Bug 1775923
| Summary: | SELinux prevents confined user from running realm list | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Milos Malik <mmalik> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED WONTFIX | QA Contact: | Milos Malik <mmalik> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 8.2 | CC: | lvrabec, mmalik, plautrba, rmetrich, ssekidde, zpytela |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | 8.3 | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | No Doc Update | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-05-07 18:02:09 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1778780 | ||
*** Bug 1919129 has been marked as a duplicate of this bug. *** This bug has not been acknowledged by the subsystem to be resolved during in RHEL 8, hence closing. If you believe the decision needs to be reconsidered, please adjust severity accordingly and bring out justification. |
Description of problem: Version-Release number of selected component (if applicable): realmd-0.16.3-16.el8.x86_64 selinux-policy-3.14.3-27.el8.noarch selinux-policy-targeted-3.14.3-27.el8.noarch How reproducible: * always Steps to Reproduce: 1. get a RHEL-8.1 machine 2. log in as a confined user (user_u, staff_u, guest_u, xguest_u, sysadm_u) 3. run: realm list 4. search for SELinux denials Actual results: ---- type=USER_AVC msg=audit(11/23/2019 17:06:30.920:1064) : pid=1028 uid=dbus auid=unset ses=unset subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.DBus.Properties member=GetAll dest=:1.1806 spid=22201 tpid=22204 scontext=sysadm_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:realmd_t:s0 tclass=dbus permissive=0 exe=/usr/bin/dbus-daemon sauid=dbus hostname=? addr=? terminal=?' ---- type=USER_AVC msg=audit(11/23/2019 17:06:30.921:1065) : pid=1028 uid=dbus auid=unset ses=unset subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.DBus.ObjectManager member=GetManagedObjects dest=:1.1806 spid=22201 tpid=22204 scontext=sysadm_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:realmd_t:s0 tclass=dbus permissive=0 exe=/usr/bin/dbus-daemon sauid=dbus hostname=? addr=? terminal=?' ---- Expected results: * no SELinux denials