Bug 2039449

rhel9# seinfo -xt cupsd_lpd_t

Types: 1
   type cupsd_lpd_t, nsswitch_domain, corenet_unlabeled_type, domain, kernel_system_state_reader, netlabel_peer_type, cups_domain, syslog_client_type, pcmcia_typeattr_1;

f35# seinfo -xt cupsd_lpd_t

Types: 1
   type cupsd_lpd_t, nsswitch_domain, corenet_unlabeled_type, domain, kernel_system_state_reader, netlabel_peer_type, cups_domain, daemon, syslog_client_type, pcmcia_typeattr_1;

+++ This bug was initially created as a clone of Bug #2020531 +++

Description of problem:
 * the lpd prints the file successfully, but 1 SELinux denial appears

Version-Release number of selected component (if applicable):
cups-2.3.3op2-9.fc35.x86_64
cups-client-2.3.3op2-9.fc35.x86_64
cups-filesystem-2.3.3op2-9.fc35.noarch
cups-filters-1.28.10-1.fc35.x86_64
cups-filters-libs-1.28.10-1.fc35.x86_64
cups-ipptool-2.3.3op2-9.fc35.x86_64
cups-libs-2.3.3op2-9.fc35.x86_64
cups-lpd-2.3.3op2-9.fc35.x86_64
selinux-policy-35.5-1.fc35.noarch
selinux-policy-devel-35.5-1.fc35.noarch
selinux-policy-targeted-35.5-1.fc35.noarch

How reproducible:
 * always

Steps to Reproduce:
1. get a Fedora 35 machine (targeted policy is active)
2. # systemctl start cups.service
3. # systemctl enable cups-lpd.socket
4. # systemctl start cups-lpd.socket
5. # lpadmin -p test -o printer-is-shared=true -E
6. # DEVICE_URI=lpd://127.0.0.1/test /usr/lib/cups/backend/lpd 1 user test 1 '' /etc/fstab
7. search for SELinux denials

Actual results:
----
type=PROCTITLE msg=audit(11/05/2021 04:11:18.023:728) : proctitle=/usr/lib/cups/daemon/cups-lpd 
type=PATH msg=audit(11/05/2021 04:11:18.023:728) : item=0 name=/proc/1/environ nametype=UNKNOWN cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(11/05/2021 04:11:18.023:728) : cwd=/ 
type=SYSCALL msg=audit(11/05/2021 04:11:18.023:728) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=0xffffff9c a1=0x7ffc7f4b0f60 a2=O_RDONLY|O_CLOEXEC a3=0x0 items=1 ppid=1 pid=16668 auid=unset uid=lp gid=lp euid=lp suid=lp fsuid=lp egid=lp sgid=lp fsgid=lp tty=(none) ses=unset comm=cups-lpd exe=/usr/lib/cups/daemon/cups-lpd subj=system_u:system_r:cupsd_lpd_t:s0 key=(null) 
type=AVC msg=audit(11/05/2021 04:11:18.023:728) : avc:  denied  { search } for  pid=16668 comm=cups-lpd name=1 dev="proc" ino=13409 scontext=system_u:system_r:cupsd_lpd_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=dir permissive=0 
----

Expected results:
 * no SELinux denials

--- Additional comment from Milos Malik on 2021-11-05 09:31:52 CET ---

The same SELinux denial appears in permissive mode:
----
type=PROCTITLE msg=audit(11/05/2021 04:30:31.873:931) : proctitle=/usr/lib/cups/daemon/cups-lpd 
type=PATH msg=audit(11/05/2021 04:30:31.873:931) : item=0 name=/proc/1/environ inode=13550 dev=00:16 mode=file,400 ouid=root ogid=root rdev=00:00 obj=system_u:system_r:init_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(11/05/2021 04:30:31.873:931) : cwd=/ 
type=SYSCALL msg=audit(11/05/2021 04:30:31.873:931) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=0xffffff9c a1=0x7ffd27408890 a2=O_RDONLY|O_CLOEXEC a3=0x0 items=1 ppid=1 pid=17628 auid=unset uid=lp gid=lp euid=lp suid=lp fsuid=lp egid=lp sgid=lp fsgid=lp tty=(none) ses=unset comm=cups-lpd exe=/usr/lib/cups/daemon/cups-lpd subj=system_u:system_r:cupsd_lpd_t:s0 key=(null) 
type=AVC msg=audit(11/05/2021 04:30:31.873:931) : avc:  denied  { search } for  pid=17628 comm=cups-lpd name=1 dev="proc" ino=13409 scontext=system_u:system_r:cupsd_lpd_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=dir permissive=1 
----

--- Additional comment from Milos Malik on 2021-11-05 09:32:45 CET ---

The following automated TC found the issue:
 * /CoreOS/selinux-policy/Regression/cups-lpd-and-similar

--- Additional comment from Zdenek Pytela on 2021-11-05 09:50:40 CET ---

I made an attempt to address the issue some time ago:
https://github.com/fedora-selinux/selinux-policy/pull/773

but eventually made it draft and I cannot figure out why, it seems to be correct to change

init_domain:
##	Create a domain which can be started by init.

to

init_daemon_domain:
##	Create a domain for long running processes
##	(daemons/services) which are started by init scripts.

--- Additional comment from Milos Malik on 2021-11-05 15:04:06 CET ---

Test coverage for this bug exists in a form of PR:
 * https://src.osci.redhat.com/tests/selinux-policy/pull-request/354

The PR waits for review.

--- Additional comment from Milos Malik on 2021-11-05 15:08:58 CET ---

The same bug is reproducible on RHEL-9.0.

--- Additional comment from Zdenek Pytela on 2021-11-05 17:23:36 CET ---

I've undrafted the existing PR:
https://github.com/fedora-selinux/selinux-policy/pull/773

which should be sufficient because:
# sesearch --dontaudit -s daemon -t init_t -ds
dontaudit daemon init_t:dir { getattr open search };
dontaudit daemon init_t:fd use;
dontaudit daemon init_t:file { getattr ioctl lock open read };

--- Additional comment from Fedora Update System on 2021-11-29 17:03:27 CET ---

FEDORA-2021-ea3fa543f0 has been submitted as an update to Fedora 35. https://bodhi.fedoraproject.org/updates/FEDORA-2021-ea3fa543f0

--- Additional comment from Fedora Update System on 2021-11-30 03:19:04 CET ---

FEDORA-2021-ea3fa543f0 has been pushed to the Fedora 35 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2021-ea3fa543f0`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2021-ea3fa543f0

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

--- Additional comment from Fedora Update System on 2021-12-04 02:23:38 CET ---

FEDORA-2021-ea3fa543f0 has been pushed to the Fedora 35 stable repository.
If problem still persists, please make note of it in this bug report.