Bug 2180634
| Summary: | [Regression] SELinux is preventing SMB mounts using cached Kerberos credentials | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | James <james> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | medium | ||
| Version: | 38 | CC: | dwalsh, lvrabec, mmalik, omosnacek, pkoncity, vmojzis, zpytela |
| Target Milestone: | --- | Keywords: | Triaged |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-38.17-1.fc38 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-06-18 01:29:51 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
There's quite a lot of alerts related to both cifs.idmap and cifs.upcall. The alert bug reporter is currently broken, but here are *some* of the ones for cifs.upcall (which is probably the main culprit):
SELinux is preventing cifs.upcall from 'connectto' accesses on the unix_stream_socket /run/.heim_org.h5l.kcm-socket.
***** Plugin catchall (100. confidence) suggests **************************
If you believe that cifs.upcall should be allowed connectto access on the .heim_org.h5l.kcm-socket unix_stream_socket by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'cifs.upcall' --raw | audit2allow -M my-cifsupcall
# semodule -X 300 -i my-cifsupcall.pp
Additional Information:
Source Context system_u:system_r:keyutils_request_t:s0
Target Context system_u:system_r:sssd_t:s0
Target Objects /run/.heim_org.h5l.kcm-socket [ unix_stream_socket
]
Source cifs.upcall
Source Path cifs.upcall
Port <Unknown>
Host (removed)
Source RPM Packages
Target RPM Packages
SELinux Policy RPM selinux-policy-targeted-38.8-2.fc38.noarch
Local Policy RPM selinux-policy-targeted-38.8-2.fc38.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Permissive
Host Name (removed)
Platform Linux (removed) 6.2.7-300.fc38.x86_64 #1 SMP
PREEMPT_DYNAMIC Fri Mar 17 16:02:49 UTC 2023
x86_64
Alert Count 1
First Seen 2023-03-21 23:24:45 GMT
Last Seen 2023-03-21 23:24:45 GMT
Local ID c2da35c6-5174-4184-a4e5-ec7306461c94
Raw Audit Messages
type=AVC msg=audit(1679441085.287:241): avc: denied { connectto } for pid=3442 comm="cifs.upcall" path="/run/.heim_org.h5l.kcm-socket" scontext=system_u:system_r:keyutils_request_t:s0 tcontext=system_u:system_r:sssd_t:s0 tclass=unix_stream_socket permissive=1
Hash: cifs.upcall,keyutils_request_t,sssd_t,unix_stream_socket,connectto
SELinux is preventing cifs.upcall from 'read' accesses on the file /etc/krb5.conf.
***** Plugin catchall (100. confidence) suggests **************************
If you believe that cifs.upcall should be allowed read access on the krb5.conf file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'cifs.upcall' --raw | audit2allow -M my-cifsupcall
# semodule -X 300 -i my-cifsupcall.pp
Additional Information:
Source Context system_u:system_r:keyutils_request_t:s0
Target Context system_u:object_r:krb5_conf_t:s0
Target Objects /etc/krb5.conf [ file ]
Source cifs.upcall
Source Path cifs.upcall
Port <Unknown>
Host (removed)
Source RPM Packages
Target RPM Packages krb5-libs-1.20.1-8.fc38.x86_64
krb5-libs-1.20.1-8.fc38.i686
SELinux Policy RPM selinux-policy-targeted-38.8-2.fc38.noarch
Local Policy RPM selinux-policy-targeted-38.8-2.fc38.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Permissive
Host Name (removed)
Platform Linux (removed) 6.2.7-300.fc38.x86_64 #1 SMP
PREEMPT_DYNAMIC Fri Mar 17 16:02:49 UTC 2023
x86_64
Alert Count 1
First Seen 2023-03-21 23:24:45 GMT
Last Seen 2023-03-21 23:24:45 GMT
Local ID 0403e45c-eeee-4387-897b-a0281397bffd
Raw Audit Messages
type=AVC msg=audit(1679441085.287:235): avc: denied { read } for pid=3442 comm="cifs.upcall" name="krb5.conf" dev="dm-0" ino=13428752 scontext=system_u:system_r:keyutils_request_t:s0 tcontext=system_u:object_r:krb5_conf_t:s0 tclass=file permissive=1
Hash: cifs.upcall,keyutils_request_t,krb5_conf_t,file,read
SELinux is preventing cifs.upcall from 'read' accesses on the directory /var/lib/sss/pubconf/krb5.include.d.
