Bug 549507
| Summary: | SELinux is preventing /usr/sbin/rpc.gssd "read" access on krb5cc_501_AjUh0E. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Louis Lagendijk <louis> |
| Component: | selinux-policy | Assignee: | Daniel Walsh <dwalsh> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 12 | CC: | dwalsh, mgrepl, nalin, rstrode, steved |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | setroubleshoot_trace_hash:4ea6cf3d7ac61eabfb90b9104e6b48502a8e476a0306ac78bf97bb54ad6808f8 | ||
| Fixed In Version: | 3.6.32-66.fc12 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2010-01-08 20:09:53 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Louis Lagendijk
2009-12-21 21:26:26 UTC
How was the krb5cc file created? The problem here was the krb5cc file was not created via a normal login so it ended up with an incorrect context. ls -lZ /tmp/krb5cc_3267 -rw-------. dwalsh dwalsh unconfined_u:object_r:user_tmp_t:s0 /tmp/krb5cc_3267 bash-4.0# ls -lZ /tmp/krb5cc_3267* -rw-------. dwalsh dwalsh unconfined_u:object_r:user_tmp_t:s0 /tmp/krb5cc_3267 -rw-------. dwalsh dwalsh unconfined_u:object_r:user_tmp_t:s0 /tmp/krb5cc_3267_NcMLrh It should be labeled user_tmp_t. All my krb5cc* files are created by login processes, some have user_tmp_t, others have xserver_tmp_t. I use the gdm graphical login.... [louis@travel ~]$ ls -alZ /tmp/krb5cc_* -rw-------. louis users unconfined_u:object_r:user_tmp_t:s0 /tmp/krb5cc_501_0feHVy -rw-------. louis users unconfined_u:object_r:user_tmp_t:s0 /tmp/krb5cc_501_12Eq42 -rw-------. louis users unconfined_u:object_r:user_tmp_t:s0 /tmp/krb5cc_501_1Sxtwk -rw-------. louis users unconfined_u:object_r:user_tmp_t:s0 /tmp/krb5cc_501_2u5qxO -rw-------. louis users system_u:object_r:xserver_tmp_t:s0 /tmp/krb5cc_501_2VMQXG -rw-------. louis users system_u:object_r:xserver_tmp_t:s0 /tmp/krb5cc_501_4KyIB5 -rw-------. louis users system_u:object_r:xserver_tmp_t:s0 /tmp/krb5cc_501_4VliSn [louis@travel ~]$ ps ax |grep gdm 1715 ? Ss 0:00 /usr/sbin/gdm-binary -nodaemon 1757 ? S 0:00 /usr/libexec/gdm-simple-slave --display-id /org/gnome/DisplayManager/Display1 --force-active-vt 1758 tty1 Rs+ 3:03 /usr/bin/Xorg :0 -nr -verbose -auth /var/run/gdm/auth-for-gdm-AnNl4J/database -nolisten tcp vt1 1831 ? S 0:00 pam: gdm-password 5416 pts/0 S+ 0:00 grep gdm Are the xserver_tmp_t ones older? Could you remove all of the krb5cc files and relogin, and see if some are created with a context other then user_tmp_t? The xserver_tmp_t get created together with a user_tmp_t one at login. After removing all old krb5cc* and login I have in /tmp: -rw-------. louis users system_u:object_r:xserver_tmp_t:s0 /tmp/krb5cc_501_5DX3C8 -rw-------. louis users unconfined_u:object_r:user_tmp_t:s0 /tmp/krb5cc_501_MZ19Hz -rw-------. root root system_u:object_r:gssd_tmp_t:s0 /tmp/krb5cc_machine_FAZANT.NET Ok gssd can read all of the labels here. So it should work. I will also allow it to read tmp_t which would probably be a mislabeled file. Fixed in selinux-policy-3.6.32-66.fc12.noarch selinux-policy-3.6.32-66.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-66.fc12 selinux-policy-3.6.32-66.fc12 has been pushed to the Fedora 12 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2010-0184 selinux-policy-3.6.32-66.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report. |