Bug 532180
Summary: | SELinux is preventing /usr/sbin/vsftpd "net_raw" access. | ||
---|---|---|---|
Product: | [Fedora] Fedora | Reporter: | Víctor Daniel Martínez O. <vdanielmo> |
Component: | kernel | Assignee: | Kernel Maintainer List <kernel-maint> |
Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
Severity: | medium | Docs Contact: | |
Priority: | low | ||
Version: | 12 | CC: | amarecek, dougsland, dwalsh, eparis, gansalmon, itamar, jskala, kernel-maint, mgrepl, mnagy |
Target Milestone: | --- | ||
Target Release: | --- | ||
Hardware: | i386 | ||
OS: | Linux | ||
Whiteboard: | setroubleshoot_trace_hash:6efa9ae964cb52eaf6163a6085f66d715b11a1b3b95beb45297150db21f659cb | ||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2009-12-05 23:43:01 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: |
Description
Víctor Daniel Martínez O.
2009-10-31 04:24:57 UTC
Why does vsftpd need raw access to the network? There is no SOCK_RAW or SOCK_PACKET option (Vsftpd uses SOCK_STREAM only). Selinux blocks reading ftp command. There is no change in opening socket between vsftpd 2.1.2 (F11) and 2.2.0 (F12). I'm currently investigating differences between the versions cos 2.1.2 isn't affected. The difference is known now. Vsftpd supports new option (unfortunately true by default) that switches forking process. The new option is: isolate_network (YES by default) Setting NO adjusts vsftpd behaviour to previous releases. The main difference is usage: - fork() (isolate_network=NO) - clone() (isolate_network=YES) Usage clone() creates cloned process sharing memory space. Is it an intention to block it with selinux? Not sure what this has to do with using raw_network? Might be a kernel problem. Turning up ftp protection should not force me to give ftp a dangerous permission. Eric? <unrelated> Dan, can we get setroubleshoot to show ausearch -i rather than the raw log data? </unrelated> node=(removed) type=SYSCALL msg=audit(10/31/2009 00:24:13.500:21344) : arch=i386 syscall=clone success=no exit=-1(Operation not permitted) a0=40000011 a1=0 a2=fd1338 a3=fd1338 items=0 ppid=0 pid=28750 auid=paris uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=10 comm=vsftpd exe=/usr/sbin/vsftpd subj=unconfined_u:system_r:ftpd_t:s0-s0:c0.c1023 key=(null) node=(removed) type=AVC msg=audit(10/31/2009 00:24:13.500:21344) : avc: denied { net_raw } for pid=28750 comm=vsftpd capability=net_raw scontext=unconfined_u:system_r:ftpd_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:ftpd_t:s0-s0:c0.c1023 tclass=capability I definitely happened during the clone() syscall. I don't see it in the kernel, but I'm looking for why it happened. Seems very odd. Sure send me a patch. :^) Kernel issue. Note that vsftpd is not going to need CAP_SYS_ADMIN and that is correct behaviour :( http://marc.info/?l=linux-netdev&m=125727935613278&w=2 This bug appears to have been reported against 'rawhide' during the Fedora 12 development cycle. Changing version to '12'. More information and reason for this action is here: http://fedoraproject.org/wiki/BugZappers/HouseKeeping *** This bug has been marked as a duplicate of bug 537428 *** |