Bug 1003012 - in.ntalkd runs as init_t when ntalk.socket is active
Summary: in.ntalkd runs as init_t when ntalk.socket is active
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.0
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Miroslav Grepl
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks: 1004161
TreeView+ depends on / blocked
 
Reported: 2013-08-30 13:32 UTC by Milos Malik
Modified: 2014-06-18 02:25 UTC (History)
2 users (show)

Fixed In Version: selinux-policy-3.12.1-77.el7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-06-13 10:00:53 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description Milos Malik 2013-08-30 13:32:31 UTC
Description of problem:
It reminds me of bz#965140.

Version-Release number of selected component (if applicable):
selinux-policy-3.12.1-73.el7.noarch
selinux-policy-devel-3.12.1-73.el7.noarch
selinux-policy-doc-3.12.1-73.el7.noarch
selinux-policy-minimum-3.12.1-73.el7.noarch
selinux-policy-mls-3.12.1-73.el7.noarch
selinux-policy-targeted-3.12.1-73.el7.noarch
talk-server-0.17-42.el7.x86_64

How reproducible:
always

Steps to Reproduce:
# systemctl enable ntalk.socket
ln -s '/usr/lib/systemd/system/ntalk.socket' '/etc/systemd/system/sockets.target.wants/ntalk.socket'
# systemctl start ntalk.socket
# systemctl status ntalk.socket
ntalk.socket - Talk Server Activation Socket
   Loaded: loaded (/usr/lib/systemd/system/ntalk.socket; enabled)
   Active: active (listening) since Fri 2013-08-30 09:28:23 EDT; 22s ago
     Docs: man:ntalkd(8)
           man:talk(1)
   Listen: 0.0.0.0:518 (Datagram)

# nc --udp 127.0.0.1 518
pokus
o^Z
[1]+  Stopped                 nc --udp 127.0.0.1 518
# ps -efZ | grep talk
system_u:system_r:init_t:s0     nobody   14507     1  0 09:29 ?        00:00:00 /usr/sbin/in.ntalkd
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 14509 7635  0 09:29 pts/0 00:00:00 grep --color=auto talk
# fg
nc --udp 127.0.0.1 518
^C

Actual results:
 * in.ntalkd runs as init_t

Expected results:
 * in.ntalkd runs as ktalkd_t

Comment 1 Milos Malik 2013-08-30 13:59:13 UTC
The same problem appears when following daemons are executed by systemd:
 * /usr/sbin/in.rexecd
 * /usr/sbin/in.rlogind

Comment 2 Milos Malik 2013-08-30 14:19:51 UTC
The list of daemons executed by systemd and running as init_t:
 * /usr/sbin/in.rexecd
 * /usr/sbin/in.rlogind
 * /usr/sbin/in.telnetd
 * /usr/sbin/in.authd

Comment 4 Milos Malik 2013-09-02 09:47:32 UTC
Following services can be executed by systemd when a TCP connection is established to their port:

# pwd
/usr/lib/systemd/system
# grep -i -e "listenstream=[0-9]" -e "listendatagram=[0-9]" *.socket
amanda.socket:ListenStream=10080
amanda-udp.socket:ListenDatagram=10080
auth.socket:ListenStream=113
btimed.socket:ListenDatagram=23456
cups-lpd.socket:ListenStream=515
cvs.socket:ListenStream=2401
dovecot.socket:ListenStream=0.0.0.0:143
dovecot.socket:ListenStream=0.0.0.0:993
eklogin.socket:ListenStream=2105
ekrb5-telnet.socket:ListenStream=23
ekshell.socket:ListenStream=544
finger.socket:ListenStream=79
git.socket:ListenStream=9418
gssftp.socket:ListenStream=21
klogin.socket:ListenStream=543
krb5-telnet.socket:ListenStream=23
kshell.socket:ListenStream=544
ntalk.socket:ListenDatagram=0.0.0.0:518
qarshd.socket:ListenStream=5008
rexec.socket:ListenStream=512
rlogin.socket:ListenStream=513
rsh.socket:ListenStream=514
rsyncd.socket:ListenStream=873
sshd.socket:ListenStream=22
systemd-journal-gatewayd.socket:ListenStream=19531
telnet.socket:ListenStream=23
tftp.socket:ListenDatagram=69
#

Manual tests (see Steps to Reproduce in comment#0), which I did on a fresh RHEL-7 machine provided by beaker, showed that only following services run under correct SELinux context:
dovecot.socket
finger.socket
gssftp.socket
qarshd.socket
sshd.socket
tftp.socket

Comment 5 Miroslav Grepl 2013-09-02 12:15:25 UTC
# ls -Z /usr/lib/systemd/system/ntalk*
-rw-r--r--. root root system_u:object_r:systemd_unit_file_t:s0 /usr/lib/systemd/system/ntalk.service
-rw-r--r--. root root system_u:object_r:systemd_unit_file_t:s0 /usr/lib/systemd/system/ntalk.socket

so we don't have support for these unit files. Could you check labels also for others where you see it does not work.

Comment 6 Milos Malik 2013-09-02 12:26:34 UTC
I don't think the problem is caused by incorrect labelling of unit files because amanda and cups-lpd run as init_t even if their unit files are labelled correctly. On the other hand dovecot and finger daemons run under correct context even if their unit files are not labelled correctly.

-rw-r--r--. root root system_u:object_r:amanda_unit_file_t:s0 amanda.socket
-rw-r--r--. root root system_u:object_r:cupsd_unit_file_t:s0 cups-lpd.socket
-rw-r--r--. root root system_u:object_r:systemd_unit_file_t:s0 dovecot.socket
-rw-r--r--. root root system_u:object_r:systemd_unit_file_t:s0 finger.socket

Comment 7 Miroslav Grepl 2013-09-02 13:18:32 UTC
Yes, I probably see also another bug related to this issue. I am investigating it.

Comment 8 Miroslav Grepl 2013-09-02 13:28:56 UTC
Ok, I was able to fix it for talk-server.

# nc --udp 127.0.0.1 518test
test

$ ps -eZ |grep ktalk
system_u:system_r:ktalkd_t:s0   14721 ?        00:00:00 in.ntalkd

$ ps -eZ |grep init
system_u:system_r:init_t:s0         1 ?        00:00:16 systemd


commit 7551ae747a485e95e965a05ba9bd3866b58205aa
Author: Miroslav Grepl <mgrepl>
Date:   Mon Sep 2 15:15:42 2013 +0200

    Make ktalk as init domain

diff --git a/ktalk.te b/ktalk.te
index 8da4d5d..1166856 100644
--- a/ktalk.te
+++ b/ktalk.te
@@ -7,6 +7,7 @@ policy_module(ktalk, 1.8.1)
 
 type ktalkd_t;
 type ktalkd_exec_t;
+init_daemon_domain(ktalkd_t, ktalkd_exec_t)
 inetd_udp_service_domain(ktalkd_t, ktalkd_exec_t)

Comment 9 Miroslav Grepl 2013-09-02 16:13:48 UTC
Adding fixes for others.

Comment 11 Daniel Walsh 2013-09-05 12:56:45 UTC
6804babd35f27f71fb799be631e6bd2119e889ab fixes this in git.

Comment 12 Daniel Walsh 2013-09-05 12:57:56 UTC
bed107b183700a0277093de44e59f041dc146408 fixes this in git.

Comment 14 Ludek Smid 2014-06-13 10:00:53 UTC
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.


Note You need to log in before you can comment on or make changes to this bug.