Bug 575179

Summary: sssd requires manage privileges on krb5_host_rcache_t
Product: [Fedora] Fedora Reporter: Eugene Indenbom <eindenbom>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: 12CC: dwalsh, mgrepl
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: selinux-policy-3.6.32-106.fc12 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-03-30 02:11:56 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Eugene Indenbom 2010-03-19 16:54:24 UTC 
Description of problem:
When sssd krb5_validate domain option is True (see man sssd-krb5), sss authentication fails as sssd is not able to use /var/tmp/host_0 credential cache for ticket validation.

Please, note that krb5_validate = True is the default in IPA domain.

Version-Release number of selected component (if applicable): 3.6.32-99.fc12

How reproducible:

Steps to Reproduce:
1. Configure sssd for domain with kerberos authentication and set krb5_validate = True
2. Turn on sssd authentication using authconfig
3. It is not possible to login using network credentials
  
Actual results:
Users can not login using network credentials. selinux alert log contains audit messages about denied access from sssd_t to krb5_host_rcache_t

Expected results:
Users can login using network credentials


Additional info:
The problem is fixed by adding to policy:
kerberos_manage_host_rcache(sssd_t)
Comment 1 Daniel Walsh 2010-03-22 14:23:55 UTC 
Miroslav add it.
Comment 2 Miroslav Grepl 2010-03-23 12:30:56 UTC 
Fixed in selinux-policy-3.6.32-106.fc12
Comment 3 Fedora Update System 2010-03-23 18:03:39 UTC 
selinux-policy-3.6.32-106.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-106.fc12
Comment 4 Fedora Update System 2010-03-24 23:30:48 UTC 
selinux-policy-3.6.32-106.fc12 has been pushed to the Fedora 12 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update selinux-policy'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-106.fc12
Comment 5 Fedora Update System 2010-03-30 02:10:20 UTC 
selinux-policy-3.6.32-106.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.