Bug 1848953
| Summary: | ssh auth failing with avc denial for krb5_0.rcache2 | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Kaleem <ksiddiqu> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | high | Docs Contact: | |
| Priority: | medium | ||
| Version: | 8.3 | CC: | abokovoy, fdvorak, lmiksik, lvrabec, mmalik, omoris, plautrba, rcritten, sorlov, ssekidde, twoerner, xifeng, zpytela |
| Target Milestone: | rc | Keywords: | AutoVerified, Regression, Triaged |
| Target Release: | 8.3 | Flags: | pm-rhel:
mirror+
|
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-11-04 01:56:46 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1842946 | ||
Kaleem, The krb5_0.rcache2 file has smbd_tmp_t type which does not seem to be correct. Do you know how this file was created? (In reply to Zdenek Pytela from comment #1) > Kaleem, > > The krb5_0.rcache2 file has smbd_tmp_t type which does not seem to be > correct. Do you know how this file was created? I think this is needed in case of trust scenario with windows but putting needinfo on Alexander for confirming this. I have seen this too. Well, if two daemons running under root use Kerberos, it is libkrb5 they use produces a replay cache in the same location. Who does it first, gets the label. May be we shouldn't apply the per-app type to this specific file? May be we should make a type that is allowed to both apps? This bug has not been acknowledged by the subsystem to be resolved during the RHEL 8.3 development and testing phase. If you believe the decision needs to be reconsidered, please adjust severity accordingly and bring out justification. Since this affects all RHEL IdM installations in the default configuration and wasn't a problem in RHEL 8.2, it is pretty much a regression and blocker from RHEL IdM point of view. We need to have this fixed before the issue gets to produce increase of customer cases. I've submitted a Fedora PR to address the issue: https://github.com/fedora-selinux/selinux-policy-contrib/pull/312 *** Bug 1857253 has been marked as a duplicate of this bug. *** *** Bug 1847221 has been marked as a duplicate of this bug. *** Zdenek, The scenario I mentioned in #26 is still failing. I see that smbd creates /var/tmp/krb5_0.rcache2 with type krb5_host_rcache_t but sshd still creates it with type user_tmp_t. # rpm -q selinux-policy selinux-policy-3.14.3-51.el8.noarch Here is my test: Setup: ===== hostnamectl set-hostname master.test.ipa dnf module reset idm -y dnf module enable -y idm:DL1/dns dnf install -y ipa-server-dns ipa-server-trust-ad samba-client systemctl stop firewalld ipa-server-install -a Secret123 -p Secret123 --setup-dns --auto-forwarders -n test.ipa -U -r TEST.IPA echo Secret123 | kinit admin ipa-adtrust-install -a Secret123 --add-sids -U mkdir /bz1073829 chcon -t samba_share_t /bz1073829 setfacl -m g:admins:rwx /bz1073829 net conf setparm 'share' 'comment' 'Trust test share' net conf setparm 'share' 'read only' 'no' net conf setparm 'share' 'path' '/bz1073829' Test1 (fails): ====== # rm /var/tmp/krb5_0.rcache2 -f # ssh admin@`hostname` whoami admin # ls -lZ /var/tmp/krb5_0.rcache2 -rw-------. 1 root root system_u:object_r:user_tmp_t:s0 3008 Aug 11 13:02 /var/tmp/krb5_0.rcache2 # smbclient -k //master.test.ipa/share -c dir lp_load_ex: changing to config backend registry gse_get_client_auth_token: gss_init_sec_context failed with [Unspecified GSS failure. Minor code may provide more information: Generic error (see e-text)](2529638972) gensec_spnego_client_negTokenTarg_step: SPNEGO(gse_krb5) login failed: NT_STATUS_LOGON_FAILURE session setup failed: NT_STATUS_LOGON_FAILURE Test2 (pass): ====== # rm /var/tmp/krb5_0.rcache2 -f # smbclient -k //master.test.ipa/share -c dir lp_load_ex: changing to config backend registry . D 0 Tue Aug 11 12:53:06 2020 .. D 0 Tue Aug 11 12:53:06 2020 20960236 blocks of size 1024. 