Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1082191

Summary: RHEL7 IPA selinuxusermap hbac rule not always matching
Product: Red Hat Enterprise Linux 7 Reporter: Scott Poore <spoore>
Component: sssdAssignee: Jakub Hrozek <jhrozek>
Status: CLOSED CURRENTRELEASE QA Contact: Kaushik Banerjee <kbanerje>
Severity: urgent Docs Contact:
Priority: urgent    
Version: 7.0CC: dpal, grajaiya, jgalipea, jhrozek, lslebodn, mkosek, nsoman, pbrezina, preichl, rcritten, spoore
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: sssd-1.11.2-65.el7 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-06-13 11:23:20 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
SSSD log from client none

Description Scott Poore 2014-03-29 00:25:33 UTC
Description of problem:

IPA selinuxusermap entries using HBAC rules are not always properly matching.  I'm seeing the first lookup/connection fail often in automated tests and follow up ones work.

In manual tests, I may have to run a test a few times before I see the failure.  Is there something going on with the id -Z check that is caugin

[root@ipaqa64vme ~]# ssh -l user3_1 ipaqa64vmc.testrelm.test 'id -Z'
staff_u:staff_r:staff_t:s0-s0:c0.c1023

[root@ipaqa64vme ~]# ssh -l user3_1 ipaqa64vmc.testrelm.test 'id -Z'
staff_u:staff_r:staff_t:s0-s0:c0.c1023

[root@ipaqa64vme ~]# ssh -l user3_1 ipaqa64vmc.testrelm.test 'id -Z'
staff_u:staff_r:staff_t:s0-s0:c0.c1023

[root@ipaqa64vme ~]# ssh -l user3_1 ipaqa64vmc.testrelm.test 'id -Z'
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

[root@ipaqa64vmc ~]# ipa selinuxusermap-show --all
Rule name: ^C
ipa: ERROR: Could not get Rule name interactively
[root@ipaqa64vmc ~]# ipa selinuxusermap-find --all
--------------------------
1 SELinux User Map matched
--------------------------
  dn: ipaUniqueID=c3b7ac90-b6c4-11e3-ac49-021016980186,cn=usermap,cn=selinux,dc=testrelm,dc=test
  Rule name: selinuxusermap3_1
  SELinux User: staff_u:s0-s0:c0.c1023
  HBAC Rule: hbacrule3_1
  Enabled: TRUE
  ipauniqueid: c3b7ac90-b6c4-11e3-ac49-021016980186
  objectclass: ipaassociation, ipaselinuxusermap
Number of entries returned 1
----------------------------
[root@ipaqa64vmc ~]# ipa hbacrule-find --all
--------------------
2 HBAC rules matched
--------------------
  dn: ipaUniqueID=4183ace4-b6c2-11e3-aaa2-021016980186,cn=hbac,dc=testrelm,dc=test
  Rule name: allow_all
  User category: all
  Host category: all
  Service category: all
  Description: Allow all users to access any host from any host
  Enabled: FALSE
  accessruletype: allow
  ipauniqueid: 4183ace4-b6c2-11e3-aaa2-021016980186
  objectclass: ipaassociation, ipahbacrule

  dn: ipaUniqueID=c021a5ea-b6c4-11e3-b738-021016980186,cn=hbac,dc=testrelm,dc=test
  Rule name: hbacrule3_1
  Enabled: TRUE
  Users: user3_1
  Hosts: ipaqa64vmc.testrelm.test
  Services: sshd
  accessruletype: allow
  ipauniqueid: c021a5ea-b6c4-11e3-b738-021016980186
  objectclass: ipaassociation, ipahbacrule
----------------------------
Number of entries returned 2
----------------------------

Version-Release number of selected component (if applicable):
ipa-server-3.3.3-27.el7.x86_64
sssd-1.11.2-63.el7.x86_64

How reproducible:
frequently but, not consistent.