***** Plugin catchall (100. confidence) suggests **************************
If you believe that cifs.upcall should be allowed read access on the krb5.include.d directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'cifs.upcall' --raw | audit2allow -M my-cifsupcall
# semodule -X 300 -i my-cifsupcall.pp
Additional Information:
Source Context system_u:system_r:keyutils_request_t:s0
Target Context system_u:object_r:sssd_public_t:s0
Target Objects /var/lib/sss/pubconf/krb5.include.d [ dir ]
Source cifs.upcall
Source Path cifs.upcall
Port <Unknown>
Host (removed)
Source RPM Packages
Target RPM Packages sssd-krb5-common-2.8.2-4.fc38.x86_64
SELinux Policy RPM selinux-policy-targeted-38.8-2.fc38.noarch
Local Policy RPM selinux-policy-targeted-38.8-2.fc38.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Permissive
Host Name (removed)
Platform Linux (removed) 6.2.7-300.fc38.x86_64 #1 SMP
PREEMPT_DYNAMIC Fri Mar 17 16:02:49 UTC 2023
x86_64
Alert Count 1
First Seen 2023-03-21 23:24:45 GMT
Last Seen 2023-03-21 23:24:45 GMT
Local ID 4b24717d-05a8-4899-a05d-dde6d745ca49
Raw Audit Messages
type=AVC msg=audit(1679441085.287:237): avc: denied { read } for pid=3442 comm="cifs.upcall" name="krb5.include.d" dev="dm-0" ino=158247 scontext=system_u:system_r:keyutils_request_t:s0 tcontext=system_u:object_r:sssd_public_t:s0 tclass=dir permissive=1
Hash: cifs.upcall,keyutils_request_t,sssd_public_t,dir,read
This is part of the same suite as 2180608 and 2180632. *** Bug 2180632 has been marked as a duplicate of this bug. *** FEDORA-2023-9050c32c92 has been submitted as an update to Fedora 38. https://bodhi.fedoraproject.org/updates/FEDORA-2023-9050c32c92 FEDORA-2023-9050c32c92 has been pushed to the Fedora 38 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2023-9050c32c92` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-9050c32c92 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2023-9050c32c92 has been pushed to the Fedora 38 stable repository. If problem still persists, please make note of it in this bug report. |
The general symptom is I can no longer automount a Samba share using multiuser,cruid=... with credentials in a Kerberos cache (KEYRING or KCM) because of things like: [ 41.829922] CIFS: Attempting to mount \\skipper.cb.ettle\home [ 41.863223] CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed [ 41.863229] CIFS: VFS: \\skipper.cb.ettle Send error in SessSetup = -126 [ 41.863239] CIFS: VFS: cifs_mount failed w/return code = -126 Full relabel doesn't help. SELinux is preventing cifs.idmap from 'write' accesses on the sock_file /var/lib/sss/pipes/nss. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that cifs.idmap should be allowed write access on the nss sock_file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'cifs.idmap' --raw | audit2allow -M my-cifsidmap # semodule -X 300 -i my-cifsidmap.pp Additional Information: Source Context system_u:system_r:keyutils_request_t:s0 Target Context system_u:object_r:sssd_var_lib_t:s0 Target Objects /var/lib/sss/pipes/nss [ sock_file ] Source cifs.idmap Source Path cifs.idmap Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-38.8-2.fc38.noarch Local Policy RPM selinux-policy-targeted-38.8-2.fc38.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 6.2.7-300.fc38.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Mar 17 16:02:49 UTC 2023 x86_64 Alert Count 1 First Seen 2023-03-21 23:24:45 GMT Last Seen 2023-03-21 23:24:45 GMT Local ID 15e3c220-f46d-47d4-8da2-43489d08e8ce Raw Audit Messages type=AVC msg=audit(1679441085.440:254): avc: denied { write } for pid=3444 comm="cifs.idmap" name="nss" dev="dm-0" ino=94801869 scontext=system_u:system_r:keyutils_request_t:s0 tcontext=system_u:object_r:sssd_var_lib_t:s0 tclass=sock_file permissive=1 Hash: cifs.idmap,keyutils_request_t,sssd_var_lib_t,sock_file,write