Bug 639083
| Summary: | SELinux prevents passwd from working in runlevel 1 | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | George Hacker <ghacker> | ||||
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> | ||||
| Severity: | high | Docs Contact: | |||||
| Priority: | high | ||||||
| Version: | 6.0 | CC: | dwalsh, ftaylor, mmalik, notting, sbonnevi, snagar | ||||
| Target Milestone: | rc | Keywords: | ZStream | ||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | selinux-policy-3.7.19-58.el6 | Doc Type: | Bug Fix | ||||
| Doc Text: |
Prior to this update, running the passwd command in the single user mode (that is, runlevel 1) failed when SELinux was enabled. To address this issue, the SELinux rules have been updated, so that passwd can now access the console, as well as all terminals (TTYs) and pseudo terminals (PTYs).
|
Story Points: | --- | ||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2011-05-19 11:56:42 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | |||||||
| Bug Blocks: | 580448, 644820 | ||||||
| Attachments: |
|
||||||
Single user mode is supposed to execute sushell If you execute # sushell # passwd Does it work? No, same error. The attachment is not viewable. What avc are you seeing? Also what does id -Z show? id -Z after running sushell One difference we noticed between single and rl 5 was that passwd is
transitioning into system_u:system_r:passwd_t in runlevel single and
unconfined_u:unconfined_r:passwd_t in runlevel 5.
The other odd thing was that passwd seems to be trying to read a pipe
associated with fd 9 in the bash process in runlevel single.
Not sure what that pipe's there for. fd 0 1 2 and 255 all point to
/dev/console.
The actual AVC:
type=1400 audit(1285871927.977:4): avc: denied { read } for pid=819 comm="passwd" path="pipe:[10143]" dev=pipefs ino=10143 scontext=system_u:system_r:passwd_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=fifo_file
Re comment #5, both cases it shows "system_u:system_r:unconfined_t:s0". Miroslav add term_use_all_terms(passwd_t) The difference is that the terminal in single user mode is labeled console_device_t and passwd is not allowed to use this. Ah. And that was masked by a dontaudit rule. The business with the avc for fd 9 is almost certainly related to the discussion in bug #618995#c6, coming from Upstart init. Fixed in selinux-policy-3.7.19-56.el6.noarch
Technical note added. If any revisions are required, please edit the "Technical Notes" field
accordingly. All revisions will be proofread by the Engineering Content Services team.
New Contents:
Prior to this update, running the passwd command in the single user mode (that is, runlevel 1) failed when SELinux was enabled. To address this issue, the SELinux rules have been updated, so that passwd can now access the console, as well as all terminals (TTYs) and pseudo terminals (PTYs).
Fixed in selinux-policy-3.7.19-58.el6. An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2011-0526.html |
Created attachment 450843 [details] AVC errors from dmesg after failed passwd attempt Description of problem: The passwd command doesn't function when used in runlevel 1 because of an SELinux violation. It is expected that passwd can be used in runlevel 1 to recover a system with an unknown root password. Version-Release number of selected component (if applicable): selinux-policy-targeted-3.7.19-54.el6.noarch How reproducible: Always Steps to Reproduce: 1. Boot system into runlevel 1 2. Execute passwd command Actual results: passwd command pauses then shell returns prompt. No prompting is given to provide the new password. Expected results: passwd command should prompt for new password. Additional info: Changing SELinux into permissive mode before executing passwd restores desired functionality. Passwd will prompt and update passwords.