Bug 1003012 - in.ntalkd runs as init_t when ntalk.socket is active
in.ntalkd runs as init_t when ntalk.socket is active
Status: CLOSED CURRENTRELEASE
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy (Show other bugs)
7.0
All Linux
medium Severity medium
: rc
: ---
Assigned To: Miroslav Grepl
Milos Malik
:
Depends On:
Blocks: 1004161
  Show dependency treegraph
 
Reported: 2013-08-30 09:32 EDT by Milos Malik
Modified: 2014-06-17 22:25 EDT (History)
2 users (show)

See Also:
Fixed In Version: selinux-policy-3.12.1-77.el7
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-06-13 06:00:53 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Milos Malik 2013-08-30 09:32:31 EDT
Description of problem:
It reminds me of bz#965140.

Version-Release number of selected component (if applicable):
selinux-policy-3.12.1-73.el7.noarch
selinux-policy-devel-3.12.1-73.el7.noarch
selinux-policy-doc-3.12.1-73.el7.noarch
selinux-policy-minimum-3.12.1-73.el7.noarch
selinux-policy-mls-3.12.1-73.el7.noarch
selinux-policy-targeted-3.12.1-73.el7.noarch
talk-server-0.17-42.el7.x86_64

How reproducible:
always

Steps to Reproduce:
# systemctl enable ntalk.socket
ln -s '/usr/lib/systemd/system/ntalk.socket' '/etc/systemd/system/sockets.target.wants/ntalk.socket'
# systemctl start ntalk.socket
# systemctl status ntalk.socket
ntalk.socket - Talk Server Activation Socket
   Loaded: loaded (/usr/lib/systemd/system/ntalk.socket; enabled)
   Active: active (listening) since Fri 2013-08-30 09:28:23 EDT; 22s ago
     Docs: man:ntalkd(8)
           man:talk(1)
   Listen: 0.0.0.0:518 (Datagram)

# nc --udp 127.0.0.1 518
pokus
o^Z
[1]+  Stopped                 nc --udp 127.0.0.1 518
# ps -efZ | grep talk
system_u:system_r:init_t:s0     nobody   14507     1  0 09:29 ?        00:00:00 /usr/sbin/in.ntalkd
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 14509 7635  0 09:29 pts/0 00:00:00 grep --color=auto talk
# fg
nc --udp 127.0.0.1 518
^C

Actual results:
 * in.ntalkd runs as init_t

Expected results:
 * in.ntalkd runs as ktalkd_t
Comment 1 Milos Malik 2013-08-30 09:59:13 EDT
The same problem appears when following daemons are executed by systemd:
 * /usr/sbin/in.rexecd
 * /usr/sbin/in.rlogind
Comment 2 Milos Malik 2013-08-30 10:19:51 EDT
The list of daemons executed by systemd and running as init_t:
 * /usr/sbin/in.rexecd
 * /usr/sbin/in.rlogind
 * /usr/sbin/in.telnetd
 * /usr/sbin/in.authd
Comment 4 Milos Malik 2013-09-02 05:47:32 EDT
Following services can be executed by systemd when a TCP connection is established to their port:

# pwd
/usr/lib/systemd/system
# grep -i -e "listenstream=[0-9]" -e "listendatagram=[0-9]" *.socket
amanda.socket:ListenStream=10080
amanda-udp.socket:ListenDatagram=10080
auth.socket:ListenStream=113
btimed.socket:ListenDatagram=23456
cups-lpd.socket:ListenStream=515
cvs.socket:ListenStream=2401
dovecot.socket:ListenStream=0.0.0.0:143
dovecot.socket:ListenStream=0.0.0.0:993
eklogin.socket:ListenStream=2105
ekrb5-telnet.socket:ListenStream=23
ekshell.socket:ListenStream=544
finger.socket:ListenStream=79
git.socket:ListenStream=9418
gssftp.socket:ListenStream=21
klogin.socket:ListenStream=543
krb5-telnet.socket:ListenStream=23
kshell.socket:ListenStream=544
ntalk.socket:ListenDatagram=0.0.0.0:518
qarshd.socket:ListenStream=5008
rexec.socket:ListenStream=512
rlogin.socket:ListenStream=513
rsh.socket:ListenStream=514
rsyncd.socket:ListenStream=873
sshd.socket:ListenStream=22
systemd-journal-gatewayd.socket:ListenStream=19531
telnet.socket:ListenStream=23
tftp.socket:ListenDatagram=69
#

