Bug 1831732
| Summary: | AVC avc: denied { dac_override } for comm="ods-enforcerd | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Alexander Bokovoy <abokovoy> |
| Component: | opendnssec | Assignee: | François Cami <fcami> |
| Status: | CLOSED ERRATA | QA Contact: | ipa-qe <ipa-qe> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 8.3 | CC: | ssidhaye, twoerner |
| Target Milestone: | rc | Flags: | pm-rhel:
mirror+
|
| Target Release: | 8.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | opendnssec-2.1.6-2 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-11-04 02:50:41 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Alexander Bokovoy
2020-05-05 14:29:34 UTC
Test criteria: there should be no DAC override AVCs after installing RHEL IdM with DNSSEC master enabled. Build used for verification
ipa-client-4.8.7-8.module+el8.3.0+7513+a375844a.x86_64
ipa-client-common-4.8.7-8.module+el8.3.0+7513+a375844a.noarch
ipa-common-4.8.7-8.module+el8.3.0+7513+a375844a.noarch
ipa-healthcheck-core-0.4-4.module+el8.2.0+5489+95477d9f.noarch
ipa-selinux-4.8.7-8.module+el8.3.0+7513+a375844a.noarch
ipa-server-4.8.7-8.module+el8.3.0+7513+a375844a.x86_64
ipa-server-common-4.8.7-8.module+el8.3.0+7513+a375844a.noarch
ipa-server-dns-4.8.7-8.module+el8.3.0+7513+a375844a.noarch
ipa-server-trust-ad-4.8.7-8.module+el8.3.0+7513+a375844a.x86_64
opendnssec-2.1.6-2.module+el8.3.0+6580+328a3362.x86_64
============================= test session starts ==============================
platform linux -- Python 3.6.8, pytest-3.10.1, py-1.9.0, pluggy-0.13.1 -- /usr/libexec/platform-python
cachedir: /home/cloud-user/.pytest_cache
metadata: {'Python': '3.6.8', 'Platform': 'Linux-4.18.0-232.el8.x86_64-x86_64-with-redhat-8.3-Ootpa', 'Packages': {'pytest': '3.10.1', 'py': '1.9.0', 'pluggy': '0.13.1'}, 'Plugins': {'metadata': '1.10.0', 'html': '1.22.1', 'multihost': '3.0', 'sourceorder': '0.5'}}
rootdir: /usr/lib/python3.6/site-packages/ipatests, inifile:
plugins: metadata-1.10.0, html-1.22.1, multihost-3.0, sourceorder-0.5
collecting ... collected 11 items
test_integration/test_dnssec.py::TestInstallDNSSECLast::test_install_dnssec_master PASSED [ 9%]
test_integration/test_dnssec.py::TestInstallDNSSECLast::test_if_zone_is_signed_master PASSED [ 18%]
test_integration/test_dnssec.py::TestInstallDNSSECLast::test_if_zone_is_signed_replica PASSED [ 27%]
test_integration/test_dnssec.py::TestInstallDNSSECLast::test_disable_reenable_signing_master PASSED [ 36%]
test_integration/test_dnssec.py::TestInstallDNSSECLast::test_disable_reenable_signing_replica PASSED [ 45%]
test_integration/test_dnssec.py::TestInstallDNSSECFirst::test_sign_root_zone PASSED [ 54%]
test_integration/test_dnssec.py::TestInstallDNSSECFirst::test_chain_of_trust xfail [ 63%]
test_integration/test_dnssec.py::TestInstallDNSSECFirst::test_resolvconf PASSED [ 72%]
test_integration/test_dnssec.py::TestMigrateDNSSECMaster::test_migrate_dnssec_master PASSED [ 81%]
test_integration/test_dnssec.py::TestInstallNoDnssecValidation::test_install_withDnssecValidation PASSED [ 90%]
test_integration/test_dnssec.py::TestInstallNoDnssecValidation::test_install_noDnssecValidation PASSED [100%]
---------------- generated xml file: /home/cloud-user/junit.xml ----------------
----------- generated html file: file:///home/cloud-user/report.html -----------
=========================== short test summary info ============================
XFAIL test_integration/test_dnssec.py::TestInstallDNSSECFirst::()::test_chain_of_trust
dnspython issue 343
=================== 10 passed, 1 xfailed in 4303.77 seconds ====================
No dac_override AVCs were seen on master and replicas
[root@master ~]# systemctl show ods-enforcerd.service -p User
User=ods
[root@master ~]# ausearch -m AVC | grep 'dac_override'
[root@master ~]#
[root@replica1 ~]# ausearch -m AVC | grep 'dac_override'
[root@replica1 ~]#
[root@replica1 ~]#
[root@replica1 ~]# systemctl show ods-enforcerd.service -p User
User=ods
[root@replica1 ~]#
[root@replica2 ~]# ausearch -m AVC | grep 'dac_override'
[root@replica2 ~]#
[root@replica2 ~]# systemctl show ods-enforcerd.service -p User
User=ods
[root@replica2 ~]#
Based on above observations marking Bugzilla verified
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2020:4670 |