Bug 747608

Summary: sssd needs to be allowed to create, delete and read symlinks in /var/lib/sss/pipes/private
Product: [Fedora] Fedora Reporter: Jakub Hrozek <jhrozek>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED RAWHIDE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: high    
Version: rawhideCC: dominick.grift, dwalsh, jbastian, ksrot, mgrepl, mmalik, sgallagh, smizrahi, syeghiay
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 746265 Environment:
Last Closed: 2011-10-20 13:51:16 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Jakub Hrozek 2011-10-20 13:47:37 UTC 
+++ This bug was initially created as a clone of Bug #746265 +++

Description of problem:
The fix for https://bugzilla.redhat.com/show_bug.cgi?id=743841 included creating a symlink to a dbus socket in the /var/lib/sss/pipes/private directory. However, the selinux-policy must be tweaked in order to allow SSSD to manage symlinks there.

This BZ is a dependency of https://bugzilla.redhat.com/show_bug.cgi?id=743841

Version-Release number of selected component (if applicable):
selinux-policy-3.7.19-117.el6

How reproducible:
always

Steps to Reproduce:
1. install RHEL6.2 candidate SSSD (sssd-1.5.1-56 or newer)
2. service sssd start
3.
  
Actual results:
AVC denials

Expected results:
no AVC denials

Additional info:
Code-wise, we do:
 * symlink
 * stat
 * readlink
 * unlink

symlink, readlink and unlink on the symlink are only be called from sssd_be now, stat is done from the other sssd processes as well

--- Additional comment from jhrozek on 2011-10-14 11:12:46 EDT ---

type=AVC msg=audit(1318596215.810:92920): avc:  denied  { create } for  pid=19521 comm="sssd_be" name="sbus-dp_AD" scontext=unconfined_u:system_r:sssd_t:s0 tcontext=unconfined_u:object_r:sssd_var_lib_t:s0 tclass=lnk_file

type=AVC msg=audit(1318597994.204:92998): avc:  denied  { read } for  pid=19521 comm="sssd_be" name="sbus-dp_AD" dev=dm-0 ino=1833784 scontext=unconfined_u:system_r:sssd_t:s0 tcontext=unconfined_u:object_r:sssd_var_lib_t:s0 tclass=lnk_file

type=AVC msg=audit(1318597994.204:92999): avc:  denied  { unlink } for  pid=19521 comm="sssd_be" name="sbus-dp_AD" dev=dm-0 ino=1833784 scontext=unconfined_u:system_r:sssd_t:s0 tcontext=unconfined_u:object_r:sssd_var_lib_t:s0 tclass=lnk_file

type=AVC msg=audit(1318596216.167:92921): avc:  denied  { read } for  pid=19522 comm="sssd_nss" name="sbus-dp_AD" dev=dm-0 ino=1833784 scontext=unconfined_u:system_r:sssd_t:s0 tcontext=unconfined_u:object_r:sssd_var_lib_t:s0 tclass=lnk_file
Comment 1 Miroslav Grepl 2011-10-20 13:51:16 UTC 
Also added to Rawhide.
Comment 2 Jakub Hrozek 2011-10-20 13:52:43 UTC 
Stephen, I think we must hold off releasing 1.5.14 (in updates-testing now), until this is fixed, otherwise we'd break all enforcing sssd installations.
Comment 3 Stephen Gallagher 2011-10-21 14:20:44 UTC 
Miroslav, we need this bug fixed in Fedora 15 and 16 as well. Please perform a Koji build and tell me the package NVR. I will add that version of the selinux-policy package to the Bodhi update containing SSSD 1.5.14 and 1.6.2 (F15 and F16, respectively).
Comment 4 Daniel Walsh 2011-10-21 14:42:37 UTC 
Looks like it was added to F16 as of

selinux-policy-3.10.0-41.f16

And F15 seems to have it in 

selinux-policy-3.9.16-44.fc15
Comment 5 Stephen Gallagher 2011-10-21 15:00:26 UTC 
Ok, I've added those to the following Bodhi Updates:
 * https://admin.fedoraproject.org/updates/FEDORA-2011-14639 (Fedora 15)
 * https://admin.fedoraproject.org/updates/FEDORA-2011-14614 (Fedora 16)