Bug 642330

Summary: SELinux verhindert /bin/login "write" Zugriff on agent.4764.
Product: [Fedora] Fedora Reporter: Jochen Schmitt <jochen>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: 13CC: dwalsh, mgrepl
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard: setroubleshoot_trace_hash:d52bc8d5a4e391775c11a7224fb4acb17a3af4ffaf6f450ac450dcce59b2c578
Fixed In Version: selinux-policy-3.7.19-69.fc13 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-11-11 22:23:06 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Jochen Schmitt 2010-10-12 15:36:06 UTC 
Zusammenfassung:

SELinux verhindert /bin/login "write" Zugriff on agent.4764.

Detaillierte Beschreibung:

[SELinux ist in freizügigem Modus. Dieser Zugriff wurde nicht verweigert.]

SELinux verweigerte den von login angeforderten Zugriff. Da nicht davon
ausgegangen wird, dass dieser Zugriff von login benötigt wird, signalisiert dies
möglicherweise einen Einbruchsversuch. Es ist ausserdem möglich, dass diese
spezielle Version oder Konfiguration der Anwendung den zusätzlichen Zugriff
verursacht.

Zugriff erlauben:

Sie können ein lokales Richtlininenmodul generieren, um diesen Zugriff zu
erlauben siehe FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385)
Bitte reichen Sie einen Fehlerbericht ein.

Zusätzliche Informationen:

Quellkontext                  system_u:system_r:local_login_t:SystemLow-
                              SystemHigh
Zielkontext                   unconfined_u:object_r:user_tmp_t:SystemLow
Zielobjekte                   agent.4764 [ sock_file ]
Quelle                        login
Quellpfad                     /bin/login
Port                          <Unbekannt>
Host                          (entfernt)
RPM-Pakete der Quelle         util-linux-ng-2.17.2-8.fc13
RPM-Pakete des Ziels          
Richtlinien-RPM               selinux-policy-3.7.19-47.fc13
SELinux aktiviert             True
Richtlinientyp                targeted
Enforcing-Modus               Permissive
Plugin-Name                   catchall
Rechnername                   (entfernt)
Plattform                     Linux (entfernt)
                              2.6.33.6-147.2.4.fc13.x86_64 #1 SMP Fri Jul 23
                              17:14:44 UTC 2010 x86_64 x86_64
Anzahl der Alarme             4
Zuerst gesehen                So 14 Mär 2010 19:43:09 CET
Zuletzt gesehen               Fr 20 Aug 2010 21:32:24 CEST
Lokale ID                     49a7f5e9-0c19-4738-86e5-2c3e50846d72
Zeilennummern                 

Raw-Audit-Meldungen           

node=(entfernt) type=AVC msg=audit(1282332744.660:33169): avc:  denied  { write } for  pid=2397 comm="login" name="agent.4764" dev=dm-0 ino=572194 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=sock_file

node=(entfernt) type=AVC msg=audit(1282332744.660:33169): avc:  denied  { connectto } for  pid=2397 comm="login" path="/tmp/ssh-WyOPhK4764/agent.4764" scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket

node=(entfernt) type=SYSCALL msg=audit(1282332744.660:33169): arch=c000003e syscall=42 success=yes exit=128 a0=4 a1=7fff5a751dd0 a2=6e a3=0 items=0 ppid=1 pid=2397 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty3 ses=4 comm="login" exe="/bin/login" subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null)



Hash String generated from  catchall,login,local_login_t,user_tmp_t,sock_file,write
audit2allow suggests:

#============= local_login_t ==============
allow local_login_t unconfined_t:unix_stream_socket connectto;
allow local_login_t user_tmp_t:sock_file write;
Comment 1 Jochen Schmitt 2010-10-12 15:39:51 UTC 
I assume there is a relationship whith the pam_ssh module.
Comment 2 Daniel Walsh 2010-10-12 17:30:35 UTC 
What does the pam_ssh module do?
Comment 3 Jochen Schmitt 2010-10-12 18:10:53 UTC 
pam_ssh is a so called PAM module which allows you to use your ssh passphrase to login to the system. Therefore a so-called ssh-agent will be started and I assume, that the pam module which will be started by the login process want to communicate with the ssh-agent over a unix socket.
Comment 4 Daniel Walsh 2010-10-12 18:42:20 UTC 
Do you login once and then ssh new ssh agents communicate with the ssh-agent?
Comment 5 Daniel Walsh 2010-10-12 19:43:59 UTC 
Miroslav add

	userdom_stream_connect($1)

to 

interface(`auth_login_pgm_domain',`
Comment 6 Miroslav Grepl 2010-10-13 06:43:04 UTC 
Ok. Fixed in selinux-policy-3.7.19-66.fc13.
Comment 7 Fedora Update System 2010-10-27 08:09:33 UTC 
selinux-policy-3.7.19-69.fc13 has been submitted as an update for Fedora 13.
https://admin.fedoraproject.org/updates/selinux-policy-3.7.19-69.fc13
Comment 8 Fedora Update System 2010-10-28 06:19:57 UTC 
selinux-policy-3.7.19-69.fc13 has been pushed to the Fedora 13 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update selinux-policy'.  You can provide feedback for this update here: https://admin.fedoraproject.org/updates/selinux-policy-3.7.19-69.fc13
Comment 9 Fedora Admin XMLRPC Client 2010-11-08 21:51:21 UTC 
This package has changed ownership in the Fedora Package Database.  Reassigning to the new owner of this component.
Comment 10 Fedora Admin XMLRPC Client 2010-11-08 21:52:45 UTC 
This package has changed ownership in the Fedora Package Database.  Reassigning to the new owner of this component.
Comment 11 Fedora Admin XMLRPC Client 2010-11-08 21:55:14 UTC 
This package has changed ownership in the Fedora Package Database.  Reassigning to the new owner of this component.
Comment 12 Fedora Update System 2010-11-11 22:22:44 UTC 
selinux-policy-3.7.19-69.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.