Bug 556276

Created attachment 384929 [details]
avc messages extracted from /var/log/messages

Description of problem:

gpg cannot read/write files (as root) in /root/.gnupg or /var when used in a script started by a cron job.

I have a backup script of my own that creates some tar files in /var/backup, after which I'm using gpg to encrypt them (and then later write them to an external disk).  

When this backup script is run by root on the command line, everything is running fine, but when this backup script is run as a cron job as root (via /etc/cron.d), gpg cannot access any files in /root/.gnupg or /var/backup.


Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.6.32-66.fc12.noarch

How reproducible:

Always

Steps to Reproduce:
1. make a script that uses gpg to encrypt something in /var
2. add it as cron job
3. wait for the cron job to fire
  
Actual results:

gpg gets "Permission denied" errors.

Expected results:

gpg should succeed in encrypting the file in /var

Additional info:

The test script I was using is the following:

id > /tmp/testcron
cd /var/backup
/usr/bin/gpg -q -c --no-options --no-tty --cipher-algo AES --passphrase-file tmpfile etc.tgz

and it is started in /etc/cron.d as follows (I've put it to be run every 5 minutes, to be able to test and improve...):

*/5 * * * *     root    /root/testcron

When the script is run on the command line, the /tmp/testcron file contains the following id (written by the first line in the script):
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

When the script is run from the cron job, /tmp/testcron contains the following:
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) context=system_u:system_r:system_cronjob_t:s0-s0:c0.c1023

The only difference is the selinux security context. 

I know the basics of selinux, but I wasn't able to understand why it didn't work as cron job, but by experimenting with audit2allow, I found that I could fix the problems by using the following module:

module mygpg 1.0;

require {
	type admin_home_t;
	type var_t;
	type gpg_t;
	class file { read lock create write getattr open };
	class dir { write search add_name };
}

#============= gpg_t ==============

allow gpg_t admin_home_t:dir search;
allow gpg_t admin_home_t:file { read lock write open };
allow gpg_t var_t:dir { write add_name };
allow gpg_t var_t:file { read write getattr open create };


Is there a reason why this is not in the selinux-policy-targeted?   

It's also not clear to me why this gives a problem in a cron job, since the changes I made have nothing to do with cron...   As a side note, is there a tool that allows to trace selinux transitions on something that works (audit only shows problems...), to see how it is supposed to go?

I'm attaching the AVC messages that I extracted from /var/log/messages to this bug report (note that some of these are only visible when dontallow is disabled).