Bug 831229

Summary: SELinux is preventing /usr/sbin/winbindd from 'read' accesses on the file passwd.
Product: [Fedora] Fedora Reporter: Stef Walter <stefw>
Component: sssdAssignee: Stephen Gallagher <sgallagh>
Status: CLOSED NOTABUG QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 17CC: dominick.grift, dwalsh, jhrozek, mgrepl, sbose, sgallagh, ssorce
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
Whiteboard: abrt_hash:82aede57fba86e5ef57bb4496b227b73c06484f1d4304fcc895acd28df9d410c
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-06-19 08:56:54 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Description Stef Walter 2012-06-12 10:12:17 EDT
libreport version: 2.0.10
executable:     /usr/bin/python2.7
hashmarkername: setroubleshoot
kernel:         3.4.0-1.fc17.x86_64
time:           Tue 12 Jun 2012 04:12:04 PM CEST

description:
:SELinux is preventing /usr/sbin/winbindd from 'read' accesses on the file passwd.
:
:*****  Plugin catchall (100. confidence) suggests  ***************************
:
:If you believe that winbindd should be allowed read access on the passwd file by default.
:Then you should report this as a bug.
:You can generate a local policy module to allow this access.
:Do
:allow this access for now by executing:
:# grep winbindd /var/log/audit/audit.log | audit2allow -M mypol
:# semodule -i mypol.pp
:
:Additional Information:
:Source Context                system_u:system_r:winbind_t:s0
:Target Context                system_u:object_r:sssd_var_lib_t:s0
:Target Objects                passwd [ file ]
:Source                        winbindd
:Source Path                   /usr/sbin/winbindd
:Port                          <Unknown>
:Host                          (removed)
:Source RPM Packages           samba-winbind-3.6.5-86.fc17.1.x86_64
:Target RPM Packages           
:Policy RPM                    selinux-policy-3.10.0-128.fc17.noarch
:Selinux Enabled               True
:Policy Type                   targeted
:Enforcing Mode                Enforcing
:Host Name                     (removed)
:Platform                      Linux (removed)
:                              3.4.0-1.fc17.x86_64 #1 SMP Sun Jun 3 06:35:17 UTC
:                              2012 x86_64 x86_64
:Alert Count                   1
:First Seen                    Tue 12 Jun 2012 04:11:30 PM CEST
:Last Seen                     Tue 12 Jun 2012 04:11:30 PM CEST
:Local ID                      3b64a46b-3290-4f30-ba04-c7153f907eb3
:
:Raw Audit Messages
:type=AVC msg=audit(1339510290.847:249): avc:  denied  { read } for  pid=29877 comm="winbindd" name="passwd" dev="sda1" ino=540854 scontext=system_u:system_r:winbind_t:s0 tcontext=system_u:object_r:sssd_var_lib_t:s0 tclass=file
:
:
:type=SYSCALL msg=audit(1339510290.847:249): arch=x86_64 syscall=open success=no exit=EACCES a0=7ff197aab620 a1=0 a2=7ff194734750 a3=7fffd180fa70 items=0 ppid=29231 pid=29877 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=winbindd exe=/usr/sbin/winbindd subj=system_u:system_r:winbind_t:s0 key=(null)
:
:Hash: winbindd,winbind_t,sssd_var_lib_t,file,read
:
:audit2allowunable to open /sys/fs/selinux/policy:  Permission denied
:
:
:audit2allow -Runable to open /sys/fs/selinux/policy:  Permission denied
:
:
Comment 1 Daniel Walsh 2012-06-12 11:34:02 EDT
*** Bug 831226 has been marked as a duplicate of this bug. ***
Comment 2 Daniel Walsh 2012-06-12 11:35:18 EDT
Stef is this new feature of sssd to store the passwd file in /var/lib/sssd?
Comment 3 Stephen Gallagher 2012-06-12 12:29:46 EDT
Dan, this is a dupe of https://bugzilla.redhat.com/show_bug.cgi?id=808297 I'm pretty sure.
Comment 4 Daniel Walsh 2012-06-12 21:13:40 EDT
Except there the content is labeled as sssd_public_t now it is being labeled as sssd_var_lib_t

Has passwd moved out of /var/lib/sssd/mc/

Or is /var/lib/sssd/mc/
 mislabeled
Comment 5 Stephen Gallagher 2012-06-12 21:19:38 EDT
Looks like it must be a labeling issue, then. SSSD deletes and recreates this file on startup. Is it possible that we're missing policy to allow us to create the file as sssd_public_t?
Comment 6 Daniel Walsh 2012-06-13 17:43:14 EDT
Is the file being created in /var/lib/sssd/mc?

This directory should be labeled sssd_public_t and then the file would get created with that label.
Comment 7 Stef Walter 2012-06-19 08:56:54 EDT
After looking into it further, I finally figured out this is the result of an incorrectly ./configure'd sssd.