Bug 690466

Summary: SELinux is preventing /usr/kerberos/sbin/klogind "read" access on .k5login
Product: Red Hat Enterprise Linux 6 Reporter: Gowrishankar Rajaiyan <grajaiya>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED ERRATA QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: medium Docs Contact:
Priority: medium    
Version: 6.1CC: dwalsh, jgalipea, kbanerje, mmalik, sgallagh
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: selinux-policy-3.7.19-80.el6 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-05-19 12:26:55 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Gowrishankar Rajaiyan 2011-03-24 12:26:05 UTC
Description of problem:
SELinux denied access requested by klogind. It is not expected that this access
is required by klogind and this access may signal an intrusion attempt. It is
also possible that the specific version or configuration of the application is
causing it to require additional access.


Version-Release number of selected component (if applicable):
selinux-policy-3.7.19-79.el6.noarch

How reproducible:
Always

Steps to Reproduce:
1. Configure SSSD for LDAP id and Krb5 auth.
2. Make sure to set "access_provider = krb5" in sssd.conf. See additional info for relevant domain section.
3. Login as a user.
4. Create empty .k5login.
5. Try authenticating again.
  
Actual results:
Authentication is successful.

Expected results:
An empty .k5login file should deny all access to this user.

Additional info:
Relevant sssd.conf:
[domain/LDAP-KRB5]
id_provider = ldap
ldap_uri = ldaps://sssdldap.redhat.com:636
ldap_search_base = dc=example,dc=com
ldap_tls_reqcert = demand
ldap_tls_cacertdir = /etc/openldap/cacerts
ldap_tls_cacert = /etc/openldap/cacerts/cacert.asc
cache_credentials = true
enumerate = false
debug_level = 9
krb5_realm = EXAMPLE.COM
auth_provider = krb5
access_provider = krb5
krb5_kdcip = sssdldap.redhat.com:88
krb5_ccachedir = /tmp/krb5_cache
krb5_ccname_template = FILE:%d/krb5cc_%u



Source Context                unconfined_u:system_r:rlogind_t:s0-s0:c0.c1023
Target Context                unconfined_u:object_r:home_root_t:s0
Target Objects                .k5login [ file ]
Source                        klogind
Source Path                   /usr/kerberos/sbin/klogind
Port                          <Unknown>
Host                          <Unknown>
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.7.19-79.el6
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     rhel6-1.gsr.pnq.redhat.com
Platform                      Linux rhel6-1.gsr.pnq.redhat.com
                              2.6.32-122.el6.x86_64 #1 SMP Wed Mar 9 23:54:34
                              EST 2011 x86_64 x86_64
Alert Count                   2
First Seen                    Thu Mar 24 15:55:32 2011
Last Seen                     Thu Mar 24 15:56:02 2011
Local ID                      76d04883-6f2e-4505-b0d5-c5423a2a0b46
Line Numbers                  162, 163, 220, 221

Raw Audit Messages            

type=AVC msg=audit(1300962362.34:27040): avc:  denied  { read } for  pid=23183 comm="klogind" name=".k5login" dev=dm-0 ino=1052335 scontext=unconfined_u:system_r:rlogind_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:home_root_t:s0 tclass=file

type=SYSCALL msg=audit(1300962362.34:27040): arch=c000003e syscall=2 success=no exit=-13 a0=7fc5e8ae9350 a1=0 a2=1b6 a3=0 items=0 ppid=22508 pid=23183 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=292 comm="klogind" exe="/usr/kerberos/sbin/klogind" subj=unconfined_u:system_r:rlogind_t:s0-s0:c0.c1023 key=(null)

Comment 2 Daniel Walsh 2011-03-24 18:39:33 UTC
restorecon -R -v /home

Looks like you have a labeling problem.  .k5login should not be labeled home_root_t.

Comment 3 Gowrishankar Rajaiyan 2011-03-24 19:12:42 UTC
[root@rhel6-1 ~]# restorecon -R -v /home
...
restorecon reset /home/puser1 context unconfined_u:object_r:home_root_t:s0->unconfined_u:object_r:user_home_dir_t:s0
restorecon reset /home/puser1/.k5login context unconfined_u:object_r:home_root_t:s0->unconfined_u:object_r:krb5_home_t:s0
restorecon reset /home/puser1/.bash_history context unconfined_u:object_r:home_root_t:s0->unconfined_u:object_r:user_home_t:s0
...

[root@rhel6-1 ~]# ls -alZ /home/puser1/
drwxr-xr-x. puser1 Group1 unconfined_u:object_r:user_home_dir_t:s0 .
drwxr-xr-x. root   root   system_u:object_r:home_root_t:s0 ..
-rw-------. puser1 Group1 unconfined_u:object_r:user_home_t:s0 .bash_history
-rw-r--r--. puser1 Group1 unconfined_u:object_r:krb5_home_t:s0 .k5login

[root@rhel6-1 ~]# !ss
ssh -l puser1 $HOSTNAME
puser1.pnq.redhat.com's password: 
Last login: Fri Mar 25 00:36:53 2011 from rhel6-1.gsr.pnq.redhat.com
-bash-4.1$ 


Summary:

SELinux is preventing /usr/libexec/sssd/krb5_child "search" access on /home.

