Bug 947933

+++ This bug was initially created as a clone of Bug #922167 +++

Description of problem:
Using Kerberos/GSSAPI/SASL to secure Qpid triggers SELinux AVC


Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.  install freeipa-server
2.  install two machines as freeipa-ipa clients.  I called them portal and queue.  

The following steps are done on queue
3.  install qpidd
4.  edit /usr/lib/systemd/system/qpidd.service  and under [Service] add
Environment="KRB5CCNAME=FILE:/run/user/997/krb5cc" "KRB5_KTNAME=/var/kerberos/krb5/user/997/client.keytab"
5.  edit /etc/sasl2/qpidd.conf and make sure the only mech listed is GSSAPI:
  mech_list: GSSAPI
6. edit /etc/qpidd.conf and make sure GSSAPI is enabled:
    /cluster-mechanism=GSSAPI
    auth=yes
    realm=YOURREALM  #this should match the FreeIPA install
7.   Set SELinux to permissive
    setenforce permissive
8.  fetch a keytab from the ipa server and save it in /var/kerberos/krb5/user/997/client.keytab
 ipa-getkeytab -s  ${IPAHOSTNAME} -p qpidd/$(HOSTNAME)@${REALM} -k client.keytab
9.  restart qpidd
    systemctl service qpidd restart

On portal install

 yum install python-saslwrapper python-amqplib
And run the following python program

import unittest

from qpid.messaging import Connection
from qpid.messaging.exceptions import AuthenticationFailure

class IntegrationRelatedTechResearch(unittest.TestCase):

    def setUp(self):
        self._qpid_host = 'q.openstack.freeipa.org'
        self._qpid_port = 5672

    def testConnectQPIDAsRegularUserUsingGSSAPI(self):
        conn = Connection(
            host = self._qpid_host,
            port = self._qpid_port,
            sasl_mechanisms = 'GSSAPI ')
        conn.open()
        self.assertTrue(conn.opened())
        conn.close()

if __name__ == '__main__':
   unittest.main()

  
Actual results:

Running audit2allow one queue shows

#============= qpidd_t ==============
allow qpidd_t file_context_t:dir search;
allow qpidd_t file_context_t:file { read getattr open };
allow qpidd_t krb5_conf_t:file { read getattr open };
allow qpidd_t self:process setfscreate;
allow qpidd_t sssd_public_t:dir { read search open };
allow qpidd_t tmp_t:dir { write add_name };
allow qpidd_t tmp_t:file { write create open };
allow qpidd_t var_t:file { read lock open };


WHile the last line ( var_t:file ) is probably from the keytab