Bug 919801
| Summary: | SELinux is preventing /usr/sbin/sendmail.postfix from 'read' accesses on the directory /home/dummy. | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Nicolas Mailhot <nicolas.mailhot> | ||||||||
| Component: | rpm | Assignee: | Packaging Maintenance Team <packaging-team-maint> | ||||||||
| Status: | CLOSED UPSTREAM | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||||||
| Severity: | medium | Docs Contact: | |||||||||
| Priority: | medium | ||||||||||
| Version: | 23 | CC: | ak, akurtako, antyhaker93, awilliam, dan.mashal, dwalsh, dzrudy, eblake, ffesti, hrafnkellbrimar, ignatenko, jskarvad, juergengoericke, jzeleny, kmaraas, kparal, lkardos, lsatenstein, macleod2486, maj.linux, me, metherid, mgrepl, misc, mlichvar, moez.roy, murray.alex, nicolas.mailhot, novyjindrich, ovasik, packaging-team-maint, puntogil, reis.lucia, rvokal, sanjay.ankur, sayak.bugsmith, shivasrinath.reddy, steinach2810, thorben.hasenpusch, vineshteotia, vondruch, xurzwi2q1 | ||||||||
| Target Milestone: | --- | Keywords: | Reopened | ||||||||
| Target Release: | --- | ||||||||||
| Hardware: | All | ||||||||||
| OS: | Linux | ||||||||||
| Whiteboard: | setroubleshoot_trace_hash:e1d2259087e0993cdbdc2edbeed2514d5d37187593777ec8858ec2a7cfe187cf | ||||||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||||||
| Doc Text: | Story Points: | --- | |||||||||
| Clone Of: | 673384 | Environment: | |||||||||
| Last Closed: | 2016-05-31 08:35:31 UTC | Type: | --- | ||||||||
| Regression: | --- | Mount Type: | --- | ||||||||
| Documentation: | --- | CRM: | |||||||||
| Verified Versions: | Category: | --- | |||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||
| Embargoed: | |||||||||||
| Bug Depends On: | 673384 | ||||||||||
| Bug Blocks: | |||||||||||
| Attachments: |
|
||||||||||
|
Description
Nicolas Mailhot
2013-03-10 07:44:24 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 19 development cycle. Changing version to '19'. (As we did not run this process for some time, it could affect also pre-Fedora 19 development cycle bugs. We are very sorry. It will help us with cleanup during Fedora 19 End Of Life. Thank you.) More information and reason for this action is here: https://fedoraproject.org/wiki/BugZappers/HouseKeeping/Fedora19 Description of problem: The alert showed up when installing today's updates. I think it was during "setup" package installation. Additional info: hashmarkername: setroubleshoot kernel: 3.9.0-0.rc6.git2.3.fc19.x86_64 type: libreport Description of problem: Came up during an update. Additional info: reporter: libreport-2.1.4 hashmarkername: setroubleshoot kernel: 3.9.1-301.fc19.x86_64 type: libreport Description of problem: I really don't know what happened here. This is my new laptop, so a fairly clean F19, and I just opened it up and ran a 'yum update', then noticed this AVC. I haven't explicitly configured sendmail at all, it's just got the default configuration. No idea why it wants to read my homedir. Additional info: reporter: libreport-2.1.4 hashmarkername: setroubleshoot kernel: 3.9.1-301.fc19.x86_64 type: libreport Description of problem: Didn't do anything special. Sendmail seems to have been doing it's own thing in the background. Additional info: reporter: libreport-2.1.4 hashmarkername: setroubleshoot kernel: 3.9.1-301.fc19.x86_64 type: libreport Probably we should open also a bug for sendmail to ask what it does. Well these are not sendmail or sendmail.postfix bugs, they are leakes from the application that is executing sendmail or sendmail.postfix. Some application running in the postinstall is sending email while is has a open read file descriptor to /home/dummy. or /home/nim If we could figure out which app is calling newalias, then we would know who is leaking. Simplest fix would be to add a dontaudit for this. dan: it's not immediate post-install, or anything (for me anyway) - the laptop's fairly new, but it's been installed for a while. I was just doing 'normal stuff' on it when this hit. But yeah, I've no idea what's calling sendmail :| I suppose I can look through /var/spool/mail and see what's there... Created attachment 749536 [details]
journalctl -b
For me this happened during a yum update from 19 beta RC2 after rebooting from installing. Lots of messages in audit.log and journalctl. The time of the denial is 20:42:23.