Detailed Description:

SELinux denied access requested by krb5_child. It is not expected that this
access is required by krb5_child and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug
report.

Additional Information:

Source Context                unconfined_u:system_r:sssd_t:s0
Target Context                system_u:object_r:home_root_t:s0
Target Objects                /home [ dir ]
Source                        krb5_child
Source Path                   /usr/libexec/sssd/krb5_child
Port                          <Unknown>
Host                          <Unknown>
Source RPM Packages           sssd-1.5.1-17.el6
Target RPM Packages           filesystem-2.4.30-2.1.el6
Policy RPM                    selinux-policy-3.7.19-79.el6
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     rhel6-1.gsr.pnq.redhat.com
Platform                      Linux rhel6-1.gsr.pnq.redhat.com
                              2.6.32-122.el6.x86_64 #1 SMP Wed Mar 9 23:54:34
                              EST 2011 x86_64 x86_64
Alert Count                   1
First Seen                    Fri Mar 25 00:40:09 2011
Last Seen                     Fri Mar 25 00:40:09 2011
Local ID                      3e0a7e61-b265-448a-ac94-4c4b27626be5
Line Numbers                  7, 8

Raw Audit Messages            

type=AVC msg=audit(1300993809.266:27612): avc:  denied  { search } for  pid=24223 comm="krb5_child" name="home" dev=dm-0 ino=1046530 scontext=unconfined_u:system_r:sssd_t:s0 tcontext=system_u:object_r:home_root_t:s0 tclass=dir

type=SYSCALL msg=audit(1300993809.266:27612): arch=c000003e syscall=21 success=no exit=-13 a0=232b650 a1=0 a2=0 a3=7fffd46a9490 items=0 ppid=23357 pid=24223 auid=0 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=292 comm="krb5_child" exe="/usr/libexec/sssd/krb5_child" subj=unconfined_u:system_r:sssd_t:s0 key=(null)

Comment 4 Daniel Walsh 2011-03-24 19:22:08 UTC
Looks like something knew.  I take it sssd needs to read the k5login file?

What is triggering this?

Comment 5 Stephen Gallagher 2011-03-24 19:26:29 UTC
Dan, in SSSD 1.5.x we added support for a Kerberos access provider that honors the .k5login file. So yes, we need to read it if that provider is in use.

Comment 6 Daniel Walsh 2011-03-24 19:28:15 UTC
Any other content sssd needs to read in homedir?

What about nfs and cifs homedirs?  Are you doing a setfsuid()

Comment 7 Daniel Walsh 2011-03-24 19:35:23 UTC
Fixed in F15, miroslav need to back port F15 sssd.te and kerberos.if

Comment 8 Miroslav Grepl 2011-03-25 12:54:55 UTC
Fixed in selinux-policy-3.7.19-80.el6

Comment 10 Gowrishankar Rajaiyan 2011-03-25 18:40:20 UTC
[root@rhel6-1 ~]# sestatus 
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 24
Policy from config file:        targeted
[root@rhel6-1 ~]#


[root@rhel6-1 ~]# ls -lZa /home/puser1/
drwxr-xr-x. puser1 Group1 unconfined_u:object_r:user_home_dir_t:s0 .
drwxr-xr-x. root   root   system_u:object_r:home_root_t:s0 ..
-rw-------. puser1 Group1 unconfined_u:object_r:user_home_t:s0 .bash_history
-rw-r--r--. puser1 Group1 unconfined_u:object_r:krb5_home_t:s0 .k5login


[root@rhel6-1 ~]# ssh -l puser1 $HOSTNAME
puser1.pnq.redhat.com's password: 
Connection closed by XX.XX.XXX.XX


[root@rhel6-1 ~]# sealert -a /var/log/audit/audit.log
100% donefound 0 alerts in /var/log/audit/audit.log



[root@rhel6-1 ~]# rpm -qi selinux-policy
Name        : selinux-policy               Relocations: (not relocatable)
Version     : 3.7.19                            Vendor: Red Hat, Inc.
Release     : 80.el6                        Build Date: Fri 25 Mar 2011 04:17:33 PM IST
Install Date: Fri 25 Mar 2011 11:27:03 PM IST      Build Host: s390-006.build.bos.redhat.com
Group       : System Environment/Base       Source RPM: selinux-policy-3.7.19-80.el6.src.rpm
Size        : 7868123                          License: GPLv2+
Signature   : (none)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
URL         : http://oss.tresys.com/repos/refpolicy/
Summary     : SELinux policy configuration
Description :
SELinux Reference Policy - modular.
Based off of reference policy: Checked out revision  2.20091117

Comment 11 errata-xmlrpc 2011-05-19 12:26:55 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-0526.html