Bug 2131828
| Summary: | RHDS SNMP agent fails to start with selinux SELinux errors | ||
|---|---|---|---|
| Product: | Red Hat Directory Server | Reporter: | Marc Sauton <msauton> |
| Component: | 389-ds-base | Assignee: | Viktor Ashirov <vashirov> |
| Status: | CLOSED MIGRATED | QA Contact: | LDAP QA Team <idm-ds-qe-bugs> |
| Severity: | high | Docs Contact: | Evgenia Martynyuk <emartyny> |
| Priority: | medium | ||
| Version: | 11.5 | CC: | idm-ds-dev-bugs, jyoung, mmalik, mreynolds, musoni, progier, tbordaz, vashirov |
| Target Milestone: | DS11.9 | Keywords: | Triaged |
| Target Release: | dirsrv-11.9 | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | sync-to-jira | ||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2024-06-26 13:52:50 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Marc Sauton
2022-10-03 20:20:46 UTC
The issue is caused by https://github.com/389ds/389-ds-base/commit/9a6cfddee12a591b0563a400f46c6e6b72a94500 In RHEL9/RHDS12 it was fixed in the selinux-policy https://bugzilla.redhat.com/show_bug.cgi?id=2042515, https://github.com/fedora-selinux/selinux-policy/commit/8479a8400fe1b7583814356e74e9cf1c35da1dd9 We need the same change for RHEL8. > allow dirsrv_snmp_t self:capability dac_override; We should not allow this, rather it should be put in dontaudit, see https://danwalsh.livejournal.com/80232.html The dac_override SELinux denials usually indicate that there is a problem with UNIX ownership or UNIX permissions. More information can be found at: * https://lukas-vrabec.com/index.php/2018/07/03/why-do-you-see-dac_override-selinux-denials/ * https://danwalsh.livejournal.com/80232.html In order to properly solve the problem, more detailed SELinux denials are needed. You can get them after enabling the full auditing: * https://lukas-vrabec.com/index.php/2018/07/16/how-to-enable-full-auditing-in-audit-daemon/ Indeed, and in fact the ldap-agent is only acceding a few files in /run/dirsrv Checking the permissions shows that /run/dirsrv is 770 dirsrv dirsrv while ldap-agent started by snmp service is root root and that is why we are getting the dac_override message Simply changing the group ownership of /run/dirsrv to root (i.e: /run/dirsrv is 770 dirsrv root) should allow that both the ns-slpad and the ldap-agent process have the permission to read and create files in this directory without needing any extra capabilities. In short we have to fix dscreate to set the proper ownership when generating the /etc/tmpfiles.d/dirsrv-*.conf file See https://bugzilla.redhat.com/show_bug.cgi?id=2276933) ( Created upstream ticket: https://github.com/389ds/389-ds-base/issues/6155 ) This issue is also affecting RHEL 9 & RHDS 12.3.
Same resolution, compile custom selinux policy to have:
allow dirsrv_snmp_t self:capability dac_override;
This BZ has been automatically migrated to Red Hat Issue Tracker https://issues.redhat.com/browse/DIRSRV-45. All future work related to this report will be managed there. Due to differences in account names between systems, some fields were not replicated. Be sure to add yourself to Jira issue's "Watchers" field to continue receiving updates and add others to the "Need Info From" field to continue requesting information. In the event you have trouble locating or viewing this issue, you can file an issue by sending mail to rh-issues. You can also visit https://access.redhat.com/articles/7032570 for general account information. |