Bug 759679
| Summary: | ipa_kpasswd does not work with selinux in enforcing mode | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Evgeny Sinelnikov <sin> |
| Component: | freeipa | Assignee: | Rob Crittenden <rcritten> |
| Status: | CLOSED NEXTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 16 | CC: | abokovoy, deron.meranda, dew, dietervandenbroeck, dwalsh, hhorak, jfarre, mgrepl, mkosek, rcritten, ssorce |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | freeipa-2.1.3-8.fc16 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | 754072 | Environment: | |
| Last Closed: | 2011-12-05 18:09:13 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Evgeny Sinelnikov
2011-12-03 03:12:32 UTC
A temporary workaround is: /usr/sbin/setsebool authlogin_nsswitch_use_ldap on We have our own SELinux policy for ipa_kpasswd, not sure if we need to allow it to read /dev/urandom ourselves or if this should be changed in selinux-policy. Thanks, it's really works. But I'm already create updated selinux policy: http://git.etersoft.ru/people/sin/packages/?p=freeipa.git;a=commitdiff;h=04137ed07936430bd6d0f4084465ec21082903a0 There are few more avcs:
Dec 3 01:12:26 vm-047 systemd-logind[701]: New session 78 of user root.
Dec 3 01:12:30 vm-047 kernel: [212678.760809] type=1400 audit(1322892750.400:355): avc: denied { getattr } for pid=2638 comm="krb5kdc" path="/etc/krb5.conf" dev=dm-0 ino=9992 scontext=system_u:system_r:krb5kdc_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file
Dec 3 01:13:06 vm-047 kernel: [212715.067845] type=1400 audit(1322892786.708:356): avc: denied { getattr } for pid=2698 comm="httpd" path="/etc/krb5.conf" dev=dm-0 ino=9992 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file
Dec 3 01:13:06 vm-047 kernel: [212715.067907] type=1400 audit(1322892786.708:357): avc: denied { read } for pid=2698 comm="httpd" name="krb5.conf" dev=dm-0 ino=9992 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file
Dec 3 01:13:06 vm-047 kernel: [212715.067936] type=1400 audit(1322892786.708:358): avc: denied { open } for pid=2698 comm="httpd" name="krb5.conf" dev=dm-0 ino=9992 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file
Dec 3 01:13:07 vm-047 kernel: [212715.359261] type=1400 audit(1322892786.999:359): avc: denied { read } for pid=2579 comm="ns-slapd" name="krb5.conf" dev=dm-0 ino=9992 scontext=system_u:system_r:dirsrv_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file
Dec 3 01:13:07 vm-047 kernel: [212715.359282] type=1400 audit(1322892786.999:360): avc: denied { getattr } for pid=2579 comm="ns-slapd" path="/etc/krb5.conf" dev=dm-0 ino=9992 scontext=system_u:system_r:dirsrv_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file
Dec 3 01:13:07 vm-047 kernel: [212715.359734] type=1400 audit(1322892786.999:361): avc: denied { open } for pid=2579 comm="ns-slapd" name="hosts" dev=dm-0 ino=973 scontext=system_u:system_r:dirsrv_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file
Dec 3 01:13:46 vm-047 kernel: [212755.082544] type=1400 audit(1322892826.722:362): avc: denied { getattr } for pid=17540 comm="ipa_kpasswd" path="/etc/krb5.conf" dev=dm-0 ino=9992 scontext=system_u:system_r:ipa_kpasswd_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file
Dec 3 01:13:46 vm-047 kernel: [212755.082633] type=1400 audit(1322892826.722:363): avc: denied { read } for pid=17540 comm="ipa_kpasswd" name="krb5.conf" dev=dm-0 ino=9992 scontext=system_u:system_r:ipa_kpasswd_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file
Dec 3 01:13:46 vm-047 kernel: [212755.082644] type=1400 audit(1322892826.722:364): avc: denied { open } for pid=17540 comm="ipa_kpasswd" name="krb5.conf" dev=dm-0 ino=9992 scontext=system_u:system_r:ipa_kpasswd_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file
Dec 3 01:13:46 vm-047 kernel: [212755.083076] type=1400 audit(1322892826.723:365): avc: denied { read } for pid=17540 comm="ipa_kpasswd" name="urandom" dev=devtmpfs ino=4278 scontext=system_u:system_r:ipa_kpasswd_t:s0 tcontext=system_u:object_r:urandom_device_t:s0 tclass=chr_file
