| Summary: | SELinux is preventing /usr/kerberos/sbin/klogind "read" access on .k5login | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Gowrishankar Rajaiyan <grajaiya> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED ERRATA | QA Contact: | BaseOS QE Security Team <qe-baseos-security> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 6.1 | CC: | dwalsh, jgalipea, kbanerje, mmalik, sgallagh |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-3.7.19-80.el6 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-05-19 12:26:55 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
restorecon -R -v /home Looks like you have a labeling problem. .k5login should not be labeled home_root_t. [root@rhel6-1 ~]# restorecon -R -v /home ... restorecon reset /home/puser1 context unconfined_u:object_r:home_root_t:s0->unconfined_u:object_r:user_home_dir_t:s0 restorecon reset /home/puser1/.k5login context unconfined_u:object_r:home_root_t:s0->unconfined_u:object_r:krb5_home_t:s0 restorecon reset /home/puser1/.bash_history context unconfined_u:object_r:home_root_t:s0->unconfined_u:object_r:user_home_t:s0 ... [root@rhel6-1 ~]# ls -alZ /home/puser1/ drwxr-xr-x. puser1 Group1 unconfined_u:object_r:user_home_dir_t:s0 . drwxr-xr-x. root root system_u:object_r:home_root_t:s0 .. -rw-------. puser1 Group1 unconfined_u:object_r:user_home_t:s0 .bash_history -rw-r--r--. puser1 Group1 unconfined_u:object_r:krb5_home_t:s0 .k5login [root@rhel6-1 ~]# !ss ssh -l puser1 $HOSTNAME puser1.pnq.redhat.com's password: Last login: Fri Mar 25 00:36:53 2011 from rhel6-1.gsr.pnq.redhat.com -bash-4.1$ Summary: SELinux is preventing /usr/libexec/sssd/krb5_child "search" access on /home. Detailed Description: SELinux denied access requested by krb5_child. It is not expected that this access is required by krb5_child and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug report. Additional Information: Source Context unconfined_u:system_r:sssd_t:s0 Target Context system_u:object_r:home_root_t:s0 Target Objects /home [ dir ] Source krb5_child Source Path /usr/libexec/sssd/krb5_child Port <Unknown> Host <Unknown> Source RPM Packages sssd-1.5.1-17.el6 Target RPM Packages filesystem-2.4.30-2.1.el6 Policy RPM selinux-policy-3.7.19-79.el6 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name catchall Host Name rhel6-1.gsr.pnq.redhat.com Platform Linux rhel6-1.gsr.pnq.redhat.com 2.6.32-122.el6.x86_64 #1 SMP Wed Mar 9 23:54:34 EST 2011 x86_64 x86_64 Alert Count 1 First Seen Fri Mar 25 00:40:09 2011 Last Seen Fri Mar 25 00:40:09 2011 Local ID 3e0a7e61-b265-448a-ac94-4c4b27626be5 Line Numbers 7, 8 Raw Audit Messages type=AVC msg=audit(1300993809.266:27612): avc: denied { search } for pid=24223 comm="krb5_child" name="home" dev=dm-0 ino=1046530 scontext=unconfined_u:system_r:sssd_t:s0 tcontext=system_u:object_r:home_root_t:s0 tclass=dir type=SYSCALL msg=audit(1300993809.266:27612): arch=c000003e syscall=21 success=no exit=-13 a0=232b650 a1=0 a2=0 a3=7fffd46a9490 items=0 ppid=23357 pid=24223 auid=0 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=292 comm="krb5_child" exe="/usr/libexec/sssd/krb5_child" subj=unconfined_u:system_r:sssd_t:s0 key=(null) Looks like something knew. I take it sssd needs to read the k5login file? What is triggering this? Dan, in SSSD 1.5.x we added support for a Kerberos access provider that honors the .k5login file. So yes, we need to read it if that provider is in use. Any other content sssd needs to read in homedir? What about nfs and cifs homedirs? Are you doing a setfsuid() Fixed in F15, miroslav need to back port F15 sssd.te and kerberos.if Fixed in selinux-policy-3.7.19-80.el6 [root@rhel6-1 ~]# sestatus SELinux status: enabled SELinuxfs mount: /selinux Current mode: enforcing Mode from config file: enforcing Policy version: 