| Summary: | reloading dbus config on a machine with ypserv but not ypbind causes selinux AVC denials | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 5 | Reporter: | Chris Duryee <cduryee> |
| Component: | ypserv | Assignee: | Honza Horak <hhorak> |
| Status: | CLOSED NOTABUG | QA Contact: | qe-baseos-daemons |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 5.7 | ||
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-05-13 07:42:08 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
|
Description
Chris Duryee
2011-04-12 19:55:39 UTC
Hi Chris, I've tested this issue in many scenarios and this is what I found: The steps to reproduce from comment #1 didn't work for me, while I didn't see any AVC denials using ypserv configured alone (and ypbind disabled). However I could reproduce it when I tried to start ypbind, which had been binded to a server, that didn't serve the NIS services (e.g. localhost without ypserv running). If I boot with ypbind disabled, there is no problem with the dbus-send command (it doesn't matter how allow_ypbind is set). Then, after trying to start ypbind daemon (which fails because there is no server running), the dbus-send command triggers AVC denial messages, but only allow_ypbind is set to 0. So it seems like there is "something" (somewhere) changed in the system even if ypbind wasn't started correctly. Nevertheless, I haven't found a problem in ypbind yet, while the daemon seems to be always finished correctly (portmap binding too). But generally, if I have ypbind configured to start on boot, shouldn't the allow_ypbind be enabled every time in this case? Example of my AVC denial messages (hope they are the same as yours): type=AVC msg=audit(1303146131.442:56): avc: denied { name_connect } for pid=1816 comm="dbus-daemon" dest=111 scontext=system_u:system_r:system_dbusd_t:s0 tcontext=system_u:object_r:portmap_port_t:s0 tclass=tcp_socket type=SYSCALL msg=audit(1303146131.442:56): arch=c000003e syscall=42 success=no exit=-13 a0=18 a1=7ffff623ff10 a2=10 a3=2 items=0 ppid=1 pid=1816 auid=4294967295 uid=81 gid=81 euid=81 suid=81 fsuid=81 egid=81 sgid=81 fsgid=81 tty=(none) comm="dbus-daemon" exe="/bin/dbus-daemon" subj=system_u:system_r:system_dbusd_t:s0 key=(null) Please, see bug #474187, too. There is a similar issue discussed and it seems that setting setsebool -P allow_ypbind=1 permanently can be good enough in this case. Jan, I am going to unlink this bug from mine, since a workaround is provided. Thanks! That's good news, Chris, so I'm closing this as a notabug, too. |