Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1243458

Summary:	Policy for command setting root/administrator account password
Product:	Red Hat Enterprise Linux 7	Reporter:	Marc-Andre Lureau <marcandre.lureau>
Component:	selinux-policy	Assignee:	Lukas Vrabec <lvrabec>
Status:	CLOSED ERRATA	QA Contact:	Milos Malik <mmalik>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.2	CC:	lvrabec, marcandre.lureau, mgrepl, mmalik, mvadkert, plautrba, pvrabec, ssekidde
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	selinux-policy-3.13.1-36.el7	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:
Clones:	1243459 (view as bug list)		Environment:
Last Closed:	2015-11-19 10:40:40 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1174176, 1243459

Description Marc-Andre Lureau 2015-07-15 13:23:40 UTC

Description of problem:

qemu-ga set password command fails with SELinux enforcing:

type=AVC msg=audit(1431952168.903:567): avc:  denied  { write } for  pid=2097 comm="chpasswd" name=".pwd.lock" dev="vda1" ino=33595649 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file permissive=0

Comment 2 Milos Malik 2015-07-15 14:02:57 UTC

Could you re-run the scenario in permissive mode and collect SELinux denials?

# ausearch -m avc -m user_avc -m selinux_err -i -ts recent

Comment 3 Marc-Andre Lureau 2015-07-15 14:10:59 UTC

I think this is it:

type=SYSCALL msg=audit(07/15/2015 10:07:40.206:404) : arch=x86_64 syscall=open success=yes exit=3 a0=0x7fcb807290dd a1=O_WRONLY|O_CREAT|O_CLOEXEC a2=0600 a3=0x1 items=0 ppid=3562 pid=3683 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=chpasswd exe=/usr/sbin/chpasswd subj=system_u:system_r:virt_qemu_ga_t:s0 key=(null) 
type=AVC msg=audit(07/15/2015 10:07:40.206:404) : avc:  denied  { write } for  pid=3683 comm=chpasswd name=.pwd.lock dev="dm-1" ino=134688785 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file 
----
type=SYSCALL msg=audit(07/15/2015 10:07:40.206:405) : arch=x86_64 syscall=open success=yes exit=4 a0=0x7fff385192b0 a1=O_WRONLY|O_CREAT|O_EXCL a2=0600 a3=0xb items=0 ppid=3562 pid=3683 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=chpasswd exe=/usr/sbin/chpasswd subj=system_u:system_r:virt_qemu_ga_t:s0 key=(null) 
type=AVC msg=audit(07/15/2015 10:07:40.206:405) : avc:  denied  { write } for  pid=3683 comm=chpasswd path=/etc/passwd.3683 dev="dm-1" ino=135973408 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file 
type=AVC msg=audit(07/15/2015 10:07:40.206:405) : avc:  denied  { create } for  pid=3683 comm=chpasswd name=passwd.3683 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file 
type=AVC msg=audit(07/15/2015 10:07:40.206:405) : avc:  denied  { add_name } for  pid=3683 comm=chpasswd name=passwd.3683 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir 
type=AVC msg=audit(07/15/2015 10:07:40.206:405) : avc:  denied  { write } for  pid=3683 comm=chpasswd name=etc dev="dm-1" ino=134320257 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir 
----
type=SYSCALL msg=audit(07/15/2015 10:07:40.207:406) : arch=x86_64 syscall=link success=yes exit=0 a0=0x7fff385192b0 a1=0x7fff385196b0 a2=0x5 a3=0x0 items=0 ppid=3562 pid=3683 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=chpasswd exe=/usr/sbin/chpasswd subj=system_u:system_r:virt_qemu_ga_t:s0 key=(null) 
type=AVC msg=audit(07/15/2015 10:07:40.207:406) : avc:  denied  { link } for  pid=3683 comm=chpasswd name=passwd.3683 dev="dm-1" ino=135973408 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file 
----
type=SYSCALL msg=audit(07/15/2015 10:07:40.207:407) : arch=x86_64 syscall=unlink success=yes exit=0 a0=0x7fff385192b0 a1=0x7fff385191c0 a2=0x1 a3=0x0 items=0 ppid=3562 pid=3683 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=chpasswd exe=/usr/sbin/chpasswd subj=system_u:system_r:virt_qemu_ga_t:s0 key=(null) 
type=AVC msg=audit(07/15/2015 10:07:40.207:407) : avc:  denied  { unlink } for  pid=3683 comm=chpasswd name=passwd.3683 dev="dm-1" ino=135973408 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file 
type=AVC msg=audit(07/15/2015 10:07:40.207:407) : avc:  denied  { remove_name } for  pid=3683 comm=chpasswd name=passwd.3683 dev="dm-1" ino=135973408 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir 
----
type=SYSCALL msg=audit(07/15/2015 10:07:40.207:408) : arch=x86_64 syscall=open success=yes exit=6 a0=0x7fcb811f8a00 a1=O_RDWR|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW a2=0x0 a3=0x0 items=0 ppid=3562 pid=3683 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=chpasswd exe=/usr/sbin/chpasswd subj=system_u:system_r:virt_qemu_ga_t:s0 key=(null) 
type=AVC msg=audit(07/15/2015 10:07:40.207:408) : avc:  denied  { open } for  pid=3683 comm=chpasswd path=/etc/shadow dev="dm-1" ino=136675055 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file 
type=AVC msg=audit(07/15/2015 10:07:40.207:408) : avc:  denied  { read write } for  pid=3683 comm=chpasswd name=shadow dev="dm-1" ino=136675055 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file 
type=AVC msg=audit(07/15/2015 10:07:40.207:408) : avc:  denied  { dac_override } for  pid=3683 comm=chpasswd capability=dac_override  scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:system_r:virt_qemu_ga_t:s0 tclass=capability 
----
type=SYSCALL msg=audit(07/15/2015 10:07:40.207:409) : arch=x86_64 syscall=fstat success=yes exit=0 a0=0x6 a1=0x7fff38519950 a2=0x7fff38519950 a3=0x0 items=0 ppid=3562 pid=3683 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=chpasswd exe=/usr/sbin/chpasswd subj=system_u:system_r:virt_qemu_ga_t:s0 key=(null) 
type=AVC msg=audit(07/15/2015 10:07:40.207:409) : avc:  denied  { getattr } for  pid=3683 comm=chpasswd path=/etc/shadow dev="dm-1" ino=136675055 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file 
----
type=SYSCALL msg=audit(07/15/2015 10:07:40.225:410) : arch=x86_64 syscall=fchown success=yes exit=0 a0=0x7 a1=0x0 a2=0x0 a3=0x1 items=0 ppid=3562 pid=3683 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=chpasswd exe=/usr/sbin/chpasswd subj=system_u:system_r:virt_qemu_ga_t:s0 key=(null) 
type=AVC msg=audit(07/15/2015 10:07:40.225:410) : avc:  denied  { setattr } for  pid=3683 comm=chpasswd name=shadow- dev="dm-1" ino=134934467 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file 
----
type=SYSCALL msg=audit(07/15/2015 10:07:40.259:411) : arch=x86_64 syscall=open success=yes exit=6 a0=0x7fff385196d0 a1=O_WRONLY|O_CREAT|O_TRUNC a2=0666 a3=0x6165726373662f72 items=0 ppid=3562 pid=3683 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=chpasswd exe=/usr/sbin/chpasswd subj=system_u:system_r:virt_qemu_ga_t:s0 key=(null) 
type=AVC msg=audit(07/15/2015 10:07:40.259:411) : avc:  denied  { create } for  pid=3683 comm=chpasswd name=shadow+ scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file 
----
type=SYSCALL msg=audit(07/15/2015 10:07:40.277:412) : arch=x86_64 syscall=rename success=yes exit=0 a0=0x7fff385196d0 a1=0x7fcb811f8a00 a2=0x7fff38519640 a3=0x0 items=0 ppid=3562 pid=3683 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=chpasswd exe=/usr/sbin/chpasswd subj=system_u:system_r:virt_qemu_ga_t:s0 key=(null) 
type=AVC msg=audit(07/15/2015 10:07:40.277:412) : avc:  denied  { unlink } for  pid=3683 comm=chpasswd name=shadow dev="dm-1" ino=136675055 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file 
type=AVC msg=audit(07/15/2015 10:07:40.277:412) : avc:  denied  { rename } for  pid=3683 comm=chpasswd name=shadow+ dev="dm-1" ino=135973410 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file

