Red Hat Bugzilla – Bug 1251526
ipa-client/server-install should not execute daemons directly
Last modified: 2018-06-19 09:29:02 EDT
Description of problem:
The ipa-client-install seems to execute at least ntpd and sshd directly - in the case of ntpd, it's on a custom config file in /tmp, in case of sshd, it's to check "dynamically loading authorized user keys" support.
This causes various issues with selinux - not only it doesn't work under the MLS policy (sysadm_r role), it has a potential to break things in the targeted policy as well - ie. by creating pid/lock/log files as unconfined_t.
The only supported (AFAIK) way to run daemons is via sysvinit / systemd where the daemon is executed with correct context according to appropriate selinux transition rules. Anything else (even a simple daemon --help) can cause issues.
Therefore please modify the ipa-*-install scripts to only interact with services/daemons using service(8) or systemctl(1).
Example alternatives covering the use cases currently used by ipa-client-install:
- ntpd: modify /etc/ntpd.conf directly, if you need to do only one-time synchronization, use ntpdate, if you need to just check if a NTP server is working, use 'ntpdate -q'
- sshd: modify /etc/ssh/ssh(d)_config directly, restart sshd and see if it fails on missing support - the live ssh sessions won't be killed on sshd restart
I've also noticed ipa-client-install has 'services' and 'services.knownservices' classes - these also need to use service(8)/systemctl(1) if they aren't using it already.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. switch the system to selinux-policy-mls (see RH knowledgebase, RHEL7 / "SELinux User's and Administrator's Guide", section 4.11.2)
2. semodule -d sysadm_secadm
3. login under the sysadm_r role
4. try ipa-client-install
ipa-*-install executes services/daemons directly
ipa-*-install uses service(8) or systemctl(1) to launch daemons
Upgrading to ipa-4.2.0-3.el7 still shows the same issue.
IdM team doesn't have capacity to fix this bug for RHEL 7.4. Moving to next RHEL version. Fixing the bug there will depend on capacity of FreeIPA upstream. Without sufficient justification there is a chance that it will be moved again later.