Bug 1105212
| Summary: | FreeIPA's httpd cannot read CRL generated by PKI | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Martin Kosek <mkosek> | |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> | |
| Status: | CLOSED ERRATA | QA Contact: | Stanislav Zidek <szidek> | |
| Severity: | high | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 7.0 | CC: | adingman, lvrabec, mmalik, pviktori, szidek | |
| Target Milestone: | rc | Keywords: | Regression | |
| Target Release: | --- | |||
| Hardware: | Unspecified | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | Bug Fix | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1115418 1152219 (view as bug list) | Environment: | ||
| Last Closed: | 2015-03-05 10:39:22 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1082754, 1115418, 1152219 | |||
|
Description
Martin Kosek
2014-06-05 15:29:02 UTC
I would consider this a regression given CRL could be downloaded in RHEL-6 (though only via https): $ wget https://`hostname`/ipa/crl/MasterCRL.bin --no-check-certificate selinux-policy-3.7.19-231.el6_5.3.noarch ipa-server-3.0.0-37.el6.x86_64 What are you getting in permissive mode? Hmm, actually I get no AVC when in permissive mode: # setenforce 0 # wget http://`hostname`/ipa/crl/MasterCRL.bin 2014-06-06 06:20:54 (51.3 MB/s) - ‘MasterCRL.bin’ saved [414/414] # ausearch -m avc -ts today <no matches> This changes when I enable enforcing mode: # setenforce 1 # wget http://`hostname`/ipa/crl/MasterCRL.bin 2014-06-06 06:21:36 ERROR 403: Forbidden. # ausearch -m avc -ts today ---- time->Fri Jun 6 06:21:36 2014 type=SYSCALL msg=audit(1402050096.299:407): arch=c000003e syscall=4 success=no exit=-13 a0=7fd163cbc7c0 a1=7fff1058a1a0 a2=7fff1058a1a0 a3=7fd158642752 items=0 ppid=5172 pid=5995 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null) type=AVC msg=audit(1402050096.299:407): avc: denied { search } for pid=5995 comm="httpd" name="ipa" dev="dm-1" ino=1527033 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:ipa_var_lib_t:s0 tclass=dir ---- time->Fri Jun 6 06:21:36 2014 type=SYSCALL msg=audit(1402050096.299:408): arch=c000003e syscall=6 success=no exit=-13 a0=7fd163cbc8c0 a1=7fff1058a1a0 a2=7fff1058a1a0 a3=0 items=0 ppid=5172 pid=5995 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null) type=AVC msg=audit(1402050096.299:408): avc: denied { getattr } for pid=5995 comm="httpd" path="/var/lib/ipa" dev="dm-1" ino=1527033 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:ipa_var_lib_t:s0 tclass=dir I got no AVC in permissive mode even when I disabled noaudit with # semodule -DB I see we have httpd_manage_ipa boolean. Probably it should be a part of this boolean. Or do we want to allow it by default? I am personally OK with both options, we turn on httpd_manage_ipa during FreeIPA installation. It depends what is the semantics of this sebool. Given the man page description of the sebool "If you want to allow httpd processes to manage IPA content, you must turn on the httpd_manage_ipa boolean." I would say yes - it should be part of the boolean. This issue is still present also in Fedora 20, I will clone the bug. Link for selinux-policy package with fix: http://koji.fedoraproject.org/koji/buildinfo?buildID=541542 Spec fixed upstream master: https://fedorahosted.org/freeipa/changeset/5434851efd394c27ab6445a4b7544767452e20a5 Restoring the state back to ASSIGNED - Petr did not notice this is a selinux-policy bug, not ipa one. commit 0293b601ec803a1e2b6ec1b8c1e6e40950bafa78
Author: Miroslav Grepl <mgrepl>
Date: Wed Jul 2 12:53:45 2014 +0200
Allow apache to search ipa lib files by default
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-0458.html |