Bug 541657

Summary: SELinux is preventing /usr/sbin/asterisk "getcap" access.
Product: [Fedora] Fedora Reporter: Wolfgang Rupprecht <wolfgang.rupprecht>
Component: asteriskAssignee: Jeffrey C. Ollie <jeff>
Status: CLOSED WONTFIX QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: 12CC: amessina, bsexton, dwalsh, itamar, jeff, kgagnon, maarten, mgrepl, michal
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard: setroubleshoot_trace_hash:a184567fe87c4f9dfeee8ad643c0606af68037dc554525ac4d85e96e6be35013
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-12-04 02:44:49 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
"avc" messages collected by asterisk
none
audit complaints generated by logrotate with mods for asterisk none

Description Wolfgang Rupprecht 2009-11-26 16:21:00 UTC
Summary:

SELinux is preventing /usr/sbin/asterisk "getcap" access.

Detailed Description:

SELinux denied access requested by asterisk. It is not expected that this access
is required by asterisk and this access may signal an intrusion attempt. It is
also possible that the specific version or configuration of the application is
causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Please file a bug
report.

Additional Information:

Source Context                system_u:system_r:asterisk_t:s0
Target Context                system_u:system_r:asterisk_t:s0
Target Objects                None [ process ]
Source                        asterisk
Source Path                   /usr/sbin/asterisk
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           asterisk-1.6.1.9-1.fc12
Target RPM Packages           
Policy RPM                    selinux-policy-3.6.32-49.fc12
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     (removed)
Platform                      Linux (removed) 2.6.31.5-127.fc12.x86_64 #1
                              SMP Sat Nov 7 21:11:14 EST 2009 x86_64 x86_64
Alert Count                   1
First Seen                    Thu 26 Nov 2009 07:47:14 AM PST
Last Seen                     Thu 26 Nov 2009 07:47:14 AM PST
Local ID                      f5b00dbd-cc0d-406a-b771-cd4e9eda17c7
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1259250434.308:8): avc:  denied  { getcap } for  pid=2169 comm="asterisk" scontext=system_u:system_r:asterisk_t:s0 tcontext=system_u:system_r:asterisk_t:s0 tclass=process

node=(removed) type=SYSCALL msg=audit(1259250434.308:8): arch=c000003e syscall=125 success=no exit=-14 a0=18afa44 a1=0 a2=e1 a3=24 items=0 ppid=2168 pid=2169 auid=4294967295 uid=488 gid=471 euid=488 suid=488 fsuid=488 egid=471 sgid=471 fsgid=471 tty=(none) ses=4294967295 comm="asterisk" exe="/usr/sbin/asterisk" subj=system_u:system_r:asterisk_t:s0 key=(null)



Hash String generated from  selinux-policy-3.6.32-49.fc12,catchall,asterisk,asterisk_t,asterisk_t,process,getcap
audit2allow suggests:

#============= asterisk_t ==============
allow asterisk_t self:process getcap;

Comment 1 Wolfgang Rupprecht 2009-11-26 16:24:33 UTC
This was a result of normal asterisk startup after a reboot.

Comment 2 Miroslav Grepl 2009-11-27 10:01:25 UTC
*** Bug 541728 has been marked as a duplicate of this bug. ***

Comment 3 Michal Jaegermann 2009-11-29 18:04:19 UTC
Created attachment 374596 [details]
"avc" messages collected by asterisk

This is not only 'setcap' or 'getcap'.  For all practical purposes selinux on Fedora 12 breaks asterisk quite thoroughly.  After an upgrade of an asterisk server machine from Fedora 10, where it was running for quite a while with selinux in an "Enforcing" mode and no complaints in logs, I immediately started collecting entries like attached and had to switch to "Permissive".  Both for F10 and F11 policies were "targeted"

That is an excerpt.  A number of "avc" complaints about asterisk is steadily growing.

Comment 4 Daniel Walsh 2009-11-30 21:48:48 UTC
Michal I will add allow rules for most of this, but I would rather not allow asterisk to write to the /root directory.  Why is it doing this?

