Bug 713218
| Summary: | Add policy to allow kerberos kadmind to communicate with openldap via ldapi | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Jonathan Underwood <jonathan.underwood> | ||||
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | 6.0 | CC: | dwalsh, mmalik, syeghiay | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | selinux-policy-3.7.19-98.el6 | Doc Type: | Bug Fix | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2011-12-06 10:08:36 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
Created attachment 504728 [details]
sample audit.log entries for kadmind
I think this is fixed in the 6.1 policy. I know it is in selinux-policy-3.7.19-98.el6 which is the preview of the 6.2 policy. Preview available on people.redhat.com/dwalsh/SELinux/RHEL6 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2011-1511.html |
Description of problem: Currently SElinux policy forbids kadmind from communicating with slapd via ldapi. Version-Release number of selected component (if applicable): libselinux-2.0.94-2.el6.x86_64 libselinux-utils-2.0.94-2.el6.x86_64 selinux-policy-3.7.19-54.el6_0.5.noarch libselinux-ruby-2.0.94-2.el6.x86_64 selinux-policy-targeted-3.7.19-54.el6_0.5.noarch krb5-server-1.8.2-3.el6_0.7.x86_64 krb5-server-ldap-1.8.2-3.el6_0.7.x86_64 krb5-workstation-1.8.2-3.el6_0.7.x86_64 krb5-libs-1.8.2-3.el6_0.7.x86_64 openldap-2.4.19-15.el6_0.2.x86_64 openldap-servers-2.4.19-15.el6_0.2.x86_64 openldap-clients-2.4.19-15.el6_0.2.x86_64 How reproducible: Everytime Steps to Reproduce: 1.Configure krb5.conf such that kadmin it is communicating to a backend openldap database on same host 2. Try to start kadmin service 3. Actual results: Starting Kerberos 5 Admin Server: kadmind: Can't contact LDAP server while initializing, aborting Expected results: kadmin service starts Additional info: setenforce 0 does allow kadmin to start. Basically we need to allow kadmind to communicate with slapd via a socket (/var/run/ldapi) Generating an selinux module with: grep kadmin audit.log | audit2allow -M kadminldapilocal produces the following kadminldapilocal.te module kadminldapilocal 1.0; require { type slapd_t; type slapd_var_run_t; type kadmind_t; class sock_file write; class unix_stream_socket connectto; } #============= kadmind_t ============== allow kadmind_t slapd_t:unix_stream_socket connectto; allow kadmind_t slapd_var_run_t:sock_file write;