Bug 558418

Summary:	SELinux is preventing /usr/bin/chsh "execute" access on nxserver.
Product:	[Fedora] Fedora	Reporter:	Jan Teichmann <jan.teichmann>
Component:	selinux-policy	Assignee:	Miroslav Grepl <mgrepl>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	low
Version:	12	CC:	dwalsh, mgrepl
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:	setroubleshoot_trace_hash:34f06e00fd4970c86d462e6501a3ed1b5c2e509e5e817e7461f8c139e5ff01cd
Fixed In Version:	3.6.32-78.fc12	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-02-02 01:23:11 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jan Teichmann 2010-01-25 10:01:11 UTC

Summary:

SELinux is preventing /usr/bin/chsh "execute" access on nxserver.

Detailed Description:

[SELinux is in permissive mode. This access was not denied.]

SELinux denied access requested by chsh. It is not expected that this access is
required by chsh and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://(removed).redhat.com/docs/selinux-faq-fc5/#id2961385) Please file a bug
report.

Additional Information:

Source Context                unconfined_u:unconfined_r:chfn_t:s0-s0:c0.c1023
Target Context                system_u:object_r:nx_server_exec_t:s0
Target Objects                nxserver [ file ]
Source                        chsh
Source Path                   /usr/bin/chsh
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           util-linux-ng-2.16.2-5.fc12
Target RPM Packages           
Policy RPM                    selinux-policy-3.6.32-66.fc12
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Plugin Name                   catchall
Host Name                     (removed)
Platform                      Linux (removed) 2.6.31.9-174.fc12.x86_64 #1 SMP Mon
                              Dec 21 05:33:33 UTC 2009 x86_64 x86_64
Alert Count                   2
First Seen                    Thu 14 Jan 2010 12:23:33 CET
Last Seen                     Thu 14 Jan 2010 12:30:36 CET
Local ID                      1d67d726-c7da-49fd-9641-ac0d92655dac
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1263468636.741:23474): avc:  denied  { execute } for  pid=20753 comm="chsh" name="nxserver" dev=dm-1 ino=428603 scontext=unconfined_u:unconfined_r:chfn_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nx_server_exec_t:s0 tclass=file

node=(removed) type=SYSCALL msg=audit(1263468636.741:23474): arch=c000003e syscall=21 success=yes exit=0 a0=7faedbd115a0 a1=1 a2=726576 a3=7fff2067f610 items=0 ppid=20751 pid=20753 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=13 comm="chsh" exe="/usr/bin/chsh" subj=unconfined_u:unconfined_r:chfn_t:s0-s0:c0.c1023 key=(null)



Hash String generated from  selinux-policy-3.6.32-66.fc12,catchall,chsh,chfn_t,nx_server_exec_t,file,execute
audit2allow suggests:

#============= chfn_t ==============
allow chfn_t nx_server_exec_t:file execute;

Comment 1 Daniel Walsh 2010-01-25 19:16:14 UTC

Why would chsh be executing the nxserver?  Is this the login shell?

Comment 2 Jan Teichmann 2010-01-25 19:38:14 UTC

it happens on the system start-up. my login shell should be bash but maybe the starting nxserver try to change the shell. but the nxserver is also working with this restriction.

Comment 3 Daniel Walsh 2010-01-25 19:48:36 UTC

Any chance nxserver is listed in /etc/shells?

chsh might be checking which shells are executables?  is nxserver in the /etc/passwd?

Comment 4 Jan Teichmann 2010-01-25 19:59:03 UTC

the nxserver is not in the /etc/shells but in /etc/passwd:
nx:x:491:475::/usr/NX/home/nx:/usr/NX/bin/nxserver

and I noticed that's the NoMachine server... I completely forgot that I changed to the proprietary one some months ago.

Comment 5 Daniel Walsh 2010-01-25 20:26:44 UTC

Miroslav, add

optional_policy(`
	nx_exec_server(chfn_t)
')

to usermanage.te

and

########################################
## <summary>
##	Execute the NX server.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`nx_exec_server',`
	gen_require(`
		type nx_server_exec_t;
	')

	can_exec($1, nx_server_exec_t)
')

to nx.if

Comment 6 Miroslav Grepl 2010-01-26 13:46:42 UTC

Fixed in selinux-policy-3.6.32-78.fc12

Comment 7 Fedora Update System 2010-01-28 09:23:43 UTC

selinux-policy-3.6.32-78.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-78.fc12

Comment 8 Fedora Update System 2010-01-29 03:28:56 UTC

selinux-policy-3.6.32-78.fc12 has been pushed to the Fedora 12 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update selinux-policy'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2010-1207

Comment 9 Fedora Update System 2010-02-02 01:21:02 UTC

selinux-policy-3.6.32-78.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.