Comment 5 Miroslav Grepl 2015-07-29 07:34:01 UTC

Lukas,
could you check it?

It looks we need to add labeling for chpasswd and allow virt_qemu_ga_t to have a transition to passwd_t.

Comment 6 Miroslav Grepl 2015-07-29 07:44:12 UTC

Marc-Andre,
could you re-test it with

# cat mypol.te
policy_module(mypol,1.0)

require{
 type virt_qemu_ga_t;
}

usermanage_domtrans_passwd(virt_qemu_ga_t)


and run

# yum install selinux-policy-devel
# make -f /usr/share/selinux/devel/Makefile mypol.pp
# semodule -i mypol.pp
# chcon -t passwd_exec_t /usr/sbin/chpasswd

and re-test it? Thank you.

Comment 7 Marc-Andre Lureau 2015-07-29 09:29:49 UTC

(In reply to Miroslav Grepl from comment #6)
> Marc-Andre,
> could you re-test it with
...
> and re-test it? Thank you.

It works!

Comment 8 Lukas Vrabec 2015-07-29 09:58:29 UTC

commit 21687562873180d347ff6a29e727e1e7d86437b7
Author: Lukas Vrabec <lvrabec>
Date:   Wed Jul 29 11:52:14 2015 +0200

    Label /usr/sbin/chpasswd as passwd_exec_t.

commit cd857dfac06f08ac5e82b155c137e08f4a437b30
Author: Lukas Vrabec <lvrabec>
Date:   Wed Jul 29 11:54:26 2015 +0200

    Allow virt_qemu_ga_t domtrans to passwd_t.

Comment 9 Miroslav Grepl 2015-07-29 10:48:31 UTC

Great. Thank you for testing.

Comment 13 Miroslav Vadkerti 2015-10-05 14:46:34 UTC

Moving back to correct state

Comment 15 errata-xmlrpc 2015-11-19 10:40:40 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2300.html