Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 914433

Summary: sssd pam write_selinux_login_file creating the temp file for SELinux data failed
Product: Red Hat Enterprise Linux 6 Reporter: Maxim Egorushkin <maxim.yegorushkin>
Component: sssdAssignee: Jakub Hrozek <jhrozek>
Status: CLOSED ERRATA QA Contact: Kaushik Banerjee <kbanerje>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 6.4CC: arubin, dpal, grajaiya, hgraham, jgalipea, lnovich, mkosek, nsoman, pbrezina
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: sssd-1.9.2-114.el6 Doc Type: Bug Fix
Doc Text:
Cause: The code that writes the login file for the IPA provider did not handle error conditions correctly and was unable to recover if writing the SELinux label failed. Consequence: If the client system did not have the selinux-policy-targeted directory installed at all, the target directory the SSSD writes to would be missing and writing the login file would fail, which would make the whole login operation fail. Fix: The SSSD was amended so that it is able to handle failures to write the SELinux login file Result: Logins work fine even on clients w/o selinux-policy-targeted installed at all
 Story Points: ---
Clone Of: Environment:
Last Closed: 2013-11-21 22:14:57 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
sssd_pam.log none

Description Maxim Egorushkin 2013-02-22 10:16:13 UTC 
Description of problem:

After updating to sssd-1.9.2-82.el6.x86_64 tonight IPA registered users can not login.

Version-Release number of selected component (if applicable):
sssd-1.9.2-82.el6.x86_64
Red Hat Enterprise Linux Server release 6.4 (Santiago)

How reproducible:
Always


Steps to Reproduce:
1. try to ssh as an IPA registered user
  
Actual results:
$ ssh xyz
Connection closed by 10.20.117.146

Expected results:
$ ssh xyz
Last login: Fri Feb 22 09:44:36 2013 from 10.92.217.89


Additional info:
sssd_pam.log:
(Fri Feb 22 10:02:14 2013) [sssd[pam]] [write_selinux_login_file] (0x0040): creating the temp file for SELinux data failed. /etc/selinux/targeted/logins/maxAYGyki(Fri Feb 22 10:02:14 2013) [sssd[pam]] [pam_reply] (0x0100): blen: 40
Comment 1 Maxim Egorushkin 2013-02-22 10:17:33 UTC 
Created attachment 701109 [details]
sssd_pam.log
Comment 3 Jenny Severance 2013-02-22 10:50:28 UTC 
What version of selinux-policy do you have installed?
Comment 4 Maxim Egorushkin 2013-02-22 10:53:28 UTC 
Selinux is disabled:

# getenforce 
Disabled
# sestatus 
SELinux status:                 disabled
Comment 5 Dmitri Pal 2013-02-22 11:03:07 UTC 
The workaround would be to put SELinux into permissive mode.
SSSD is a security software. It is recommended to run with SELinux on. This is how it is developed and tested. Permissive mode is the compromise. 
If it does not work in the permissive mode then this is a real issue which we would look into.
Comment 6 Jakub Hrozek 2013-02-22 11:04:06 UTC 
Is the directory /etc/selinux/targeted/logins/ there at all? What permissions does it have?
Comment 7 Jakub Hrozek 2013-02-22 11:04:50 UTC 
*** Bug 914428 has been marked as a duplicate of this bug. ***
Comment 8 Maxim Egorushkin 2013-02-22 11:10:10 UTC 
Directory /etc/selinux/targeted does not exist.

# ls -l /etc/selinux
total 12
-rw-r--r-- 1 root root  113 Jan 16 14:15 restorecond.conf
-rw-r--r-- 1 root root   76 Jan 16 14:15 restorecond_user.conf
-rw-r--r-- 1 root root 2271 Oct 15 14:08 semanage.conf

It used to work just yesterday with selinux disabled. 

Is there a way to make it work again with selinux disabled please? I am loath to enable it because it used to break our proprietary applications or cause other nasty issues.
Comment 9 Jakub Hrozek 2013-02-22 11:20:07 UTC 
Can you check if mkdir -p /etc/selinux/targeted/logins/ fixes the issue for you?
Comment 10 Maxim Egorushkin 2013-02-22 11:22:14 UTC 
It does, thanks a lot Jakub.
Comment 11 Jakub Hrozek 2013-02-22 11:33:24 UTC 
We still need to fix the problem in SSSD. We should either detect if SELinux is off completely and skip creating the context or just check if the logins directory exists before attempting to write the file there.
Comment 12 Jakub Hrozek 2013-02-22 11:35:33 UTC 
Upstream ticket:
https://fedorahosted.org/sssd/ticket/1817
Comment 13 Jakub Hrozek 2013-02-26 14:58:14 UTC 
btw I think SELinux should always create the directory and just ignore potential contents, so I filed https://bugzilla.redhat.com/show_bug.cgi?id=915811
Comment 14 Maxim Egorushkin 2013-02-26 15:03:50 UTC 
Just in case, https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Enterprise_Linux/6/html-single/Identity_Management_Guide/index.html never mentions SELinux as a requirement for either IPA server or client.
Comment 15 Jakub Hrozek 2013-02-26 17:54:51 UTC 
Maxim, can you chime in to bug #915811 and describe how exactly you installed your system? Was selinux disabled from anaconda? Do you have selinux-policy-targeted installed at all?
Comment 16 Jakub Hrozek 2013-05-10 15:13:29 UTC 
Fixed upstream.
Comment 26 Namita Soman 2013-10-11 13:53:59 UTC 
Verified using ipa-server-3.0.0-37.el6.x86_64, ipa-client-3.0.0-37.el6.x86_64, sssd-1.9.2-128.el6.x86_64, selinux-policy-3.7.19-218

On server:
# sestatus 
SELinux status:                 disabled

installed ipa-server

# ls -l /etc/selinux/
total 20
-rw-r--r--. 1 root root  457 Oct 11 08:29 config
-rw-r--r--. 1 root root  113 Sep 18 12:43 restorecond.conf
-rw-r--r--. 1 root root   76 Sep 18 12:43 restorecond_user.conf
-rw-r--r--. 1 root root 2271 Oct 15  2012 semanage.conf
drwxr-xr-x. 6 root root 4096 Oct  8 15:35 targeted_ORIG


On client:
# sestatus 
SELinux status:                 disabled

# ls -l /etc/selinux/
total 20
-rw-r--r--. 1 root root  457 Oct 11 09:06 config
-rw-r--r--. 1 root root  113 Sep 18 12:43 restorecond.conf
-rw-r--r--. 1 root root   76 Sep 18 12:43 restorecond_user.conf
-rw-r--r--. 1 root root 2271 Oct 15  2012 semanage.conf
drwxr-xr-x. 6 root root 4096 Oct  8 15:17 targeted_ORIG

installed client

Then from client ssh'd as an ipa user to server:
# ssh admin@<ipa server name>

Was successful
Comment 27 Maxim Egorushkin 2013-10-17 15:17:29 UTC 
That's great, thank you gents!
Comment 28 errata-xmlrpc 2013-11-21 22:14:57 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-1680.html