Red Hat Bugzilla – Bug 1192314
With empty ipaselinuxusermapdefault security context on client is staff_u
Last modified: 2015-11-19 06:35:42 EST
Description of problem: Default security context for users on client becomes staff_u:staff_r:staff_t:s0-s0:c0.c1023 when ipaselinuxusermapdefault is not set Version-Release number of selected component (if applicable): ipa-server-4.1.0-18.el7.x86_64 How reproducible: always Steps to Reproduce: 1. Setup trust 2. Remove default selinux user 3. check security contest of user Actual results: On IPA Master [root@bumblebee ~]# ipa config-mod --ipaselinuxusermapdefault= [root@bumblebee ~]# ipa config-show Maximum username length: 32 Home directory base: /home Default shell: /bin/sh Default users group: ipausers Default e-mail domain: slnx2k8r2.test Search time limit: 2 Search size limit: 100 User search fields: uid,givenname,sn,telephonenumber,ou,title Group search fields: cn,description Enable migration mode: FALSE Certificate Subject base: O=SLNX2K8R2.TEST Password Expiration Notification (days): 4 Password plugin features: AllowNThash SELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023 Default PAC types: nfs:NONE, MS-PAC [root@bumblebee ~]# kdestroy -A [root@bumblebee ~]# echo Secret123| kinit au102130134@IPAAD2008R2.TEST Password for au102130134@IPAAD2008R2.TEST: [root@bumblebee ~]# ssh -l au102130134@ipaad2008r2.test `hostname` id -Z unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 On Client [root@vm-idm-033 ~]# service sssd stop; rm -rf /var/lib/sssd/{db,mc}/*; service sssd start Redirecting to /bin/systemctl stop sssd.service Redirecting to /bin/systemctl start sssd.service [root@vm-idm-033 ~]# kdestroy -A [root@vm-idm-033 ~]# echo Secret123| kinit au102130134@IPAAD2008R2.TEST Password for au102130134@IPAAD2008R2.TEST: [root@vm-idm-033 ~]# ssh -l au102130134@ipaad2008r2.test `hostname` id -Z staff_u:staff_r:staff_t:s0-s0:c0.c1023 Expected results: [root@vm-idm-033 ~]# ssh -l au102130134@ipaad2008r2.test `hostname` id -Z unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
I assume that in that case, the default comes from SSSD. Reassigning.
Upstream ticket: https://fedorahosted.org/sssd/ticket/2587
The problem here is that SSSD does not delete the user's old selinux context. Jakub already wrote a patch and it is on review. As a workaround, you can use semanage tools to delete the old context: semanage login --delete username Then the right default will be picked up.
* master: 01f78f755fde63997ccfded71fb8395569b11430 * sssd-1-12: 90efb3c2a48146d7b6cc81fe8422e9024144402a
Verified in version [root@vm-idm-043 ~]# rpm -q sssd sssd-1.13.0-11.el7.x86_64 Master [root@vm-idm-014 ~]# ipa config-show | grep -i selinux SELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023 Default SELinux user: unconfined_u:s0-s0:c0.c1023 [root@vm-idm-014 ~]# ipa config-mod --ipaselinuxusermapdefault= Maximum username length: 32 Home directory base: /home Default shell: /bin/sh Default users group: ipausers Default e-mail domain: stvidrange.test Search time limit: 2 Search size limit: 100 User search fields: uid,givenname,sn,telephonenumber,ou,title Group search fields: cn,description Enable migration mode: FALSE Certificate Subject base: O=STVIDRANGE.TEST Password Expiration Notification (days): 4 Password plugin features: AllowNThash SELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023 Default PAC types: nfs:NONE, MS-PAC [root@vm-idm-014 ~]# ipa config-show | grep -i selinux SELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023 [root@vm-idm-014 ~]# kdestroy -A [root@vm-idm-014 ~]# echo Secret123 | kinit aduser1@ADTEST.QE Password for aduser1@ADTEST.QE: [root@vm-idm-014 ~]# ssh -l aduser1@adtest.qe `hostname` id -Z Could not chdir to home directory /home/adtest.qe/aduser1: No such file or directory unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 [root@vm-idm-014 ~]# service sssd stop ; rm -f /var/lib/sss/{mc,db}/* ; service sssd start Redirecting to /bin/systemctl stop sssd.service Redirecting to /bin/systemctl start sssd.service Client [root@vm-idm-043 ~]# kdestroy -A [root@vm-idm-043 ~]# echo Secret123 | kinit aduser1@ADTEST.QE Password for aduser1@ADTEST.QE: [root@vm-idm-043 ~]# service sssd stop ; rm -f /var/lib/sss/{mc,db}/* ; service sssd start Redirecting to /bin/systemctl stop sssd.service Redirecting to /bin/systemctl start sssd.service [root@vm-idm-043 ~]# ssh -l aduser1@adtest.qe `hostname` id -Z unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 [root@vm-idm-043 ~]# rpm -q sssd sssd-1.13.0-11.el7.x86_64 [root@vm-idm-043 ~]# service sssd stop ; rm -f /var/lib/sss/{mc,db}/* ; service sssd start Redirecting to /bin/systemctl stop sssd.service Redirecting to /bin/systemctl start sssd.service [root@vm-idm-043 ~]# ssh -l aduser1@adtest.qe `hostname` id -Z unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2015-2355.html