Bug 796351

+++ This bug was initially created as a clone of Bug #746017 +++

Created attachment 528064 [details]
AVC and SYSCALL messages

If dirsrv uses
modutil -dbdir /etc/dirsrv/slapd-instname -fips true
to enable FIPS mode in the NSS key/cert db, we get AVC messages because NSS_Initialize attempts to use prelink.

--- Additional comment from nkinder on 2011-10-13 13:17:34 EDT ---

I believe that we just need to add the following to the dirsrv policy:

prelink_exec(dirsrv_t);

We will test this to see if anything else is required.

--- Additional comment from rmeggins on 2011-10-13 15:36:14 EDT ---

Created attachment 528089 [details]
after loading new policy

I did the following on F-15:
1) create a file dirsrv-prelink.te with the following contents:
policy_module(dirsrv-prelink,1.0.0)

require {
    type dirsrv_t;
}

prelink_exec(dirsrv_t);

2) make -f /usr/share/selinux/devel/Makefile
3) semodule -i dirsrv-prelink.pp

After restarting dirsrv, I got the attached AVCs

--- Additional comment from rmeggins on 2011-10-13 15:37:17 EDT ---

Created attachment 528094 [details]
after running restorecon /usr/sbin/ns-slapd

Then I ran restorecon /usr/sbin/ns-slapd, and I got the attached AVC

--- Additional comment from nkinder on 2011-10-13 18:36:50 EDT ---

(In reply to comment #2)
> Created attachment 528089 [details]
> after loading new policy
> 
> I did the following on F-15:
> 1) create a file dirsrv-prelink.te with the following contents:
> policy_module(dirsrv-prelink,1.0.0)
> 
> require {
>     type dirsrv_t;
> }
> 
> prelink_exec(dirsrv_t);
> 
> 2) make -f /usr/share/selinux/devel/Makefile
> 3) semodule -i dirsrv-prelink.pp
> 
> After restarting dirsrv, I got the attached AVCs

Perhaps we should use 'prelink_domtrans(dirsrv_t)' instead of 'prelink_exec(dirsrv_t)'.  This will make prelink run in it's own context instead of using the dirsrv_t context.  Could you try changing the policy module and testing with the prelink_domtrans macro?

--- Additional comment from rmeggins on 2011-10-13 18:52:12 EDT ---

(In reply to comment #4)
> (In reply to comment #2)
> > Created attachment 528089 [details]
> > after loading new policy
> > 
> > I did the following on F-15:
> > 1) create a file dirsrv-prelink.te with the following contents:
> > policy_module(dirsrv-prelink,1.0.0)
> > 
> > require {
> >     type dirsrv_t;
> > }
> > 
> > prelink_exec(dirsrv_t);
> > 
> > 2) make -f /usr/share/selinux/devel/Makefile
> > 3) semodule -i dirsrv-prelink.pp
> > 
> > After restarting dirsrv, I got the attached AVCs
> 
> Perhaps we should use 'prelink_domtrans(dirsrv_t)' instead of
> 'prelink_exec(dirsrv_t)'.  This will make prelink run in it's own context
> instead of using the dirsrv_t context.  Could you try changing the policy
> module and testing with the prelink_domtrans macro?

Yep, changing prelink_exec to prelink_domtrans in the above worked.  No messages, no AVCs, in Permissive and in Enforcing mode.

--- Additional comment from mgrepl on 2011-10-14 08:10:10 EDT ---

Well, this is not something what we want to allow by default.

Dan,
AFAIK we had the similar bug.

--- Additional comment from dwalsh on 2011-10-14 08:56:11 EDT ---

I would prefer not to transition to prelink and allow the relabel for the current domain.  prelink is a pretty powerfull domain, since it can read and write binaries.  If you could somehow fool prelink you could take a system over.  Allowing relabelto and relabelfrom types that you can read/write, I do not think is a problem.

--- Additional comment from mgrepl on 2011-10-21 05:47:13 EDT ---

Fixed in selinux-policy-3.9.16-44.fc15