Steps to Reproduce:

1.  Setup IPA Server

2.  Setup IPA Client

3.  Add IPA user and set kerberos password

echo 'Secret123'|kinit admin
echo -e 'password\npassword'|ipa user-add testuser1 --first=f --last=l --password
echo -e 'password\nSecret123\nSecret123'|kinit testuser1

4.  Add HBAC Rule to allow user to log into IPA Client:

echo 'Secret123'|kinit admin
ipa hbacrule-add testhbac1
ipa hbacrule-add-user testhbac1 --users=testuser1
ipa hbacrule-add-host testhbac1 --hosts=$CLIENT
ipa hbacrule-add-service testhbac1 --hbacsvcs=sshd

5.  Add SELinux User Mapping rule:

ipa selinuxusermap-add testselinux1 --selinuxuser="staff_u:s0-s0:c0.c1023" --hbacrule=testhbac1

6.  Check SELinux User Mapping via SSH:

echo 'Secret123'|kinit testuser1
ssh -l testuser1 $CLIENT id -Z

Actual results:

unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

Expected results:

staff_u:staff_r:staff_t:s0-s0:c0.c1023

Additional info:

Comment 2 Scott Poore 2014-03-29 00:29:17 UTC
Created attachment 880036 [details]
SSSD log from client

This is the sssd log from the client which first saw correct selinuxusermap and then saw incorrect.

Comment 3 Martin Kosek 2014-03-31 06:52:52 UTC
Given that SELinux assignment worked in one request but not in the another, I think this issue will be rather on the cliend side, not on the server side. Switching the component so that it can be properly investigated.

I check the log and I did not find any obvious issue, I just saw there were 2 logs in the first SELinux processing that were not in the second:

(Fri Mar 28 20:22:35 2014) [sssd[be[testrelm.test]]] [ipa_selinux_process_seealso_maps] (0x0400): HBAC rule [ipaUniqueID=c021a5ea-b6c4-11e3-b738-021016980186,cn=hbac,dc=testrelm,dc=test] matched, copying itsattributes to SELinux user map [ipaUniqueID=c021a5ea-b6c4-11e3-b738-021016980186,cn=hbac,dc=testrelm,dc=test]
(Fri Mar 28 20:22:35 2014) [sssd[be[testrelm.test]]] [be_pam_handler_callback] (0x0100): Backend returned: (0, 0, Success) [Success]
(Fri Mar 28 20:22:35 2014) [sssd[be[testrelm.test]]] [be_pam_handler_callback] (0x0100): Sending result [0][testrelm.test]
(Fri Mar 28 20:22:35 2014) [sssd[be[testrelm.test]]] [be_pam_handler_callback] (0x0100): Sent result [0][testrelm.test]

>>>   (Fri Mar 28 20:22:35 2014) [sssd[be[testrelm.test]]] [sdap_id_op_destroy] (0x4000): releasing operation connection
>>>   (Fri Mar 28 20:22:35 2014) [sssd[be[testrelm.test]]] [sdap_process_result] (0x2000): Trace: sh[0x7f8d3c595af0], connected[1], ops[(nil)], ldap[0x7f8d3c595f90]

(Fri Mar 28 20:22:35 2014) [sssd[be[testrelm.test]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing!
(Fri Mar 28 20:22:36 2014) [sssd[be[testrelm.test]]] [sbus_dispatch] (0x4000): dbus conn: 0x7f8d3c58d3d0

Comment 4 Jakub Hrozek 2014-03-31 11:56:39 UTC
(In reply to Martin Kosek from comment #3)
> >>>   (Fri Mar 28 20:22:35 2014) [sssd[be[testrelm.test]]] [sdap_id_op_destroy] (0x4000): releasing operation connection
> >>>   (Fri Mar 28 20:22:35 2014) [sssd[be[testrelm.test]]] [sdap_process_result] (0x2000): Trace: sh[0x7f8d3c595af0], connected[1], ops[(nil)], ldap[0x7f8d3c595f90]

I'd assume this is  because the connection was reused for the second attempt, while sssd was establishing it for the first attempt. Anyway, just guess and this code is low level LDAP connection handling, not directly SELinux code.