Manual tests (see Steps to Reproduce in comment#0), which I did on a fresh RHEL-7 machine provided by beaker, showed that only following services run under correct SELinux context:
dovecot.socket
finger.socket
gssftp.socket
qarshd.socket
sshd.socket
tftp.socket
Comment 5 Miroslav Grepl 2013-09-02 08:15:25 EDT
# ls -Z /usr/lib/systemd/system/ntalk*
-rw-r--r--. root root system_u:object_r:systemd_unit_file_t:s0 /usr/lib/systemd/system/ntalk.service
-rw-r--r--. root root system_u:object_r:systemd_unit_file_t:s0 /usr/lib/systemd/system/ntalk.socket

so we don't have support for these unit files. Could you check labels also for others where you see it does not work.
Comment 6 Milos Malik 2013-09-02 08:26:34 EDT
I don't think the problem is caused by incorrect labelling of unit files because amanda and cups-lpd run as init_t even if their unit files are labelled correctly. On the other hand dovecot and finger daemons run under correct context even if their unit files are not labelled correctly.

-rw-r--r--. root root system_u:object_r:amanda_unit_file_t:s0 amanda.socket
-rw-r--r--. root root system_u:object_r:cupsd_unit_file_t:s0 cups-lpd.socket
-rw-r--r--. root root system_u:object_r:systemd_unit_file_t:s0 dovecot.socket
-rw-r--r--. root root system_u:object_r:systemd_unit_file_t:s0 finger.socket
Comment 7 Miroslav Grepl 2013-09-02 09:18:32 EDT
Yes, I probably see also another bug related to this issue. I am investigating it.
Comment 8 Miroslav Grepl 2013-09-02 09:28:56 EDT
Ok, I was able to fix it for talk-server.

# nc --udp 127.0.0.1 518test
test

$ ps -eZ |grep ktalk
system_u:system_r:ktalkd_t:s0   14721 ?        00:00:00 in.ntalkd

$ ps -eZ |grep init
system_u:system_r:init_t:s0         1 ?        00:00:16 systemd


commit 7551ae747a485e95e965a05ba9bd3866b58205aa
Author: Miroslav Grepl <mgrepl@redhat.com>
Date:   Mon Sep 2 15:15:42 2013 +0200

    Make ktalk as init domain

diff --git a/ktalk.te b/ktalk.te
index 8da4d5d..1166856 100644
--- a/ktalk.te
+++ b/ktalk.te
@@ -7,6 +7,7 @@ policy_module(ktalk, 1.8.1)
 
 type ktalkd_t;
 type ktalkd_exec_t;
+init_daemon_domain(ktalkd_t, ktalkd_exec_t)
 inetd_udp_service_domain(ktalkd_t, ktalkd_exec_t)
Comment 9 Miroslav Grepl 2013-09-02 12:13:48 EDT
Adding fixes for others.
Comment 11 Daniel Walsh 2013-09-05 08:56:45 EDT
6804babd35f27f71fb799be631e6bd2119e889ab fixes this in git.
Comment 12 Daniel Walsh 2013-09-05 08:57:56 EDT
bed107b183700a0277093de44e59f041dc146408 fixes this in git.
Comment 14 Ludek Smid 2014-06-13 06:00:53 EDT
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.

Note You need to log in before you can comment on or make changes to this bug.