Dec 3 01:13:46 vm-047 kernel: [212755.083088] type=1400 audit(1322892826.723:366): avc: denied { open } for pid=17540 comm="ipa_kpasswd" name="urandom" dev=devtmpfs ino=4278 scontext=system_u:system_r:ipa_kpasswd_t:s0 tcontext=system_u:object_r:urandom_device_t:s0 tclass=chr_file
Dec 3 01:13:46 vm-047 kernel: [212755.083530] type=1400 audit(1322892826.723:367): avc: denied { getattr } for pid=17540 comm="ipa_kpasswd" path="/dev/urandom" dev=devtmpfs ino=4278 scontext=system_u:system_r:ipa_kpasswd_t:s0 tcontext=system_u:object_r:urandom_device_t:s0 tclass=chr_file
Dec 3 01:13:46 vm-047 kernel: [212755.235948] type=1400 audit(1322892826.875:368): avc: denied { name_connect } for pid=17540 comm="ipa_kpasswd" dest=389 scontext=system_u:system_r:ipa_kpasswd_t:s0 tcontext=system_u:object_r:ldap_port_t:s0 tclass=tcp_socket
Following rules are generated by audit2allow:
#============= dirsrv_t ==============
allow dirsrv_t file_t:file { read getattr open };
#============= httpd_t ==============
allow httpd_t file_t:file { read getattr open };
#============= ipa_kpasswd_t ==============
allow ipa_kpasswd_t file_t:file { read getattr open };
#!!!! This avc can be allowed using one of the these booleans:
# authlogin_nsswitch_use_ldap, allow_ypbind
allow ipa_kpasswd_t ldap_port_t:tcp_socket name_connect;
#!!!! This avc can be allowed using one of the these booleans:
# authlogin_nsswitch_use_ldap, global_ssp
allow ipa_kpasswd_t urandom_device_t:chr_file { read getattr open };
#============= krb5kdc_t ==============
allow krb5kdc_t file_t:file getattr;
httpd_t wanted to read /etc/krb5.conf, this is generated by mod_auth_kerb. Same with ns-slapd.
All this is with selinux-policy-3.10.0-61.fc16.noarch
Evgeny, could you please add these rules as well and send patch to the list for review? Ok, but it be not so quickly (I must go now). And which list do you mean? freeipa-devel@, I think. And some adjusts. Do we really need urandom rule you think? I don't understand where it needs yet. freeipa-devel@, yes. People who can review the patch will be back on Monday. Once reviewed and accepted, Rob or I can respin the update. urandom access seems to be valid one for ipa_kpasswd as libkrb5 is providing krb5_c_random_os_entropy that can access /dev/random or /dev/urandom. And it is called by krb5_init_context() used by ipa_kpasswd. file_t is a file that does not have an SELinux label, probably a file/dir created on a machine that was not running SELinux. The best way to fix these is to run restorecon on the disk. Allowing ipa_passwd access to /dev/urandom should be allowed. Good catch. Before restorecon /etc/krb5.conf, it had context system_u:object_r:file_t:s0. After I ran restorecon, the context became system_u:object_r:krb5_conf_t:s0. As avcs show access to /etc/krb5.conf, it means it was modified without restoring security context. I'll check ipa-server-install/ipa-client-install to ensure we do restore security context properly. So, original patch with urandom, but without file_t:file, I prepare for review. Fixed upstream: master 89d9ad428cf48a3aac55173ecf074e0a234a5ee5 freeipa-2.1.3-8.fc16 has been submitted as an update for Fedora 16. https://admin.fedoraproject.org/updates/freeipa-2.1.3-8.fc16 freeipa-2.1.4-1.fc16 has been submitted as an update for Fedora 16. https://admin.fedoraproject.org/updates/freeipa-2.1.4-1.fc16 freeipa-2.1.4-1.fc15 has been submitted as an update for Fedora 15. https://admin.fedoraproject.org/updates/freeipa-2.1.4-1.fc15 freeipa-2.1.4-2.fc16 has been submitted as an update for Fedora 16. https://admin.fedoraproject.org/updates/freeipa-2.1.4-2.fc16 freeipa-2.1.4-2.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report. freeipa-2.1.4-3.fc15 has been submitted as an update for Fedora 15. https://admin.fedoraproject.org/updates/freeipa-2.1.4-3.fc15 |