RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1195339 - ipa-client-install changes the label on various files which causes SELinux denials
Summary: ipa-client-install changes the label on various files which causes SELinux de...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.1
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: rc
: ---
Assignee: Pavel Picka
QA Contact: Namita Soman
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-02-23 15:41 UTC by Patrik Kis
Modified: 2015-11-19 12:01 UTC (History)
11 users (show)

Fixed In Version: ipa-4.2.0-4.el7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-11-19 12:01:34 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
audit messages produced by special policy module (214.19 KB, text/plain)
2015-02-24 09:35 UTC, Milos Malik 		no flags Details
Verify log for bz (1.49 KB, text/plain)
2015-09-30 12:57 UTC, Pavel Picka 		no flags Details
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2015:2362 0 normal SHIPPED_LIVE ipa bug fix and enhancement update 2015-11-19 10:40:46 UTC

Description Patrik Kis 2015-02-23 15:41:41 UTC 
Description of problem:
The following AVC debial appeared during testing:

----
time->Fri Feb 20 14:54:26 2015
type=SYSCALL msg=audit(1424440466.677:692): arch=c000003e syscall=21 success=no exit=-13 a0=7fb175c03338 a1=4 a2=10 a3=fffffffffffff558 items=0 ppid=15957 pid=15958 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sssd_be" exe="/usr/libexec/sssd/sssd_be" subj=system_u:system_r:sssd_t:s0 key=(null)
type=AVC msg=audit(1424440466.677:692): avc:  denied  { read } for  pid=15958 comm="sssd_be" name="krb5.conf" dev="dm-0" ino=203775716 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:realmd_var_lib_t:s0 tclass=file
----
time->Fri Feb 20 14:54:26 2015
type=SYSCALL msg=audit(1424440466.677:693): arch=c000003e syscall=4 success=no exit=-13 a0=7fb175c2c4a8 a1=7fffb8a58000 a2=7fffb8a58000 a3=0 items=0 ppid=15957 pid=15958 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sssd_be" exe="/usr/libexec/sssd/sssd_be" subj=system_u:system_r:sssd_t:s0 key=(null)
type=AVC msg=audit(1424440466.677:693): avc:  denied  { getattr } for  pid=15958 comm="sssd_be" pa

The issue could not been reproduced.
Not sure if anything can be done with it if there is no reproducer; feel free to close it, if the root cause can not be found.

Version-Release number of selected component (if applicable):
selinux-policy-3.13.1-23.el7
sssd-1.12.2-58.el7
ipa-client-4.1.0-18.el7

How reproducible:
appeared only once


Some additional info:

# semanage fcontext -l |grep realmd_var_lib_t
/var/lib/ipa-client(/.*)?                          all files          system_u:object_r:realmd_var_lib_t:s0 
# rpm -qf /var/lib/ipa-client
ipa-client-4.1.0-18.el7.s390x
# ls -la /var/lib/ipa-client/
total 4
drwxr-xr-x.  3 root root   23 Feb 23 05:16 .
drwxr-xr-x. 42 root root 4096 Feb 23 05:47 ..
drwxr-xr-x.  2 root root    6 Jan 30 10:47 sysrestore
# ls -la /var/lib/ipa-client/sysrestore/
# ls -la /var/lib/ipa-client/sysrestore/
total 0
drwxr-xr-x. 2 root root  6 Jan 30 10:47 .
drwxr-xr-x. 3 root root 23 Feb 23 05:16 ..
Comment 2 Milos Malik 2015-02-24 08:33:15 UTC 
The /etc/krb5.conf file is obviously mislabeled, but the question which process mislabeled it:
----
time->Fri Feb 20 14:54:26 2015
type=SYSCALL msg=audit(1424440466.677:692): arch=c000003e syscall=21 success=no exit=-13 a0=7fb175c03338 a1=4 a2=10 a3=fffffffffffff558 items=0 ppid=15957 pid=15958 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sssd_be" exe="/usr/libexec/sssd/sssd_be" subj=system_u:system_r:sssd_t:s0 key=(null)
type=AVC msg=audit(1424440466.677:692): avc:  denied  { read } for  pid=15958 comm="sssd_be" name="krb5.conf" dev="dm-0" ino=203775716 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:realmd_var_lib_t:s0 tclass=file
----
time->Fri Feb 20 14:54:26 2015
type=SYSCALL msg=audit(1424440466.677:693): arch=c000003e syscall=4 success=no exit=-13 a0=7fb175c2c4a8 a1=7fffb8a58000 a2=7fffb8a58000 a3=0 items=0 ppid=15957 pid=15958 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sssd_be" exe="/usr/libexec/sssd/sssd_be" subj=system_u:system_r:sssd_t:s0 key=(null)
type=AVC msg=audit(1424440466.677:693): avc:  denied  { getattr } for  pid=15958 comm="sssd_be" path="/etc/krb5.conf" dev="dm-0" ino=203775716 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:realmd_var_lib_t:s0 tclass=file
----