Comment 5 Jakub Hrozek 2014-03-31 11:59:39 UTC
(In reply to Scott Poore from comment #2)
> Created attachment 880036 [details]
> SSSD log from client
> 
> This is the sssd log from the client which first saw correct selinuxusermap
> and then saw incorrect.

I see a match (not sure if *the* match given that logs only contain uniqueIDs) in both authentication attempts. Scott, does your test system have the latest pam package (1.1.8-8) as well? If so, can I get access to the test system and check it out?

Comment 6 Scott Poore 2014-03-31 13:26:52 UTC
Yes, from the logs it looks like it had pam-1.1.8-8.el7.x86_64.  Unfortunately it's been returned already so I'll have to get a new one.  I'll let you know when that is ready.

Thanks.

Comment 7 Jakub Hrozek 2014-04-02 20:09:03 UTC
Upstream ticket:
https://fedorahosted.org/sssd/ticket/2300

Comment 9 Jakub Hrozek 2014-04-03 16:31:22 UTC
Fixed upstream:
    master: 355b8a655cfcc4e783077d12f76b55da1d23fb87
    sssd-1-11: ac93a2d27415abd730aa1063b1689def8be9dbe9

Comment 11 Scott Poore 2014-04-04 23:21:03 UTC
Verified.

Version ::

sssd-1.11.2-65.el7.x86_64

Results ::

With old version I added the following to /etc/sysconfig/sssd:

TALLOC_FREE_FILL=64

And I consistently see the error with the wrong SELinux User Mapping:

[root@intel-canoepass-12 ~]# vi /etc/sysconfig/sssd 

[root@intel-canoepass-12 ~]# service sssd restart
Redirecting to /bin/systemctl restart  sssd.service

[root@intel-canoepass-12 ~]# ssh -l testuser1 $(hostname) id -Z
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

[root@intel-canoepass-12 ~]# ssh -l testuser1 $(hostname) id -Z
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

[root@intel-canoepass-12 ~]# ssh -l testuser1 $(hostname) id -Z
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

[root@intel-canoepass-12 ~]# ssh -l testuser1 $(hostname) id -Z
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

[root@intel-canoepass-12 ~]# ssh -l testuser1 $(hostname) id -Z
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

Now, with fixed version:

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: ipa_bugcheck_bz1082191: RHEL7 IPA selinuxusermap hbac rule not always matching
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

