audit(1565642990.141:558): avc: denied { search } for pid=11876 comm="isc-worker0000" name="krb5" dev="dm-0" ino=33723500 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:krb5_keytab_t:s0 tclass=dir permissive=0 ---- time->Tue Aug 13 02:19:52 2019 type=PROCTITLE msg=audit(1565642992.178:559): proctitle=2F7573722F62696E2F6E73757064617465002D67 type=SYSCALL msg=audit(1565642992.178:559): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7f76cc2005c0 a2=0 a3=0 items=0 ppid=11804 pid=11922 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="isc-worker0000" exe="/usr/bin/nsupdate" subj=system_u:system_r:sssd_t:s0 key=(null) type=AVC msg=audit(1565642992.178:559): avc: denied { search } for pid=11922 comm="isc-worker0000" name="krb5" dev="dm-0" ino=33723500 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:krb5_keytab_t:s0 tclass=dir permissive=0 ---- time->Tue Aug 13 02:19:54 2019 type=PROCTITLE msg=audit(1565642994.187:560): proctitle=2F7573722F62696E2F6E73757064617465002D67 type=SYSCALL msg=audit(1565642994.187:560): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7f76cc2018d0 a2=0 a3=0 items=0 ppid=11804 pid=11922 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="isc-worker0000" exe="/usr/bin/nsupdate" subj=system_u:system_r:sssd_t:s0 key=(null) type=AVC msg=audit(1565642994.187:560): avc: denied { search } for pid=11922 comm="isc-worker0000" name="krb5" dev="dm-0" ino=33723500 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:krb5_keytab_t:s0 tclass=dir permissive=0 Version-Release number of selected component (if applicable): selinux-policy-3.14.3-13.el8.noarch How reproducible: always Steps to Reproduce: 1. Running regression run for realmd https://beaker.engineering.redhat.com/recipes/7230022#task97643445 messages are at http://beaker-archive.host.prod.eng.bos.redhat.com/beaker-logs/2019/08/37243/3724304/7230022/97643445/448564820/avc.log 2. 3. Actual results: sssd_be is denied while searching for keytab Expected results: there should be no denial. Additional info: