Bug 1950267
| Summary: | Allow unconfined_service_t confidentiality and integrity lockdown permissions | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Zdenek Pytela <zpytela> | ||||
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> | ||||
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Milos Malik <mmalik> | ||||
| Severity: | high | Docs Contact: | |||||
| Priority: | high | ||||||
| Version: | 9.0 | CC: | bgoncalv, bugproxy, hkrzesin, honli, jkaluza, jwboyer, lvrabec, mmalik, omosnace, plautrba, ssekidde, than, zpytela | ||||
| Target Milestone: | beta | Keywords: | Triaged | ||||
| Target Release: | 9.0 Beta | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | No Doc Update | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | 1945581 | Environment: | |||||
| Last Closed: | 2021-12-07 21:35:16 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | 1945581 | ||||||
| Bug Blocks: | 1939095 | ||||||
| Attachments: |
|
||||||
|
Description
Zdenek Pytela
2021-04-16 09:21:01 UTC
I've submitted a Fedora PR to address the issue: https://github.com/fedora-selinux/selinux-policy/pull/696 Merged in rawhide:
commit a34ebcf284186001f7ef360f6a8d57c3773fed05 (HEAD -> rawhide, upstream/rawhide)
Author: Zdenek Pytela <zpytela>
Date: Fri Apr 16 15:45:38 2021 +0200
Allow unconfined_service_t confidentiality and integrity lockdown
Allow unconfined_service_t the confidentiality and integrity lockdown
permissions. Currently, the permissions are allowed for unconfined_t,
but not for the unconfined_service_t domain with similar behaviour
expectations, so this change is merely for the sake of consistency.
*** Bug 1957490 has been marked as a duplicate of this bug. *** ------- Comment From cdeadmin.com 2021-05-06 08:35 EDT------- <Note by ravikiran, 2021/05/06 07:23:48 seq: 17 rel: 0 action: assign> ------- Comment From Geetika.Moolchandani1 2021-05-26 03:02 EDT------- > Hi, > The required permissions will be added to the policy. We cannot, however, > confirm the scenario in this bz description works and no other denials are > triggered. Could you insert a local policy module and verify it? > # cat local_lockdown.cil > (allow unconfined_service_t unconfined_service_t (lockdown (confidentiality > integrity))) > # semodule -i local_lockdown.cil > <run the tests> > > # semodule -r local_lockdown Following the above comment, here's what I tried. 1. Check Initial Status [root@ltcfleet8-lp6 ~]# firewall-cmd --stat not running [root@ltcfleet8-lp6 ~]# sestatus SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: enforcing Mode from config file: enforcing Policy MLS status: enabled Policy deny_unknown status: allowed Memory protection checking: actual (secure) Max kernel policy version: 33 [root@ltcfleet8-lp6 ~]# lssrc -a Subsystem Group PID Status ctrmc rsct 1275 active IBM.MgmtDomainRM rsct_rm 1400 active IBM.HostRM rsct_rm 1462 active IBM.ServiceRM rsct_rm 1502 active IBM.DRM rsct_rm 1552 active ctcas rsct inoperative IBM.ERRM rsct_rm inoperative IBM.AuditRM rsct_rm inoperative IBM.SensorRM rsct_rm inoperative Check RMC connection from HMC : inactive hscroot@ltchmcv4:~> lssyscfg -r lpar -m ltcfleet8 -F name,rmc_state,rmc_ipaddr,rmc_osshutdown_capable,dlpar_mem_capable,dlpar_proc_capable,dlpar_io_capable ltcfleet8-lp6,none,,0,0,0,0 2. Modifying local policy [root@ltcfleet8-lp6 ~]# vi local_lockdown.cil [root@ltcfleet8-lp6 ~]# cat local_lockdown.cil (allow unconfined_service_t unconfined_service_t (lockdown (confidentiality integrity))) [root@ltcfleet8-lp6 ~]# semodule -i local_lockdown.cil ----<dmesg>---- [ 407.965076] SELinux: policy capability network_peer_controls=1 [ 407.965085] SELinux: policy capability open_perms=1 [ 407.965089] SELinux: policy capability extended_socket_class=1 [ 407.965094] SELinux: policy capability always_check_network=0 [ 407.965098] SELinux: policy capability cgroup_seclabel=1 [ 407.965102] SELinux: policy capability nnp_nosuid_transition=1 [ 407.965106] SELinux: policy capability genfs_seclabel_symlinks=0 -----<dmesg>---- [root@ltcfleet8-lp6 ~]# sestatus SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: enforcing Mode from config file: enforcing Policy MLS status: enabled Policy deny_unknown status: allowed Memory protection checking: actual (secure) Max kernel policy version: 33 [root@ltcfleet8-lp6 ~]# 3. Check RMC connection status : still inactive. hscroot@ltchmcv4:~> lssyscfg -r lpar -m ltcfleet8 -F name,rmc_state,rmc_ipaddr,rmc_osshutdown_capable,dlpar_mem_capable,dlpar_proc_capable,dlpar_io_capable ltcfleet8-lp6,none,,0,0,0,0 The above seems to make no difference, the RMC connection remains inactive. ------- Comment From kalshett.com 2021-05-26 03:08 EDT------- (In reply to comment #27) > This issue has already been resolved in selinux-policy-34.1.2-1.el9.noarch. > > IBM people: please update to this package version or use the custom policy > module from #c6 to verify your issue is gone. > > *** This bug has been marked as a duplicate of bug 1950267 *** As per the last comment from Geetika ii.e comment 29 , the custom policy did not work. So can you provide "selinux-policy-34.1.2-1.el9.noarch" package for test team to try? Created attachment 1787109 [details]
sosreport
------- Comment From kalshett.com 2021-08-11 04:19 EDT------- Base on comment #34, it is working fine with RHEL-9.0 Beta builds, hence closing. ------- Comment From cdeadmin.com 2022-11-01 10:13 EDT------- cde00 (cdeadmin.com) added native attachment /tmp/AIXOS13381983/sosreport-ltcden13-lp4-2021-04-20-ldzmrel.tar.xz on 2022-11-01 09:13:25 |