Password for admin: 
:: [   PASS   ] :: Running 'echo -e 'Secret123'|kinit admin' (Expected 0, got 0)
---------------------------
Added user "bz1082191_user"
---------------------------
  User login: bz1082191_user
  First name: f
  Last name: l
  Full name: f l
  Display name: f l
  Initials: fl
  Home directory: /home/bz1082191_user
  GECOS: f l
  Login shell: /bin/sh
  Kerberos principal: bz1082191_user
  Email address: bz1082191_user
  UID: 773000010
  GID: 773000010
  Password: True
  Member of groups: ipausers
  Kerberos keys available: True
:: [   PASS   ] :: Running 'echo -e 'password\npassword'|ipa user-add bz1082191_user --first=f --last=l --password' (Expected 0, got 0)
Password for bz1082191_user: 
Password expired.  You must change it now.
Enter new password: 
Enter it again: 
:: [   PASS   ] :: Running 'echo -e 'password\nSecret123\nSecret123'|kinit bz1082191_user' (Expected 0, got 0)
cp: overwrite ‘/etc/sysconfig/sssd.ipa_bugcheck_bz1082191’? y
:: [   PASS   ] :: Running 'cp /etc/sysconfig/sssd /etc/sysconfig/sssd.ipa_bugcheck_bz1082191' (Expected 0, got 0)
:: [   PASS   ] :: Running 'echo TALLOC_FREE_FILL=64 >> /etc/sysconfig/sssd' (Expected 0, got 0)
Redirecting to /bin/systemctl stop  sssd.service
Redirecting to /bin/systemctl start  sssd.service
:: [   PASS   ] :: Running 'service sssd stop; rm -rf /var/lib/sss/{db,mc}/*; service sssd start' (Expected 0, got 0)
Password for bz1082191_user: 
:: [   PASS   ] :: Running 'echo -e 'Secret123'|kinit bz1082191_user' (Expected 0, got 0)
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
:: [   PASS   ] :: Running 'ssh -l bz1082191_user intel-canoepass-12.testrelm.test id -Z 2>&1|tee /tmp/tmpout.ipa_bugcheck_bz1082191 2>&1' (Expected 0, got 0)
:: [   PASS   ] :: File '/tmp/tmpout.ipa_bugcheck_bz1082191' should contain 'unconfined_u' 
Password for admin: 
:: [   PASS   ] :: Running 'echo -e 'Secret123'|kinit admin' (Expected 0, got 0)
--------------------------------
Added HBAC rule "bz1082191_hbac"
--------------------------------
  Rule name: bz1082191_hbac
  Enabled: TRUE
:: [   PASS   ] :: Running 'ipa hbacrule-add bz1082191_hbac' (Expected 0, got 0)
  Rule name: bz1082191_hbac
  Enabled: TRUE
  Users: bz1082191_user
-------------------------
Number of members added 1
-------------------------
:: [   PASS   ] :: Running 'ipa hbacrule-add-user bz1082191_hbac --users=bz1082191_user' (Expected 0, got 0)
  Rule name: bz1082191_hbac
  Enabled: TRUE
  Users: bz1082191_user
  Hosts: intel-canoepass-12.testrelm.test
-------------------------
Number of members added 1
-------------------------
:: [   PASS   ] :: Running 'ipa hbacrule-add-host bz1082191_hbac --hosts=intel-canoepass-12.testrelm.test' (Expected 0, got 0)
  Rule name: bz1082191_hbac
  Enabled: TRUE
  Users: bz1082191_user
  Hosts: intel-canoepass-12.testrelm.test
  Services: sshd
-------------------------
Number of members added 1
-------------------------
:: [   PASS   ] :: Running 'ipa hbacrule-add-service bz1082191_hbac --hbacsvcs=sshd' (Expected 0, got 0)
------------------------------------------
Added SELinux User Map "bz1082191_selinux"
------------------------------------------
  Rule name: bz1082191_selinux
  SELinux User: staff_u:s0-s0:c0.c1023
  HBAC Rule: bz1082191_hbac
  Enabled: TRUE
:: [   PASS   ] :: Running 'ipa selinuxusermap-add bz1082191_selinux --selinuxuser='staff_u:s0-s0:c0.c1023' --hbacrule=bz1082191_hbac' (Expected 0, got 0)
Redirecting to /bin/systemctl stop  sssd.service
Redirecting to /bin/systemctl start  sssd.service
:: [   PASS   ] :: Running 'service sssd stop; rm -rf /var/lib/sss/{db,mc}/*; service sssd start' (Expected 0, got 0)
Password for bz1082191_user: 
:: [   PASS   ] :: Running 'echo -e 'Secret123'|kinit bz1082191_user' (Expected 0, got 0)
staff_u:staff_r:staff_t:s0-s0:c0.c1023
:: [   PASS   ] :: Running 'ssh -l bz1082191_user intel-canoepass-12.testrelm.test id -Z 2>&1|tee /tmp/tmpout.ipa_bugcheck_bz1082191 2>&1' (Expected 0, got 0)
:: [   PASS   ] :: File '/tmp/tmpout.ipa_bugcheck_bz1082191' should contain 'staff_u' 
:: [   PASS   ] :: BZ 1082191 not found

Comment 12 Ludek Smid 2014-06-13 11:23:20 UTC
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.