Hide Forgot
Description of problem: coolkey modules wants to access files in /var/cache/coolkey/ and p11_child is currently not allowed to access those files Version-Release number of selected component (if applicable): coolkey-1.1.0-33.el7 How reproducible: always Steps to Reproduce: 1. Changes to https://bugzilla.redhat.com/show_bug.cgi?id=1303214 may block IPA Smartcard login 2. 3. Actual results: Expected results: Additional info:
Please attach AVCs that you see when reproducing this scenario.
I have not yet reproduced this issue on RHEL 7 but once https://bugzilla.redhat.com/show_bug.cgi?id=1303214 is fixed we will be running into this issue. The same happened on RHEL 6.8, the AVC's on RHEl 6.8 can be found here https://bugzilla.redhat.com/show_bug.cgi?id=1299066#c7
Some of the AVCs listed in BZ#1299066 contain "success=no", which means they appeared in enforcing mode. The selinux-policy developers need to see all AVCs triggered by the scenario to fix it properly in policy. Could you switch the sssd_t type to permissive and repeat your scenario? # setenforce 1 # semanage permissive -a sssd_t (repeat your scenario) # semanage permissive -d sssd_t
AVC messages on RHEL 6.8 based on the instructions in comment 4: [root@dhcp123-129 ~]# ausearch -ts recent -m AVC time->Mon Feb 8 17:35:12 2016 type=SYSCALL msg=audit(1454970912.959:15): arch=40000003 syscall=5 success=yes exit=12 a0=8ded6d0 a1=20002 a2=180 a3=8ded6b8 items=0 ppid=1847 pid=3538 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="p11_child" exe="/usr/libexec/sssd/p11_child" subj=system_u:system_r:sssd_t:s0 key=(null) type=AVC msg=audit(1454970912.959:15): avc: denied { read write } for pid=3538 comm="p11_child" name=636F6F6C6B6579706B3131734F6D6E694B657920436172644D616E20333132312030302030302D30 dev=dm-0 ino=654671 scontext=system_u:system_r:sssd_t:s0 tcontext=unconfined_u:object_r:auth_cache_t:s0 tclass=file
Roshini, This is rhel7 bug and AVC si fixed in: [root@hp-dl380pgen8-02-vm-5 ~]# rpm -q selinux-policy selinux-policy-3.13.1-60.el7_2.3.noarch Can we close this for RHEL7?
Lukas, Can you change this bug to ON_QA status? I will verify it and close.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-2283.html