Bug 858872

Description of problem: When incremental propagation is configured for Kerberos and kadmind attempts a full re-sync, SELinux policy prevents this. Making SELinux permissive or installing a custom policy module allows the full re-sync to succeed.


Version-Release number of selected component (if applicable):krb5-server.x86_64                                             1.9-33.el6_3.3


How reproducible: Enable incremental propagation to a slave KDC; then remove the slave's KDC database to force a full resync. kadmind on the master KDC will attempt to launch a kprop to the slave which will be denied by SELinux.


Steps to Reproduce:
1. Edit kdc.conf to enable iprop; I used 755/tcp for the iprop port; define the necessary iprop principals and update the host keytabs as documented in the Kerberos installation guide.
2. On the slave KDC stop the krb5kdc process and remove the principal* files (the KDC database files) from /var/kerberos/krb5kdc to force a full resync
3. On the slave KDC, restart kpropd in standalone debug mode (-d -S) which then contacts the master KDC and requests the full resync
4. Note that both the kadmind and kpropd logs record errors which correspond to SELinux denials for various kadmind operations during the full re-sync attempt
  
Actual results: The incremental propagation fails to do a full re-sync of the KDC database on the slave KDC and subsequent incremental changes cannot be propagated.


Expected results: If the proper SELinux policy is in place (see example below), the full re-sync succeeds and then any subsequent incremental changes are sent as well.


Additional info: Example SELinux policy module (generated from entries in the audit log following a failure) that permits the full re-sync to succeed:

cat kiprop.te 

module kiprop 1.0;

require {
        type selinux_config_t;
        type bin_t;
        type kadmind_t;
        type hi_reserved_port_t;
        type kprop_port_t;
        type krb5_keytab_t;
        type krb5kdc_conf_t;
        type shell_exec_t;
        type dhcpd_port_t;
        class tcp_socket { name_bind name_connect };
        class lnk_file read;
        class fifo_file ioctl;
        class file { execute read lock create execute_no_trans write getattr unlink open };
}

#============= kadmind_t ==============
allow kadmind_t bin_t:file { read execute open execute_no_trans };
allow kadmind_t bin_t:lnk_file read;
#!!!! This avc can be allowed using the boolean 'allow_ypbind'

allow kadmind_t dhcpd_port_t:tcp_socket name_bind;
#!!!! This avc can be allowed using the boolean 'allow_ypbind'

allow kadmind_t hi_reserved_port_t:tcp_socket name_bind;
#!!!! This avc can be allowed using the boolean 'allow_ypbind'

allow kadmind_t kprop_port_t:tcp_socket name_connect;
allow kadmind_t krb5_keytab_t:file { read lock open };
allow kadmind_t krb5kdc_conf_t:file { write create unlink };
allow kadmind_t self:fifo_file ioctl;
allow kadmind_t selinux_config_t:file { read getattr open };
allow kadmind_t shell_exec_t:file { read execute open getattr execute_no_trans };