24 Policy from config file: targeted [root@rhel6-1 ~]# [root@rhel6-1 ~]# ls -lZa /home/puser1/ drwxr-xr-x. puser1 Group1 unconfined_u:object_r:user_home_dir_t:s0 . drwxr-xr-x. root root system_u:object_r:home_root_t:s0 .. -rw-------. puser1 Group1 unconfined_u:object_r:user_home_t:s0 .bash_history -rw-r--r--. puser1 Group1 unconfined_u:object_r:krb5_home_t:s0 .k5login [root@rhel6-1 ~]# ssh -l puser1 $HOSTNAME puser1.pnq.redhat.com's password: Connection closed by XX.XX.XXX.XX [root@rhel6-1 ~]# sealert -a /var/log/audit/audit.log 100% donefound 0 alerts in /var/log/audit/audit.log [root@rhel6-1 ~]# rpm -qi selinux-policy Name : selinux-policy Relocations: (not relocatable) Version : 3.7.19 Vendor: Red Hat, Inc. Release : 80.el6 Build Date: Fri 25 Mar 2011 04:17:33 PM IST Install Date: Fri 25 Mar 2011 11:27:03 PM IST Build Host: s390-006.build.bos.redhat.com Group : System Environment/Base Source RPM: selinux-policy-3.7.19-80.el6.src.rpm Size : 7868123 License: GPLv2+ Signature : (none) Packager : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla> URL : http://oss.tresys.com/repos/refpolicy/ Summary : SELinux policy configuration Description : SELinux Reference Policy - modular. Based off of reference policy: Checked out revision 2.20091117 An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2011-0526.html |
Description of problem: SELinux denied access requested by klogind. It is not expected that this access is required by klogind and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Version-Release number of selected component (if applicable): selinux-policy-3.7.19-79.el6.noarch How reproducible: Always Steps to Reproduce: 1. Configure SSSD for LDAP id and Krb5 auth. 2. Make sure to set "access_provider = krb5" in sssd.conf. See additional info for relevant domain section. 3. Login as a user. 4. Create empty .k5login. 5. Try authenticating again. Actual results: Authentication is successful. Expected results: An empty .k5login file should deny all access to this user. Additional info: Relevant sssd.conf: [domain/LDAP-KRB5] id_provider = ldap ldap_uri = ldaps://sssdldap.redhat.com:636 ldap_search_base = dc=example,dc=com ldap_tls_reqcert = demand ldap_tls_cacertdir = /etc/openldap/cacerts ldap_tls_cacert = /etc/openldap/cacerts/cacert.asc cache_credentials = true enumerate = false debug_level = 9 krb5_realm = EXAMPLE.COM auth_provider = krb5 access_provider = krb5 krb5_kdcip = sssdldap.redhat.com:88 krb5_ccachedir = /tmp/krb5_cache krb5_ccname_template = FILE:%d/krb5cc_%u Source Context unconfined_u:system_r:rlogind_t:s0-s0:c0.c1023 Target Context unconfined_u:object_r:home_root_t:s0 Target Objects .k5login [ file ] Source klogind Source Path /usr/kerberos/sbin/klogind Port <Unknown> Host <Unknown> Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.7.19-79.el6 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name catchall Host Name rhel6-1.gsr.pnq.redhat.com Platform Linux rhel6-1.gsr.pnq.redhat.com 2.6.32-122.el6.x86_64 #1 SMP Wed Mar 9 23:54:34 EST 2011 x86_64 x86_64 Alert Count 2 First Seen Thu Mar 24 15:55:32 2011 Last Seen Thu Mar 24 15:56:02 2011 Local ID 76d04883-6f2e-4505-b0d5-c5423a2a0b46 Line Numbers 162, 163, 220, 221 Raw Audit Messages type=AVC msg=audit(1300962362.34:27040): avc: denied { read } for pid=23183 comm="klogind" name=".k5login" dev=dm-0 ino=1052335 scontext=unconfined_u:system_r:rlogind_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:home_root_t:s0 tclass=file type=SYSCALL msg=audit(1300962362.34:27040): arch=c000003e syscall=2 success=no exit=-13 a0=7fc5e8ae9350 a1=0 a2=1b6 a3=0 items=0 ppid=22508 pid=23183 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=292 comm="klogind" exe="/usr/kerberos/sbin/klogind" subj=unconfined_u:system_r:rlogind_t:s0-s0:c0.c1023 key=(null)