Bug 2236056
| Summary: | SELinux denies to process samba-dceprcd during connection to LDAP server. | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | kyoneyama <kyoneyam> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED MIGRATED | QA Contact: | BaseOS QE Security Team <qe-baseos-security> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 8.8 | CC: | lvrabec, mmalik, nknazeko |
| Target Milestone: | rc | Keywords: | MigratedToJIRA, Triaged |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-08-30 11:54:40 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Issue migration from Bugzilla to Jira is in process at this time. This will be the last message in Jira copied from the Bugzilla bug. This BZ has been automatically migrated to the issues.redhat.com Red Hat Issue Tracker. All future work related to this report will be managed there. To find the migrated issue, look in the "Links" section for a direct link to the new issue location. The issue key will have an icon of 2 footprints next to it, and begin with "RHEL-" followed by an integer. You can also find this issue by visiting https://issues.redhat.com/issues/?jql= and searching the "Bugzilla Bug" field for this BZ's number, e.g. a search like: "Bugzilla Bug" = 1234567 In the event you have trouble locating or viewing this issue, you can file an issue by sending mail to rh-issues. |
Description of problem: On RHEL8, SELinux denies to process samba-dceprcd during connection to LDAP server. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ type=AVC msg=audit(1693385544.691:838): avc: denied { name_connect } for pid=6591 comm="samba-dcerpcd" dest=636 scontext=system_u:system_r:winbind_rpcd_t:s0 tcontext=system_u:object_r:ldap_port_t:s0 tclass=tcp_socket permissive=0 ---- type=AVC msg=audit(1693385545.693:839): avc: denied { name_connect } for pid=6591 comm="samba-dcerpcd" dest=636 scontext=system_u:system_r:winbind_rpcd_t:s0 tcontext=system_u:object_r:ldap_port_t:s0 tclass=tcp_socket permissive=0 ---- type=AVC msg=audit(1693385546.701:840): avc: denied { name_connect } for pid=6591 comm="samba-dcerpcd" dest=636 scontext=system_u:system_r:winbind_rpcd_t:s0 tcontext=system_u:object_r:ldap_port_t:s0 tclass=tcp_socket permissive=0 ... setroubleshoot[6462]: SELinux is preventing /usr/libexec/samba/samba-dcerpcd from name_connect access on the tcp_socket port 636. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that samba-dcerpcd should be allowed name_connect access on the port 636 tcp_socket by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'samba-dcerpcd' --raw | audit2allow -M my-sambadcerpcd # semodule -X 300 -i my-sambadcerpcd.pp ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # ausearch -c 'samba-dcerpcd' --raw | audit2allow -M my-pol # cat my-pol.te module my-pol 1.0; require { type winbind_rpcd_t; type ldap_port_t; class tcp_socket name_connect; } #============= winbind_rpcd_t ============== #!!!! This avc is allowed in the current policy allow winbind_rpcd_t ldap_port_t:tcp_socket name_connect; Version-Release number of selected component (if applicable): Red Hat Enterprise Linux 8 samba-4.17.5-3.el8_8 selinux-policy-targeted-3.14.3-108.el8 How reproducible: Always Steps to Reproduce: 1. As per https://access.redhat.com/solutions/337073, setup samba to use a ldap server. passdb backend = ldapsam:ldap://rhds.ad.example.com 2. Start winbind.service # systemctl start winbind 3. Look at journal log and audit log Actual results: samba services cannot connect to the LDAP server.