Bug 2020531

Summary: SELinux denial appears when printing via lpd (cups-lpd)
Product: [Fedora] Fedora Reporter: Milos Malik <mmalik>
Component: selinux-policyAssignee: Zdenek Pytela <zpytela>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: 35CC: dwalsh, grepl.miroslav, lvrabec, mmalik, omosnace, pkoncity, vmojzis, zpytela
Target Milestone: ---Keywords: Triaged
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: selinux-policy-35.6-1.fc35 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 2039449 (view as bug list) Environment:
Last Closed: 2021-12-04 01:23:38 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2039449    

Description Milos Malik 2021-11-05 08:29:08 UTC
Description of problem:
 * the lpd prints the file successfully, but 1 SELinux denial appears

Version-Release number of selected component (if applicable):
cups-2.3.3op2-9.fc35.x86_64
cups-client-2.3.3op2-9.fc35.x86_64
cups-filesystem-2.3.3op2-9.fc35.noarch
cups-filters-1.28.10-1.fc35.x86_64
cups-filters-libs-1.28.10-1.fc35.x86_64
cups-ipptool-2.3.3op2-9.fc35.x86_64
cups-libs-2.3.3op2-9.fc35.x86_64
cups-lpd-2.3.3op2-9.fc35.x86_64
selinux-policy-35.5-1.fc35.noarch
selinux-policy-devel-35.5-1.fc35.noarch
selinux-policy-targeted-35.5-1.fc35.noarch

How reproducible:
 * always

Steps to Reproduce:
1. get a Fedora 35 machine (targeted policy is active)
2. # systemctl start cups.service
3. # systemctl enable cups-lpd.socket
4. # systemctl start cups-lpd.socket
5. # lpadmin -p test -o printer-is-shared=true -E
6. # DEVICE_URI=lpd://127.0.0.1/test /usr/lib/cups/backend/lpd 1 user test 1 '' /etc/fstab
7. search for SELinux denials

Actual results:
----
type=PROCTITLE msg=audit(11/05/2021 04:11:18.023:728) : proctitle=/usr/lib/cups/daemon/cups-lpd 
type=PATH msg=audit(11/05/2021 04:11:18.023:728) : item=0 name=/proc/1/environ nametype=UNKNOWN cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(11/05/2021 04:11:18.023:728) : cwd=/ 
type=SYSCALL msg=audit(11/05/2021 04:11:18.023:728) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=0xffffff9c a1=0x7ffc7f4b0f60 a2=O_RDONLY|O_CLOEXEC a3=0x0 items=1 ppid=1 pid=16668 auid=unset uid=lp gid=lp euid=lp suid=lp fsuid=lp egid=lp sgid=lp fsgid=lp tty=(none) ses=unset comm=cups-lpd exe=/usr/lib/cups/daemon/cups-lpd subj=system_u:system_r:cupsd_lpd_t:s0 key=(null) 
type=AVC msg=audit(11/05/2021 04:11:18.023:728) : avc:  denied  { search } for  pid=16668 comm=cups-lpd name=1 dev="proc" ino=13409 scontext=system_u:system_r:cupsd_lpd_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=dir permissive=0 
----

Expected results:
 * no SELinux denials

Comment 1 Milos Malik 2021-11-05 08:31:52 UTC
The same SELinux denial appears in permissive mode:
----
type=PROCTITLE msg=audit(11/05/2021 04:30:31.873:931) : proctitle=/usr/lib/cups/daemon/cups-lpd 
type=PATH msg=audit(11/05/2021 04:30:31.873:931) : item=0 name=/proc/1/environ inode=13550 dev=00:16 mode=file,400 ouid=root ogid=root rdev=00:00 obj=system_u:system_r:init_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(11/05/2021 04:30:31.873:931) : cwd=/ 
type=SYSCALL msg=audit(11/05/2021 04:30:31.873:931) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=0xffffff9c a1=0x7ffd27408890 a2=O_RDONLY|O_CLOEXEC a3=0x0 items=1 ppid=1 pid=17628 auid=unset uid=lp gid=lp euid=lp suid=lp fsuid=lp egid=lp sgid=lp fsgid=lp tty=(none) ses=unset comm=cups-lpd exe=/usr/lib/cups/daemon/cups-lpd subj=system_u:system_r:cupsd_lpd_t:s0 key=(null) 
type=AVC msg=audit(11/05/2021 04:30:31.873:931) : avc:  denied  { search } for  pid=17628 comm=cups-lpd name=1 dev="proc" ino=13409 scontext=system_u:system_r:cupsd_lpd_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=dir permissive=1 
----

Comment 6 Zdenek Pytela 2021-11-05 16:23:36 UTC
I've undrafted the existing PR:
https://github.com/fedora-selinux/selinux-policy/pull/773

which should be sufficient because:
# sesearch --dontaudit -s daemon -t init_t -ds
dontaudit daemon init_t:dir { getattr open search };
dontaudit daemon init_t:fd use;
dontaudit daemon init_t:file { getattr ioctl lock open read };

Comment 7 Fedora Update System 2021-11-29 16:03:27 UTC
FEDORA-2021-ea3fa543f0 has been submitted as an update to Fedora 35. https://bodhi.fedoraproject.org/updates/FEDORA-2021-ea3fa543f0

Comment 8 Fedora Update System 2021-11-30 02:19:04 UTC
FEDORA-2021-ea3fa543f0 has been pushed to the Fedora 35 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2021-ea3fa543f0`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2021-ea3fa543f0

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 9 Fedora Update System 2021-12-04 01:23:38 UTC
FEDORA-2021-ea3fa543f0 has been pushed to the Fedora 35 stable repository.
If problem still persists, please make note of it in this bug report.