# matchpathcon /etc/krb5.conf
/etc/krb5.conf	system_u:object_r:krb5_conf_t:s0
#
Comment 3 Milos Malik 2015-02-24 09:35:54 UTC 
Created attachment 994637 [details]
audit messages produced by special policy module
Comment 4 Patrik Kis 2015-02-24 09:38:49 UTC 
Here are some more details:

The issue is caused by /usr/sbin/ipa-client-install when the machine is unenrolled from IPA domain. But the AVC appears only from time to time, when other process tries to access the affected file. 
Other configuration files are affected too, like ntp.conf, /etc/nsswitch.conf

type=SYSCALL msg=audit(1424767029.770:127906): arch=c000003e syscall=82 success=yes exit=0 a0=1b1dd70 a1=146a5a0 a2=7
f6c3d729f88 a3=fffffff0 items=5 ppid=23379 pid=24565 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 
fsgid=0 tty=(none) ses=4294967295 comm="ipa-client-inst" exe="/usr/bin/python2.7" subj=system_u:system_r:realmd_t:s0-
s0:c0.c1023 key=(null)
type=CWD msg=audit(1424767029.770:127906):  cwd="/"
type=PATH msg=audit(1424767029.770:127906): item=0 name="/var/lib/ipa-client/sysrestore/" inode=68984173 dev=fd:00 mo
de=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:realmd_var_lib_t:s0 objtype=PARENT
type=PATH msg=audit(1424767029.770:127906): item=1 name="/etc/" inode=134309313 dev=fd:00 mode=040755 ouid=0 ogid=0 r
dev=00:00 obj=system_u:object_r:etc_t:s0 objtype=PARENT
type=PATH msg=audit(1424767029.770:127906): item=2 name="/var/lib/ipa-client/sysrestore/5b26b063fa2d52ce-krb5.conf" i
node=68893890 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:realmd_var_lib_t:s0 objtype=DELET
E
type=PATH msg=audit(1424767029.770:127906): item=3 name="/etc/krb5.conf" inode=137256515 dev=fd:00 mode=0100644 ouid=
0 ogid=0 rdev=00:00 obj=system_u:object_r:krb5_conf_t:s0 objtype=DELETE
type=PATH msg=audit(1424767029.770:127906): item=4 name="/etc/krb5.conf" inode=68893890 dev=fd:00 mode=0100644 ouid=0
 ogid=0 rdev=00:00 obj=system_u:object_r:realmd_var_lib_t:s0 objtype=CREATE
type=AVC msg=audit(1424767029.772:127907): avc:  denied  { read } for  pid=24738 comm="sssd_be" name="krb5.conf" dev=
"dm-0" ino=68893890 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:realmd_var_lib_t:s0 tclass=file
type=SYSCALL msg=audit(1424767029.772:127907): arch=c000003e syscall=21 success=no exit=-13 a0=7f7234b4c388 a1=4 a2=e
 a3=12 items=1 ppid=24737 pid=24738 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none
) ses=4294967295 comm="sssd_be" exe="/usr/libexec/sssd/sssd_be" subj=system_u:system_r:sssd_t:s0 key=(null)
type=CWD msg=audit(1424767029.772:127907):  cwd="/"