Fixed in selinux-policy-3.6.32-52.fc12.noarch

Comment 5 Wolfgang Rupprecht 2009-11-30 22:11:26 UTC
Asterisk is not very careful with respect to security.  There are plenty of system(2) calls with uncleaned arguments.  I really don't trust it, and trust it even less to write into /.  I'm glad to hear you aren't going to allow the write.

In this case it may well be that asterisk is trying to write into a history file that it keeps at /.asterisk_history .

# ll -a /
total 146
dr-xr-xr-x.  35 root root  4096 2009-11-28 03:12 .
dr-xr-xr-x.  35 root root  4096 2009-11-28 03:12 ..
-rw-------.   1 root root    13 2009-11-30 03:07 .asterisk_history
-rw-r--r--.   1 root root     0 2009-11-28 03:11 .autofsck
drwxr-xr-x.   4 root root  4096 2009-02-28 23:49 backup
...

$ echo ~asterisk
/var/lib/asterisk

Now, I have no idea why it doesn't keep it in its own home directory.  I suppose I should start filing bugs against asterisk.

BTW. I'm not seeing any operational errors for asterisk even when selinux is enforcing.  The logs are noisy, but that seems to be the only effect for me.

Comment 6 Jeffrey C. Ollie 2009-11-30 23:25:14 UTC
Daniel, see my response in BZ#542839 for why Asterisk is trying to write to '/'.
Was there something changed between selinux-policy-3.6.32-46 and -49 in regards to Asterisk?  I've not run into any SELinux-related issues regarding Asterisk on F-12 but I'm still running the older selinux-policy package.

Comment 7 Michal Jaegermann 2009-12-01 02:45:46 UTC
> ... but I would rather not allow
> asterisk to write to the /root directory.  Why is it doing this?

Frankly I have no idea.  I was not even aware that it can as that process is owned by an 'asterisk' id and that has /sbin/nologin for a shell.  OK, I see that something wrote /.asterisk_history and /root/.asterisk_history.  These files
are not exactly readable.  Something of that sort:

_HiStOrY_V2_
exit\134134134134134134134134134134134134134134012\1341....

That is on a specialized asterisk server which really does nothing else.  OTOH its "well-beeing" is kind of critical to owners so I am somewhat reluctant to hack too much around it.

Other than that I cannot find any traces.

Comment 8 Jeffrey C. Ollie 2009-12-01 02:52:00 UTC
Michal, actually, it's probably not the main Asterisk process that is writing the files, it's any commands that use '/usr/sbin/asterisk -r' to connect to the CLI.  That process runs as root.

Comment 9 Michal Jaegermann 2009-12-01 05:39:32 UTC
Re comment #8:
> ... it's probably not the main Asterisk process that is writing

I think that you are right.  Still I wonder what wrote /.asterisk_history.
Not very much in it.  Just one line "_HiStOrY_V2_" and a timestamp suggesting some cron job.  My best guess would be that this was logrotate which runs 
"/usr/sbin/asterisk -rx 'logger reload'".  Would setting here HOME be of help?

Still apart from attempts to write /root/.asterisk_history, which would come
from 'asterisk -r' while trying to debug a configuration, I do not see any other instances of scribbling over /root/ in this log excerpt I attached.  There is quite a few of reads from /dev/urandom and few other things but elsewhere.

Comment 10 Daniel Walsh 2009-12-01 14:54:49 UTC
Yes can asterisk set the HOME to /var/lib/asterisk for its logrotate script.

Comment 11 Michal Jaegermann 2009-12-01 17:43:00 UTC
Probably a better idea to use /usr/share/asterisk for HOME in logrotate as /var/lib/asterisk seems to be on its way out.

I guess that I can file here an asterisk bug report but this still leaves interactive runs of 'asterisk -r' as somewhat problematic.  Would be helpful for 'asterisk' package to touch /root/.asterisk in %post to make a place for an
appropriate label?  Obviously selinux policies would have to be aware of that.

Comment 12 Jeffrey C. Ollie 2009-12-01 17:56:41 UTC
"/usr/share/asterisk" should be read-only for Asterisk (on Fedora at least).  Asterisk should be writing most of it's stuff to "/var/spool/asterisk".  "/var/lib/asterisk" is currently listed as the home user for Asterisk, I'll keep that around for writing the .asterisk_history and other cruft like that.

