Bug 2165220
| Summary: | selinux-policy-targeted is preventing named-chroot from starting due to preventing logging inside the chroot /var/named/chroot/var/data | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | David <webmaster> |
| Component: | selinux-policy | Assignee: | Nikola Knazekova <nknazeko> |
| Status: | CLOSED WONTFIX | QA Contact: | BaseOS QE Security Team <qe-baseos-security> |
| Severity: | high | Docs Contact: | |
| Priority: | medium | ||
| Version: | 9.1 | CC: | lvrabec, mmalik, zpytela |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | No Doc Update | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-08-04 14:56:45 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
David
2023-01-28 15:39:47 UTC
I just found another issue related to selinux-policy, this time concerning sshd:
Jan 28 09:33:01 server setroubleshoot[181272]: SELinux is preventing /usr/sbin/sshd from write access on the sock_file /var/lib/mysql/mysql.sock. For complete SELinux messages run: sealert -l 888712f0-b339-4c8d-9412-c551f5d6dd3b
Jan 28 09:33:01 server setroubleshoot[181272]: SELinux is preventing /usr/sbin/sshd from write access on the sock_file /var/lib/mysql/mysql.sock.#012#012***** Plugin catchall (100. confidence) suggests **************************#012#012If you believe that sshd should be allowed write access on the mysql.sock sock_file by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this access.#012Do#012allow this access for now by executing:#012# ausearch -c 'sshd' --raw | audit2allow -M my-sshd#012# semodule -X 300 -i my-sshd.pp#012
Raw Audit Messages
type=AVC msg=audit(1674927178.683:84366): avc: denied { write } for pid=181250 comm="sshd" name="mysql.sock" dev="dm-0" ino=44433509 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:mysqld_var_run_t:s0 tclass=sock_file permissive=1
type=AVC msg=audit(1674927178.683:84366): avc: denied { connectto } for pid=181250 comm="sshd" path="/var/lib/mysql/mysql.sock" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:mysqld_t:s0 tclass=unix_stream_socket permissive=1
type=SYSCALL msg=audit(1674927178.683:84366): arch=x86_64 syscall=connect success=yes exit=0 a0=8 a1=7ffefe3941d0 a2=6e a3=10 items=0 ppid=882 pid=181250 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=sshd exe=/usr/sbin/sshd subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
Hash: sshd,sshd_t,mysqld_var_run_t,sock_file,write
Cheers,
David
Hi David, why is sshd trying to access mysql? Did you make any changes to the config file? Thanks, Nikola Hey Nikola, No it’s a clean install running Plesk. I only have changed SSHD to enforce public key + password and set max 2 attempts. What config files do you want to see in particular? Cheers, David Hi David, the first bug related to named-chroot is working in selinux-policy-38.1.18-1. To the second issue, the plesk is not supported, so I am closing this bug as WONTFIX |