Bug 1251526 - ipa-client/server-install should not execute daemons directly
ipa-client/server-install should not execute daemons directly
Status: ASSIGNED
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa (Show other bugs)
7.1
All Linux
medium Severity medium
: rc
: ---
Assigned To: IPA Maintainers
Namita Soman
:
Depends On:
Blocks: 1251212
  Show dependency treegraph
 
Reported: 2015-08-07 11:05 EDT by Jiri Jaburek
Modified: 2017-09-25 06:18 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jiri Jaburek 2015-08-07 11:05:17 EDT
Description of problem:

The ipa-client-install seems to execute at least ntpd and sshd directly - in the case of ntpd, it's on a custom config file in /tmp, in case of sshd, it's to check "dynamically loading authorized user keys" support.

This causes various issues with selinux - not only it doesn't work under the MLS policy (sysadm_r role), it has a potential to break things in the targeted policy as well - ie. by creating pid/lock/log files as unconfined_t.

The only supported (AFAIK) way to run daemons is via sysvinit / systemd where the daemon is executed with correct context according to appropriate selinux transition rules. Anything else (even a simple daemon --help) can cause issues.

Therefore please modify the ipa-*-install scripts to only interact with services/daemons using service(8) or systemctl(1).

Example alternatives covering the use cases currently used by ipa-client-install:

- ntpd: modify /etc/ntpd.conf directly, if you need to do only one-time synchronization, use ntpdate, if you need to just check if a NTP server is working, use 'ntpdate -q'

- sshd: modify /etc/ssh/ssh(d)_config directly, restart sshd and see if it fails on missing support - the live ssh sessions won't be killed on sshd restart

I've also noticed ipa-client-install has 'services' and 'services.knownservices' classes - these also need to use service(8)/systemctl(1) if they aren't using it already.


Version-Release number of selected component (if applicable):
ipa-client-4.1.0-18.el7

How reproducible:
always

Steps to Reproduce:
1. switch the system to selinux-policy-mls (see RH knowledgebase, RHEL7 / "SELinux User's and Administrator's Guide", section 4.11.2)
2. semodule -d sysadm_secadm
3. login under the sysadm_r role
4. try ipa-client-install

Actual results:
ipa-*-install executes services/daemons directly

Expected results:
ipa-*-install uses service(8) or systemctl(1) to launch daemons

Additional info:
Upgrading to ipa-4.2.0-3.el7 still shows the same issue.
Comment 1 Petr Vobornik 2015-08-11 10:34:24 EDT
Upstream ticket:
https://fedorahosted.org/freeipa/ticket/5203
Comment 2 Petr Vobornik 2017-04-06 12:21:14 EDT
IdM team doesn't have capacity to fix this bug for RHEL 7.4. Moving to next RHEL version. Fixing the bug there will depend on capacity of FreeIPA upstream. Without sufficient  justification there is a chance that it will be moved again later.

Note You need to log in before you can comment on or make changes to this bug.