Hide Forgot
Description of problem: After running ipa-adtrust-install, I see AVC denials for winbind: time->Wed Sep 25 12:38:16 2013 type=SYSCALL msg=audit(1380130696.038:610): arch=c000003e syscall=248 success=yes exit=328706324 a0=7f1f35139b2e a1=7f1f3bed3910 a2=0 a3=0 items=0 ppid=18147 pid=18150 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="winbindd" exe="/usr/sbin/winbindd" subj=system_u:system_r:winbind_t:s0 key=(null) type=AVC msg=audit(1380130696.038:610): avc: denied { write } for pid=18150 comm="winbindd" scontext=system_u:system_r:winbind_t:s0 tcontext=system_u:system_r:winbind_t:s0 tclass=key ---- time->Wed Sep 25 12:38:16 2013 type=SYSCALL msg=audit(1380130696.038:611): arch=c000003e syscall=250 success=yes exit=4 a0=b a1=1397a914 a2=0 a3=0 items=0 ppid=18147 pid=18150 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="winbindd" exe="/usr/sbin/winbindd" subj=system_u:system_r:winbind_t:s0 key=(null) type=AVC msg=audit(1380130696.038:611): avc: denied { read } for pid=18150 comm="winbindd" scontext=system_u:system_r:winbind_t:s0 tcontext=system_u:system_r:winbind_t:s0 tclass=key Version-Release number of selected component (if applicable): selinux-policy-3.12.1-80.el7.noarch How reproducible: unknown at the moment. expected always Steps to Reproduce: 1. Install IPA server 2. ipa-adtrust-install Actual results: AVCs above. Expected results: non AVC denials. Additional info:
Milos, any chance are you getting it for more domains?
#============= winbind_t ============== #!!!! This avc is allowed in the current policy allow winbind_t self:key read;
Has been fixed.
*** Bug 1012051 has been marked as a duplicate of this bug. ***
*** Bug 1009177 has been marked as a duplicate of this bug. ***
I can confirm I was able to install IPA with enforced SELinux with the new version of selinux-policy. Thanks Mirek!
This request was resolved in Red Hat Enterprise Linux 7.0. Contact your manager or support representative in case you have further questions about the request.