Bug 685116

Summary: mls: selinux blocks console login
Product: Red Hat Enterprise Linux 6 Reporter: Karel Srot <ksrot>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED ERRATA QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: high Docs Contact:
Priority: high    
Version: 6.1CC: dwalsh, linda.knippers, plautrba, sgrubb
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: selinux-policy-3.7.19-79.el6 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-05-19 08:24:30 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On:    
Bug Blocks: 682670, 584498, 846801, 846802    
Attachments:
Description Flags
audit.log after console login none

Description Karel Srot 2011-03-15 06:54:11 EDT
Description of problem:

1. installed RHEL6.1-20110311.3 with mls policy
2. updated grub kernel line with console=ttyS0
3. opened console:  virsh console rhel6-64
4. system start up logs into the console but I do not get the login prompt

Following module fixes the problem for me but it is not probably the best solution.

module mypoltty 1.0;

require {
	type etc_t;
	type initrc_t;
	class file write;
}

#============= initrc_t ==============
allow initrc_t etc_t:file write;


Version-Release number of selected component (if applicable):
selinux-policy-mls-3.7.19-78.el6
RHEL6.1-20110311.3

How reproducible:
always

Steps to Reproduce:
above
  
Actual results:
no login prompt

type=SYSCALL msg=audit(1300185968.999:7): arch=c000003e syscall=2 success=no exit=-13 a0=400f08 a1=2 a2=18 a3=7fff03200aa0 items=0 ppid=1 pid=1229 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="securetty" exe="/sbin/securetty" subj=system_u:system_r:initrc_t:s0-s15:c0.c1023 key=(null)
type=AVC msg=audit(1300185968.999:7): avc:  denied  { write } for  pid=1229 comm="securetty" name="securetty" dev=dm-0 ino=19310 scontext=system_u:system_r:initrc_t:s0-s15:c0.c1023 tcontext=system_u:object_r:etc_t:s0 tclass=file
Comment 1 Karel Srot 2011-03-15 07:40:52 EDT
securetty is trying to add "ttyS0" to /etc/securetty. 
1. Is securetty supposed to do it in MLS?
2. I cannot login even if it is already there, this seems to be some initscript bug.
Comment 2 Daniel Walsh 2011-03-15 08:20:52 EDT
I do not think they are related.   Not sure why you can not login via the console?  What platform is this happing on?  ppc?
Comment 3 Daniel Walsh 2011-03-15 08:21:51 EDT
Looks like we might need a policy for securetty
Comment 4 Daniel Walsh 2011-03-15 08:24:18 EDT
Or change the label on /etc/securetty to etc_runtime_t.

chcon -t etc_runtime_t /etc/securetty 

Should elminate the AVC.

Can you execute semodule -DB and see if their are avcs relabeled to console_device_t when you login?
Comment 5 Miroslav Grepl 2011-03-15 08:56:36 EDT
I am seeing the same issue. 


I think we should add the etc_runtime_t label for now. And I can try to write a policy for that.
Comment 6 Miroslav Grepl 2011-03-15 09:38:45 EDT
Karel,
it works fine for me with

chcon -t etc_runtime_t /etc/securetty 


And I am not seeing AVC msgs which Dan mentioned in the comment #4.
Comment 7 Karel Srot 2011-03-15 09:44:15 EDT
Created attachment 484502 [details]
audit.log after console login

I am testing on virtual (kvm/qemu) x86_64 host on x86_64 RHEL6 guest.
Changing the context allowed me to login, I am adding the audit.log as the attachment.
Comment 8 Daniel Walsh 2011-03-15 10:07:11 EDT
Well if you are able to login with the securetty completing successfull, no other changes need to be made other then changing the label on /etc/securettys
Comment 9 Daniel Walsh 2011-03-15 10:08:08 EDT
The only concern with changing this label would be if other confined domains need to read it and can not.  I think all login domains can read it, not sure what else would read it.
Comment 11 Linda Knippers 2011-03-16 17:34:09 EDT
The 'chcon -t etc_runtime_t /etc/securetty' command suggested in the BZ
resolved an AVC I was seeing and also allows the getty to start on the 
console of my RHEL6.1 mls test system.
Comment 12 Miroslav Grepl 2011-03-17 06:29:04 EDT
Fixed in selinux-policy-3.7.19-79.el6
Comment 16 errata-xmlrpc 2011-05-19 08:24:30 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-0526.html