Bug 634945

Miroslav, these  should look like


allow smbcontrol_t nmbd_t:process { signal signull };
allow smbcontrol_t nmbd_var_run_t:file read_files_pattern;

allow smbcontrol_t smbd_t:process { signal signull };
allow smbcontrol_t smbd_var_run_t:file read_files_pattern;
allow smbcontrol_t winbind_t:process { signal signull };

Automated test also found this:
----
time->Fri Sep 17 15:35:45 2010
type=SYSCALL msg=audit(1284730545.500:438): arch=40000003 syscall=33 success=no exit=-13 a0=bfad5897 a1=4 a2=e15ff4 a3=ffffffac items=0 ppid=14732 pid=14733 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="winbindd" exe="/usr/sbin/winbindd" subj=unconfined_u:system_r:winbind_t:s0 key=(null)
type=AVC msg=audit(1284730545.500:438): avc:  denied  { read } for  pid=14733 comm="winbindd" name="unix" dev=proc ino=4026531990 scontext=unconfined_u:system_r:winbind_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file
----

I added some smbcontrol commands to the automated test and new AVC appeared:
----
time->Fri Sep 17 16:11:36 2010
type=SYSCALL msg=audit(1284732696.170:654): arch=40000003 syscall=37 success=no exit=-13 a0=4fbc a1=a a2=c7eff4 a3=123f498 items=0 ppid=1 pid=20227 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="winbindd" exe="/usr/sbin/winbindd" subj=unconfined_u:system_r:winbind_t:s0 key=(null)
type=AVC msg=audit(1284732696.170:654): avc:  denied  { signal } for  pid=20227 comm="winbindd" scontext=unconfined_u:system_r:winbind_t:s0 tcontext=unconfined_u:unconfined_r:smbcontrol_t:s0-s0:c0.c1023 tclass=process
----

What does a constraint violation mean in this context?

# ausearch -m avc -ts recent | audit2allow

#============= smbcontrol_t ==============
allow smbcontrol_t nmbd_var_run_t:file open;
allow smbcontrol_t smbd_var_run_t:file read;

#============= winbind_t ==============
allow winbind_t proc_net_t:file read;
#!!!! This avc is a constraint violation.  You will need to add an attribute to either the source or target type to make it work.
#Contraint rule: 
allow winbind_t smbcontrol_t:process signal;

The problem is the smbcontrol is executed by hand. So there is a transition from unconfined which is running with MCS label of s0-s0:c0.c1023 and smbcontrol_t ends up with the same MCS label.

Not sure how we can handle this.

Together 3 constraint violation AVCs were found in permissive mode:
----
time->Fri Sep 17 16:21:13 2010
type=SYSCALL msg=audit(1284733273.996:688): arch=40000003 syscall=37
success=yes exit=0 a0=52fd a1=a a2=e73ff4 a3=209d9f0 items=0 ppid=1 pid=21182
auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1
comm="smbd" exe="/usr/sbin/smbd" subj=unconfined_u:system_r:smbd_t:s0
key=(null)
type=AVC msg=audit(1284733273.996:688): avc:  denied  { signal } for  pid=21182
comm="smbd" scontext=unconfined_u:system_r:smbd_t:s0
tcontext=unconfined_u:unconfined_r:smbcontrol_t:s0-s0:c0.c1023 tclass=process
----
time->Fri Sep 17 16:21:25 2010
type=SYSCALL msg=audit(1284733285.560:690): arch=40000003 syscall=37
success=yes exit=0 a0=5329 a1=a a2=936ff4 a3=192b938 items=0 ppid=1 pid=21202
auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1
comm="nmbd" exe="/usr/sbin/nmbd" subj=unconfined_u:system_r:nmbd_t:s0
key=(null)
type=AVC msg=audit(1284733285.560:690): avc:  denied  { signal } for  pid=21202
comm="nmbd" scontext=unconfined_u:system_r:nmbd_t:s0
tcontext=unconfined_u:unconfined_r:smbcontrol_t:s0-s0:c0.c1023 tclass=process
----
time->Fri Sep 17 16:21:36 2010
type=SYSCALL msg=audit(1284733296.880:691): arch=40000003 syscall=37
success=yes exit=0 a0=5353 a1=a a2=eafff4 a3=1a95498 items=0 ppid=1 pid=21221
auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1
comm="winbindd" exe="/usr/sbin/winbindd"
subj=unconfined_u:system_r:winbind_t:s0 key=(null)
type=AVC msg=audit(1284733296.880:691): avc:  denied  { signal } for  pid=21221
comm="winbindd" scontext=unconfined_u:system_r:winbind_t:s0
tcontext=unconfined_u:unconfined_r:smbcontrol_t:s0-s0:c0.c1023 tclass=process
----

Miroslav, grab the changes I made to f14 involving


mcs_untrusted_proc
mcsuntrustedproc

Should fix this problem.

Dan,
the fix works. Thanks.

Fixed in selinux-policy-3.7.19-56.el6.noarch.

    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Due to incorrect SELinux policy, smbcontrol, a utility that sends messages to the smbd, nmbd, or winbindd service, did not work properly. This error has been fixed, the relevant policy code has been added, and SELinux no longer prevents smbcontrol from working.

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-0526.html