type=PATH msg=audit(1424767029.772:127907): item=0 name="/etc/krb5.conf" inode=68893890 dev=fd:00 mode=0100644 ouid=0
 ogid=0 rdev=00:00 obj=system_u:object_r:realmd_var_lib_t:s0 objtype=NORMAL
type=AVC msg=audit(1424767029.772:127908): avc:  denied  { getattr } for  pid=24738 comm="sssd_be" path="/etc/krb5.co
nf" dev="dm-0" ino=68893890 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:realmd_var_lib_t:s0 tclas
s=file
type=SYSCALL msg=audit(1424767029.772:127908): arch=c000003e syscall=4 success=no exit=-13 a0=7f7234b751d8 a1=7fff772
ca2b0 a2=7fff772ca2b0 a3=0 items=1 ppid=24737 pid=24738 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid
=0 fsgid=0 tty=(none) ses=4294967295 comm="sssd_be" exe="/usr/libexec/sssd/sssd_be" subj=system_u:system_r:sssd_t:s0 
key=(null)
type=CWD msg=audit(1424767029.772:127908):  cwd="/"
type=PATH msg=audit(1424767029.772:127908): item=0 name="/etc/krb5.conf" inode=68893890 dev=fd:00 mode=0100644 ouid=0
 ogid=0 rdev=00:00 obj=system_u:object_r:realmd_var_lib_t:s0 objtype=NORMAL
type=AVC msg=audit(1424767029.772:127909): avc:  denied  { read } for  pid=24738 comm="sssd_be" name="krb5.conf" dev=
"dm-0" ino=68893890 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:realmd_var_lib_t:s0 tclass=file
type=SYSCALL msg=audit(1424767029.772:127909): arch=c000003e syscall=21 success=no exit=-13 a0=7f7234b4c388 a1=4 a2=e
 a3=0 items=1 ppid=24737 pid=24738 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none)
 ses=4294967295 comm="sssd_be" exe="/usr/libexec/sssd/sssd_be" subj=system_u:system_r:sssd_t:s0 key=(null)
type=CWD msg=audit(1424767029.772:127909):  cwd="/"
type=PATH msg=audit(1424767029.772:127909): item=0 name="/etc/krb5.conf" inode=68893890 dev=fd:00 mode=0100644 ouid=0
 ogid=0 rdev=00:00 obj=system_u:object_r:realmd_var_lib_t:s0 objtype=NORMAL
type=AVC msg=audit(1424767029.772:127910): avc:  denied  { getattr } for  pid=24738 comm="sssd_be" path="/etc/krb5.co
nf" dev="dm-0" ino=68893890 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:realmd_var_lib_t:s0 tclas
s=file
Comment 5 Milos Malik 2015-02-24 09:39:37 UTC 
BTW the ipa-client-install program changes context of following files:
/etc/krb5.conf
/etc/nsswitch.conf
/etc/ntp.conf
/etc/ntp/step-tickers
/etc/openldap/ldap.conf
/etc/ssh/ssh_config
/etc/ssh/sshd_config
/etc/sssd/sssd.conf
/etc/sssd/sssd.conf.bkp
/etc/sysconfig/ntpd
Comment 6 Patrik Kis 2015-02-24 10:52:01 UTC 
One more note to this bug report:

Currently /usr/sbin/ipa-client-install tries to restore the context after the file was moved, but sssd reads the file right between it was moved and the context was restored:

type=SYSCALL msg=audit(1424772873.772:129716): arch=c000003e syscall=82 success=yes exit=0 a0=139b670 a1=dc6710 a2=7f8bb3e57f88 a3=0 items=5 ppid=17957 pid=18828 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ipa-client-inst" exe="/usr/bin/python2.7" subj=system_u:system_r:realmd_t:s0-s0:c0.c1023 key="KRB5.CONF"
type=CWD msg=audit(1424772873.772:129716):  cwd="/"
type=PATH msg=audit(1424772873.772:129716): item=0 name="/var/lib/ipa-client/sysrestore/" inode=68984173 dev=fd:00 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:realmd_var_lib_t:s0 objtype=PARENT
type=PATH msg=audit(1424772873.772:129716): item=1 name="/etc/" inode=134309313 dev=fd:00 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0 objtype=PARENT
type=PATH msg=audit(1424772873.772:129716): item=2 name="/var/lib/ipa-client/sysrestore/a34358ae23721cf6-krb5.conf" inode=68893893 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:realmd_var_lib_t:s0 objtype=DELETE
type=PATH msg=audit(1424772873.772:129716): item=3 name="/etc/krb5.conf" inode=136224343 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:krb5_conf_t:s0 objtype=DELETE
type=PATH msg=audit(1424772873.772:129716): item=4 name="/etc/krb5.conf" inode=68893893 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:realmd_var_lib_t:s0 objtype=CREATE
type=AVC msg=audit(1424772873.781:129717): avc:  denied  { read } for  pid=19002 comm="sssd_be" name="krb5.conf" dev="dm-0" ino=68893893 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:realmd_var_lib_t:s0 tclass=file
type=SYSCALL msg=audit(1424772873.781:129717): arch=c000003e syscall=21 success=no exit=-13 a0=7f55ea630b98 a1=4 a2=e a3=0 items=1 ppid=19001 pid=19002 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sssd_be" exe="/usr/libexec/sssd/sssd_be" subj=system_u:system_r:sssd_t:s0 key=(null)
type=CWD msg=audit(1424772873.781:129717):  cwd="/"
type=PATH msg=audit(1424772873.781:129717): item=0 name="/etc/krb5.conf" inode=68893893 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:realmd_var_lib_t:s0 objtype=NORMAL
type=AVC msg=audit(1424772873.781:129718): avc:  denied  { getattr } for  pid=19002 comm="sssd_be" path="/etc/krb5.conf" dev="dm-0" ino=68893893 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:realmd_var_lib_t:s0 tclass=file
type=SYSCALL msg=audit(1424772873.781:129718): arch=c000003e syscall=4 success=no exit=-13 a0=7f55ea649b88 a1=7fff58ab6c80 a2=7fff58ab6c80 a3=0 items=1 ppid=19001 pid=19002 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sssd_be" exe="/usr/libexec/sssd/sssd_be" subj=system_u:system_r:sssd_t:s0 key=(null)
type=CWD msg=audit(1424772873.781:129718):  cwd="/"
type=PATH msg=audit(1424772873.781:129718): item=0 name="/etc/krb5.conf" inode=68893893 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:realmd_var_lib_t:s0 objtype=NORMAL
type=SYSCALL msg=audit(1424772873.788:129719): arch=c000003e syscall=189 success=yes exit=0 a0=7f8287dea1c0 a1=7f8286eb077e a2=7f8287deb5e0 a3=21 items=1 ppid=18828 pid=19014 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:setfiles_t:s0-s0:c0.c1023 key="SET-EXTATTR"
type=CWD msg=audit(1424772873.788:129719):  cwd="/"
type=PATH msg=audit(1424772873.788:129719): item=0 name="/etc/krb5.conf" inode=68893893 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:realmd_var_lib_t:s0 objtype=NORMAL



The issue appears when the machine was previously enrolled to an AD and IPA doamin too and then when ipa client is unistalled sssd suppose to keep running.

It probably could be fixed if the config files from backup weren't moved and then label restored, but copied. In that case a new file were created and with correct label, or if the original file exists, just the content is updated and no relabeling is needed.
Comment 7 Petr Vobornik 2015-02-24 12:53:32 UTC 
Upstream ticket:
https://fedorahosted.org/freeipa/ticket/4923
Comment 8 Petr Vobornik 2015-07-17 11:59:24 UTC 
--uninstall fix:

master:
https://fedorahosted.org/freeipa/changeset/9f701283534745bf93b41a1886183e9ef1d06566
ipa-4-2:
https://fedorahosted.org/freeipa/changeset/92a73e8b2a5f26744b036a36de4b9956e8883f61
Comment 10 Martin Bašti 2015-07-29 14:53:12 UTC 
Fixed upstream
master:
https://fedorahosted.org/freeipa/changeset/45c709112da1514d57db46f9706bc03920574adf
ipa-4-2:
https://fedorahosted.org/freeipa/changeset/21d31224780d4e1e5e4371f12c5ebae6b4aca54f
Comment 12 Pavel Picka 2015-09-30 12:57:56 UTC 
Created attachment 1078638 [details]
Verify log for bz

Verified 

ipa-client-4.2.0-12.el7.x86_64
Comment 13 errata-xmlrpc 2015-11-19 12:01:34 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2362.html
Note You need to log in before you can comment on or make changes to this bug.