Comment 13 Michal Jaegermann 2009-12-01 18:04:03 UTC
See also bug 542839.

Comment 14 Daniel Walsh 2009-12-01 20:14:37 UTC
I don't care about the admin running asterisk, only system processes like init or system cron.

They should use the location of the asterisk homedir.

Comment 15 Daniel Walsh 2009-12-01 20:15:09 UTC
An administrator running asterisk will stay as unconfined_t and be able to write to the /root directory.

Comment 16 Michal Jaegermann 2009-12-08 06:56:08 UTC
While using selinux-policy-3.6.32-55.fc12 from updates testing I still see some of avc messages like illustrated in an attachment 374596 [details].  audit2allow produces for these:

#============= asterisk_t ==============
allow asterisk_t postgresql_port_t:tcp_socket name_connect;
allow asterisk_t self:process getsched;

and audit2why comes with "Missing type enforcement (TE) allow rule".  Yeah, I guess so.

Comment 17 Daniel Walsh 2009-12-09 13:11:54 UTC
Any idea why it is connecting to posgresql?

Comment 18 Daniel Walsh 2009-12-09 13:14:27 UTC
You can add these rules for now using

# grep avc /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Fixed in selinux-policy-3.6.32-57.fc12.noarch

Comment 19 Jeffrey C. Ollie 2009-12-09 17:21:04 UTC
(In reply to comment #17)
> Any idea why it is connecting to posgresql?  

Asterisk has an optional module for accessing information stored in a PostgreSQL database.

Comment 20 Daniel Walsh 2009-12-09 17:36:58 UTC
57 will allow it.  I looked it up after I asked.

Comment 21 Wolfgang Rupprecht 2009-12-09 20:16:10 UTC
Dan, asterisk has a homegrown programming language (reminiscent of sendmail's nonsense.)  One use of this language is to allow the asterisk admin to rewrite data, such as fill in the caller-id names for calls that come in with caller-id numbers only.  This number->name data can be stored in a database that asterisk links to or I guess calls externally now.

Comment 22 Michal Jaegermann 2010-01-03 21:27:27 UTC
Created attachment 381430 [details]
audit complaints generated by logrotate with mods for asterisk

In /etc/logrotate.d/asterisk I tried

        HOME=/var/lib/asterisk \
        /usr/sbin/asterisk -rx 'logger reload' ....

That indeed wrote /var/lib/asterisk/.asterisk_history, with "Permissive" for selinux, but also produced an audit spill like the one attached.

As there is nothing of interest in this .asterisk_history I think that I will replace the above with

        HOME=/var/tmp \
        /usr/sbin/asterisk -rx 'logger reload' ....

Hopefuly this should be enough.

Comment 23 Daniel Walsh 2010-01-04 16:34:11 UTC
You can add these rules for now using

# grep avc /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Fixed in selinux-policy-3.6.32-66.fc12.noarch

Comment 24 Maarten Bremer 2010-01-31 01:37:09 UTC
I think the /.asterisk_history file is written by the init script, when it checks if there is already an asterisk version running:
VERSION=`${AST_SBIN}/asterisk -rx 'core show version'`
(Line 73 of /etc/init.d/asterisk).

This command is now run as root and maybe should run as the asterisk user.

Comment 25 Bug Zapper 2010-11-04 05:15:27 UTC
This message is a reminder that Fedora 12 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 12.  It is Fedora's policy to close all
bug reports from releases that are no longer maintained.  At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '12'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 12's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 12 is end of life.  If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora please change the 'version' of this 
bug to the applicable version.  If you are unable to change the version, 
please add a comment here and someone will do it for you.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

Comment 26 Bug Zapper 2010-12-04 02:44:49 UTC
Fedora 12 changed to end-of-life (EOL) status on 2010-12-02. Fedora 12 is 
no longer maintained, which means that it will not receive any further 
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of 
Fedora please feel free to reopen this bug against that version.

Thank you for reporting this bug and we are sorry it could not be fixed.