May 17 20:42:23 localhost.localdomain dbus-daemon[356]: dbus[356]: [system] Activating service name='org.fedoraproject.Setroubleshootd' (using servicehelper)
May 17 20:42:23 localhost.localdomain dbus[356]: [system] Activating service name='org.fedoraproject.Setroubleshootd' (using servicehelper)
May 17 20:42:23 localhost.localdomain sendmail[2245]: alias database /etc/aliases rebuilt by chris
May 17 20:42:23 localhost.localdomain sendmail[2245]: /etc/aliases: 76 aliases, longest 10 bytes, 771 bytes total
Prior to that, just a bunch of yum entries.
Created attachment 749537 [details]
audit.log
Well we already had dontaudit for search, now we can add listing. -userdom_dontaudit_search_user_home_dirs(system_mail_t) +userdom_dontaudit_list_user_home_dirs(system_mail_t) userdom_dontaudit_list_admin_dir(system_mail_t) 91de1dc704ee69922424e1e4aac5c72d1025b579 Fixes this in git. Added also to F18. Description of problem: Happened during system update. Additional info: reporter: libreport-2.1.4 hashmarkername: setroubleshoot kernel: 3.9.0-0.rc8.git0.2.fc19.x86_64 type: libreport *** Bug 919802 has been marked as a duplicate of this bug. *** Description of problem: Updating F19 from stable repository. May be yum wanted send me mail. Additional info: reporter: libreport-2.1.4 hashmarkername: setroubleshoot kernel: 3.9.2-301.fc19.x86_64 type: libreport Description of problem: Fresh install of Beta. Just updating. Additional info: reporter: libreport-2.1.4 hashmarkername: setroubleshoot kernel: 3.9.2-301.fc19.x86_64 type: libreport It seems setup package is calling newaliases in its %post, but I was not successful in finding the FD leak, nor I was unable to reproduce this. I will continue to investigate. Is there wso2-wsf-cpp package installed on the affected systems? Description of problem: This pop-up during system update. Additional info: reporter: libreport-2.1.4 hashmarkername: setroubleshoot kernel: 3.9.2-301.fc19.x86_64 type: libreport Description of problem: during updates Additional info: reporter: libreport-2.1.4 hashmarkername: setroubleshoot kernel: 3.9.2-301.fc19.i686 type: libreport *** Bug 970346 has been marked as a duplicate of this bug. *** Created attachment 833223 [details]
Use CLO_EXEC
I dug more deep into it. It seems the problem is triggered by the setup package. It executes newaliases from the LUA code in its %post. This way the FD opened earlier in the transaction can leak into newaliases. Newaliases are provided by both sendmail and postfix, that's why the same problem was reported twice against different packages.
The problem is very hardly reproducible. I was able to reproduce it with both yum and dnf, but it doesn't seem to be 100% repeatedly reproducible (I wasn't able to reproduce it repeatedly even by replying the same transaction in the snapshoted VM).
I think RPM should use CLO_EXEC on FDs it opens. Attached patch tries to fix it. It was created by blind (automatic) find and replace, so it needs careful review. By using the patched RPM, I wasn't able to reproduce the problem again (this may also mean that I wasn't just lucky enough to trigger the probem).
Right, another embedded Lua "specialty"... For regular scriptlets rpm forces FD_CLOEXEC after fork, but this doesn't occur with the embedded Lua scriptlets. So yeah, there is a problem which needs addressing. The patch looks a bit like a blind man trying to kill a fly on a wall with an extremely large hammer though :) This bug appears to have been reported against 'rawhide' during the Fedora 23 development cycle. Changing version to '23'. (As we did not run this process for some time, it could affect also pre-Fedora 23 development cycle bugs. We are very sorry. It will help us with cleanup during Fedora 23 End Of Life. Thank you.) More information and reason for this action is here: https://fedoraproject.org/wiki/BugZappers/HouseKeeping/Fedora23 Fixed upstream by setting FD_CLOEXEC on opened files before exec from lua script is called: https://github.com/rpm-software-management/rpm/commit/7a7c31f551ff167f8718aea6d5048f6288d60205 Unfortunately this fix can cause a serious performance regression, for example in Docker, where ulimit -n is a lot higher: https://bugzilla.redhat.com/show_bug.cgi?id=1537564 |