18028512 blocks available # ls -lZ /var/tmp/krb5_0.rcache2 -rw-------. 1 root root system_u:object_r:krb5_host_rcache_t:s0 16032 Aug 11 13:05 /var/tmp/krb5_0.rcache2 # ssh admin@`hostname` whoami admin # ls -lZ /var/tmp/krb5_0.rcache2 -rw-------. 1 root root system_u:object_r:krb5_host_rcache_t:s0 16032 Aug 11 13:05 /var/tmp/krb5_0.rcache2 I do not see AVC failures after Test1, but if I disable dontaudit and repeat the test, I see this: time->Tue Aug 11 13:09:23 2020 type=PROCTITLE msg=audit(1597165763.137:1062): proctitle=2F7573722F7362696E2F736D6264002D2D666F726567726F756E64002D2D6E6F2D70726F636573732D67726F7570 type=SYSCALL msg=audit(1597165763.137:1062): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=55fdcbd0d010 a2=20042 a3=180 items=0 ppid=14373 pid=15255 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="smbd" exe="/usr/sbin/smbd" subj=system_u:system_r:smbd_t:s0 key=(null) type=AVC msg=audit(1597165763.137:1062): avc: denied { write } for pid=15255 comm="smbd" name="krb5_0.rcache2" dev="vda1" ino=582881 scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:user_tmp_t:s0 tclass=file permissive=0 If sshd can be the first to create the rcache file, then yes, this permission was missing. https://github.com/fedora-selinux/selinux-policy/pull/406 Sergey, do we have any test available to run before respin? Zdenek, You can use tests from #33, they cover two scenarios - when sshd creates keytab first and when smbd does the same. I just checked them and they do work on newlly provisione VM without any modifications. Just ignore "Could not chdir to home directory" in output of ssh command. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:4528 |
Description of problem: ssh auth with krb5 credentials fails and following avc denial seen. Same scenario works fine when selinux is put in permissive mode. snip from /var/log/secure Jun 19 06:48:41 master sshd[24487]: debug3: monitor_read: checking request 44 Jun 19 06:48:41 master sshd[24487]: debug1: Unspecified GSS failure. Minor code may provide more information\nPermission denied (filename: /var/tmp/krb5_0.rcache2)\n\n Jun 19 06:48:41 master sshd[24487]: debug1: Got no client credentials [root@dhcp107-3 ~]# ausearch -m avc ---- time->Fri Jun 19 06:48:41 2020 type=PROCTITLE msg=audit(1592563721.621:1796): proctitle=737368643A2061646D696E205B707269765D type=SYSCALL msg=audit(1592563721.621:1796): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=55a61a62f780 a2=20042 a3=180 items=0 ppid=23006 pid=24487 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1592563721.621:1796): avc: denied { write } for pid=24487 comm="sshd" name="krb5_0.rcache2" dev="vda3" ino=25190336 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:smbd_tmp_t:s0 tclass=file permissive=0 [root@dhcp107-3 ~]# avc: denied { write } for pid=24487 comm="sshd" name="krb5_0.rcache2" dev="vda3" ino=25190336 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:smbd_tmp_t:s0 tclass=file permissive=0 Version-Release number of selected component (if applicable): [root@dhcp107-3 ~]# rpm -q ipa-server selinux-policy ipa-server-4.8.7-2.module+el8.3.0+6996+12d13a13.x86_64 selinux-policy-3.14.3-45.el8.noarch [root@dhcp107-3 ~]# How reproducible: Always Steps to Reproduce: 1. Install IPA Server 2. Install IPA client 3. kinit admin on IPA client 4. ssh -k -l admin <IPA Server> Actual results: ssh fails and asks for password Expected results: ssh should be successful without asking password and should use krb5 ticket for auth purpose. Additional info: