Bug 752487
| Summary: | Finger cannot connect to ldap server | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 5 | Reporter: | Brian Wheeler <bdwheele> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | low | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 5.7 | CC: | dwalsh, mmalik |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2012-02-21 05:48:26 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Brian Wheeler
2011-11-09 16:41:04 UTC
I see the same AVC as you do:
----
time->Wed Nov 30 05:44:20 2011
type=SYSCALL msg=audit(1322649860.667:99927): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bf921698 a2=f780f8 a3=9cb6db8 items=0 ppid=2033 pid=2088 auid=0 uid=99 gid=99 euid=99 suid=99 fsuid=99 egid=99 sgid=99 fsgid=99 tty=(none) ses=9149 comm="finger" exe="/usr/bin/finger" subj=root:system_r:fingerd_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1322649860.667:99927): avc: denied { connect } for pid=2088 comm="finger" scontext=root:system_r:fingerd_t:s0-s0:c0.c1023 tcontext=root:system_r:fingerd_t:s0-s0:c0.c1023 tclass=tcp_socket
----
You can get rid of it using "setsebool ypbind on" command. However, finger command would not work as expected and another AVC will probably arise:
----
time->Wed Nov 30 05:35:07 2011
type=SYSCALL msg=audit(1322649307.681:99893): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bf7ff078 a2=af00f8 a3=99aa088 items=0 ppid=658 pid=709 auid=0 uid=99 gid=99 euid=99 suid=99 fsuid=99 egid=99 sgid=99 fsgid=99 tty=(none) ses=9149 comm="finger" exe="/usr/bin/finger" subj=root:system_r:fingerd_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1322649307.681:99893): avc: denied { name_connect } for pid=709 comm="finger" dest=389 scontext=root:system_r:fingerd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:ldap_port_t:s0 tclass=tcp_socket
----
Following policy module solved the timing-out problem for me, but I would like to know if it works for you too:
---- cut here ----
module mypol 1.0;
require {
type fingerd_t;
type ldap_port_t;
class tcp_socket { name_connect connect };
}
#============= fingerd_t ==============
allow fingerd_t ldap_port_t:tcp_socket name_connect;
allow fingerd_t self:tcp_socket connect;
---- cut here ----
save the above-mentioned text to mypol.te
# make -f /usr/share/selinux/devel/Makefile
# semodule -i mypol.pp
Does the finger command work as expected now?
We have the authlogin_nsswitch_use_ldap boolean for this in RHEL6. Milos, you are saying if you test it with the latest build and with the enabled allow_ypbind boolean, this won't work? I'm sorry my tests were executed on machine where selinux-policy-2.4.6-317.el5 was installed. After upgrade to selinux-policy-2.4.6-320.el5 finger seems to work (no timeout, no AVCs). Latest policy is available here: http://people.redhat.com/dwalsh/SELinux/RHEL5/noarch/ Please let us know if this policy solved your problem. yes, because of auth_use_nsswitch() was added. (In reply to comment #5) > Latest policy is available here: > > http://people.redhat.com/dwalsh/SELinux/RHEL5/noarch/ > > Please let us know if this policy solved your problem. 2.4.6-320 fixes it. Thanks! Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2012-0158.html |