Bug 828122
| Summary: | SELinux problem telnetd + /sbin/unix_chkpwd | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 5 | Reporter: | David Spurek <dspurek> | ||||
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | 5.8 | CC: | dwalsh, ebenes, mmalik | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | selinux-policy-2.4.6-328.el5 | Doc Type: | Bug Fix | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2013-01-08 03:32:02 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
This request was evaluated by Red Hat Product Management for inclusion in a Red Hat Enterprise Linux release. Product Management has requested further review of this request by Red Hat Engineering, for potential inclusion in a Red Hat Enterprise Linux release for currently deployed products. This request is not yet committed for inclusion in a release. This looks like a leaked file descriptor. Since unix_chkpwd does not do anything with the terminal.
In latest fedora's it is dontaudited.
audit2allow -i /tmp/t
#============= system_chkpwd_t ==============
#!!!! This avc has a dontaudit rule in the current policy
allow system_chkpwd_t telnetd_devpts_t:chr_file { read write };
RHEL6 also has
term_dontaudit_use_console(chkpwd_t)
term_dontaudit_use_unallocated_ttys(chkpwd_t)
term_dontaudit_use_generic_ptys(chkpwd_t)
term_dontaudit_use_all_ptys(chkpwd_t)
You can safely ignore this for now.
David, please provide a reproducer. Created attachment 589819 [details]
reproduce test
I have created reproducer, just run "bash runtest.sh" to reproduce selinux problem. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2013-0060.html |
Description of problem: ---- time->Mon Jun 4 05:23:48 2012 type=SYSCALL msg=audit(1338801828.687:695): arch=c000003e syscall=59 success=yes exit=0 a0=2b7560eebff6 a1=7fffecb3d1e0 a2=2b75610f97a0 a3=2d30733a745f6e69 items=0 ppid=21890 pid=21895 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="unix_chkpwd" exe="/sbin/unix_chkpwd" subj=root:system_r:system_chkpwd_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1338801828.687:695): avc: denied { read write } for pid=21895 comm="unix_chkpwd" name="3" dev=devpts ino=5 scontext=root:system_r:system_chkpwd_t:s0-s0:c0.c1023 tcontext=root:object_r:telnetd_devpts_t:s0 tclass=chr_file ----