Bug 750840

Summary: Denials when using CHIL crypto device in httpd
Product: Red Hat Enterprise Linux 6 Reporter: Miroslav Vadkerti <mvadkert>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED WONTFIX QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: medium Docs Contact:
Priority: medium    
Version: 6.2CC: dwalsh, mmalik
Target Milestone: rc   
Target Release: 6.3   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-11-02 18:37:45 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Miroslav Vadkerti 2011-11-02 14:00:25 UTC 
Description of problem:
When testing bug 693863 on RHEL6 with enabled netHSM 6000 hardware I got the denials below when trying to start httpd with SSLCryptoDevice chil:

time->Wed Nov  2 09:52:43 2011
type=SYSCALL msg=audit(1320241963.697:47230): arch=c000003e syscall=42 success=yes exit=0 a0=d a1=7fff1acdf470 a2=6e a3=9 items=0 ppid=23024 pid=23025 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=6096 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1320241963.697:47230): avc:  denied  { connectto } for  pid=23025 comm="httpd" path="/dev/nfast/nserver" scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=unix_stream_socket
type=AVC msg=audit(1320241963.697:47230): avc:  denied  { write } for  pid=23025 comm="httpd" name="nserver" dev=devtmpfs ino=18237 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=sock_file

The engine is installed in /opt and the it's libraries have
system_u:object_r:lib_t:s0 
context

Version-Release number of selected component (if applicable):
selinux-policy-3.7.19-120.el6.noarch

How reproducible:
100%

Steps to Reproduce:
1. Have a machine connected to netHSM 6000
2. Install mod_ssl and httpd
2. Add SSLCryptoDevice chil to ssl.conf
3. Restart httpd
  
Actual results:
httpd fails to start

Expected results:
httpd starts and crypto engine is usable

Additional info:
Setting bin_t context on the used library doesn't help:
# chcon -t bin_t /opt/nfast/toolkits/hwcrhk/libnfhwcrhk.so

Note to tester:
Please contact me when testing this bug
Comment 1 Daniel Walsh 2011-11-02 15:09:38 UTC 
What is this and what should it be labeled? /dev/nfast/nserver
Comment 2 Miroslav Grepl 2011-11-02 15:15:34 UTC 
Mirek,
also what does

# ps -eZ |grep initrc
Comment 4 Daniel Walsh 2011-11-02 15:27:59 UTC 
I think we would need new policy for nserver to make this work.  We do not ship this correct?
Comment 5 Miroslav Grepl 2011-11-02 15:49:39 UTC 
Yes, we don't ship this.
Comment 6 Daniel Walsh 2011-11-02 18:37:45 UTC 
Well it seems to be  badly designed package.  It should not be using /dev for this socket, it should be in /var/run.

I think the only solution is to build custom policy to allow this access.

Miroslav Vadkerti I suggest you request policy be started on this in Fedora.