Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
When install slapd in a Debian system in a SELinux enabled docker container, SELinux prevents slappasswd from 'execmod' accesses.
/var/log/audit/audit.log:type=AVC msg=audit(1427399438.232:448): avc: denied { execmod } for pid=4483 comm="slappasswd" path="/usr/sbin/slappasswd" dev="dm-2" ino=399582 scontext=system_u:system_r:svirt_lxc_net_t:s0:c263,c493 tcontext=system_u:object_r:svirt_sandbox_file_t:s0:c263,c493 tclass=fil
Version-Release number of selected component (if applicable):
3.13.1-23.el7
How reproducible:
sudo yum install docker
sudo systemctl start docker
sudo docker run --rm -t -i debian /bin/bash
(Now we are on the container's shell)
apt-get update && apt-get install -y slapd
(You should be prompted of some questions, just randomly fill them)
You should then have the SELinux error.
Actual results:
The container shell outputs:
slappasswd: error while loading shared libraries: cannot restore segment prot after reloc: Permission denied
Creating initial configuration... Loading the initial configuration from the ldif file () failed with
the following error while running slapadd:
slapadd: error while loading shared libraries: cannot restore segment prot after reloc: Permission denied
----
SELinux audit log:
/var/log/audit/audit.log:type=AVC msg=audit(1427399438.232:448): avc: denied { execmod } for pid=4483 comm="slappasswd" path="/usr/sbin/slappasswd" dev="dm-2" ino=399582 scontext=system_u:system_r:svirt_lxc_net_t:s0:c263,c493 tcontext=system_u:object_r:svirt_sandbox_file_t:s0:c263,c493 tclass=fil
----
SETroubleshoot Details:
SELinux is preventing /usr/sbin/slappasswd from execmod access on the file /usr/sbin/slapadd.
***** Plugin catchall (100. confidence) suggests **************************
If you believe that slappasswd should be allowed execmod access on the slapadd file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep slappasswd /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp
Additional Information:
Source Context system_u:system_r:svirt_lxc_net_t:s0:c263,c493
Target Context system_u:object_r:svirt_sandbox_file_t:s0:c263,c49
3
Target Objects /usr/sbin/slapadd [ file ]
Source slappasswd
Source Path /usr/sbin/slappasswd
Port <Unknown>
Host localhost.localdomain
Source RPM Packages
Target RPM Packages
Policy RPM selinux-policy-3.13.1-23.el7.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name localhost.localdomain
Platform Linux localhost.localdomain
3.10.0-229.1.2.el7.x86_64 #1 SMP Fri Mar 6
17:12:08 EST 2015 x86_64 x86_64
Alert Count 2
First Seen 2015-03-26 15:50:38 EDT
Last Seen 2015-03-26 15:50:38 EDT
Local ID 339bb4ee-3f70-4d05-a167-532ba2130837
Raw Audit Messages
type=AVC msg=audit(1427399438.272:449): avc: denied { execmod } for pid=4511 comm="slapadd" path="/usr/sbin/slapadd" dev="dm-2" ino=399582 scontext=system_u:system_r:svirt_lxc_net_t:s0:c263,c493 tcontext=system_u:object_r:svirt_sandbox_file_t:s0:c263,c493 tclass=file
type=SYSCALL msg=audit(1427399438.272:449): arch=x86_64 syscall=mprotect success=no exit=EACCES a0=7fd20489e000 a1=12a000 a2=5 a3=7fd203eb9428 items=0 ppid=4461 pid=4511 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=4294967295 comm=slapadd exe=/usr/sbin/slapadd subj=system_u:system_r:svirt_lxc_net_t:s0:c263,c493 key=(null)
Hash: slappasswd,svirt_lxc_net_t,svirt_sandbox_file_t,file,execmod
----
Additional info:
This seems to have been fixed in Fedora: https://bugzilla.redhat.com/show_bug.cgi?id=1129706
Maybe back port the fix should be enough.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://rhn.redhat.com/errata/RHBA-2016-2283.html
Description of problem: When install slapd in a Debian system in a SELinux enabled docker container, SELinux prevents slappasswd from 'execmod' accesses. /var/log/audit/audit.log:type=AVC msg=audit(1427399438.232:448): avc: denied { execmod } for pid=4483 comm="slappasswd" path="/usr/sbin/slappasswd" dev="dm-2" ino=399582 scontext=system_u:system_r:svirt_lxc_net_t:s0:c263,c493 tcontext=system_u:object_r:svirt_sandbox_file_t:s0:c263,c493 tclass=fil Version-Release number of selected component (if applicable): 3.13.1-23.el7 How reproducible: sudo yum install docker sudo systemctl start docker sudo docker run --rm -t -i debian /bin/bash (Now we are on the container's shell) apt-get update && apt-get install -y slapd (You should be prompted of some questions, just randomly fill them) You should then have the SELinux error. Actual results: The container shell outputs: slappasswd: error while loading shared libraries: cannot restore segment prot after reloc: Permission denied Creating initial configuration... Loading the initial configuration from the ldif file () failed with the following error while running slapadd: slapadd: error while loading shared libraries: cannot restore segment prot after reloc: Permission denied ---- SELinux audit log: /var/log/audit/audit.log:type=AVC msg=audit(1427399438.232:448): avc: denied { execmod } for pid=4483 comm="slappasswd" path="/usr/sbin/slappasswd" dev="dm-2" ino=399582 scontext=system_u:system_r:svirt_lxc_net_t:s0:c263,c493 tcontext=system_u:object_r:svirt_sandbox_file_t:s0:c263,c493 tclass=fil ---- SETroubleshoot Details: SELinux is preventing /usr/sbin/slappasswd from execmod access on the file /usr/sbin/slapadd. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that slappasswd should be allowed execmod access on the slapadd file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep slappasswd /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:svirt_lxc_net_t:s0:c263,c493 Target Context system_u:object_r:svirt_sandbox_file_t:s0:c263,c49 3 Target Objects /usr/sbin/slapadd [ file ] Source slappasswd Source Path /usr/sbin/slappasswd Port <Unknown> Host localhost.localdomain Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-23.el7.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name localhost.localdomain Platform Linux localhost.localdomain 3.10.0-229.1.2.el7.x86_64 #1 SMP Fri Mar 6 17:12:08 EST 2015 x86_64 x86_64 Alert Count 2 First Seen 2015-03-26 15:50:38 EDT Last Seen 2015-03-26 15:50:38 EDT Local ID 339bb4ee-3f70-4d05-a167-532ba2130837 Raw Audit Messages type=AVC msg=audit(1427399438.272:449): avc: denied { execmod } for pid=4511 comm="slapadd" path="/usr/sbin/slapadd" dev="dm-2" ino=399582 scontext=system_u:system_r:svirt_lxc_net_t:s0:c263,c493 tcontext=system_u:object_r:svirt_sandbox_file_t:s0:c263,c493 tclass=file type=SYSCALL msg=audit(1427399438.272:449): arch=x86_64 syscall=mprotect success=no exit=EACCES a0=7fd20489e000 a1=12a000 a2=5 a3=7fd203eb9428 items=0 ppid=4461 pid=4511 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=4294967295 comm=slapadd exe=/usr/sbin/slapadd subj=system_u:system_r:svirt_lxc_net_t:s0:c263,c493 key=(null) Hash: slappasswd,svirt_lxc_net_t,svirt_sandbox_file_t,file,execmod ---- Additional info: This seems to have been fixed in Fedora: https://bugzilla.redhat.com/show_bug.cgi?id=1129706 Maybe back port the fix should be enough.