Bug 1853432

This bug was initially created as a copy of Bug #1845596

The purpose of this bug is to track delivery of selinux-policy fix to oddjob selinux policy module.



The core of the issue is an AVC that is marked as don't audit in SELinux policy.

When starting the helper to retrieve information about trusted domains, oddjobd uses `execve()` function.
It looks like in RHEL 8.3 and Fedora 32 its processing on a transition between oddjob_t and ipa_helper_t SELinux domains breaks something in underlying libraries loaded by the IPA helper. The helper written in Python and uses bindings to Samba which also internally load libkrb5.

With disabled dontaudit SELinux rules we see following AVCs:

type=AVC msg=audit(1593698019.970:2915): avc:  denied  { noatsecure } for  pid=33476 comm="oddjobd" scontext=system_u:system_r:oddjob_t:s0-s0:c0.c1023 tcontext=system_u:system_r:ipa_helper_t:s0 tclass=process permissive=1
type=AVC msg=audit(1593698019.971:2916): avc:  denied  { rlimitinh } for  pid=33476 comm="com.redhat.idm." scontext=system_u:system_r:oddjob_t:s0-s0:c0.c1023 tcontext=system_u:system_r:ipa_helper_t:s0 tclass=process permissive=1
type=AVC msg=audit(1593698019.971:2917): avc:  denied  { siginh } for  pid=33476 comm="com.redhat.idm." scontext=system_u:system_r:oddjob_t:s0-s0:c0.c1023 tcontext=system_u:system_r:ipa_helper_t:s0 tclass=process permissive=1
type=AVC msg=audit(1593698022.000:2918): avc:  denied  { read } for  pid=33479 comm="ipa-getkeytab" name="config" dev="vda1" ino=156614 scontext=system_u:system_r:ipa_helper_t:s0 tcontext=system_u:object_r:selinux_config_t:s0 tclass=file permissive=1
type=AVC msg=audit(1593698022.001:2919): avc:  denied  { open } for  pid=33479 comm="ipa-getkeytab" path="/etc/selinux/config" dev="vda1" ino=156614 scontext=system_u:system_r:ipa_helper_t:s0 tcontext=system_u:object_r:selinux_config_t:s0 tclass=file permissive=1
type=AVC msg=audit(1593698022.001:2920): avc:  denied  { getattr } for  pid=33479 comm="ipa-getkeytab" path="/etc/selinux/config" dev="vda1" ino=156614 scontext=system_u:system_r:ipa_helper_t:s0 tcontext=system_u:object_r:selinux_config_t:s0 tclass=file permissive=1
Out of these, rlimitinh and siginh can be ignored but noatsecure denial is important. If it is allowed, the helper successfully does it work. If it is denied, Samba Python bindings could not properly initialize Kerberos principal from the current credentials cache. It should be a trusted domain object's principal from an Active Directory domain's realm but it is initialized as a principal from IPA's own realm. The difference might be subtle but the consequence is that the helper would request a cross-realm referral to Active Directory domain, effectively asking for an outgoing trust leg. However, this trust leg will not exist for a one-way trust and the whole processing will fail.

Once noatsecure was allowed, libkrb5 was able to import the Kerberos principal with Active Directory domain's realm and avoid asking for a cross-realm referral. Instead, it talked directly to AD DCs, avoiding the whole problem.

To fix this, we need two changes:

1. An extension of IPA SELinux policy: https://github.com/freeipa/freeipa/pull/4882

2. Use of IPA SElinux policy interface in oddjob SELinux policy: https://github.com/fedora-selinux/selinux-policy-contrib/pull/293