Bug 1303709 - coolkey modules wants to access files in /var/cache/coolkey/ and p11_child is currently not allowed to access those files
Summary: coolkey modules wants to access files in /var/cache/coolkey/ and p11_child is...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.2
Hardware: All
OS: Linux
high
high
Target Milestone: rc
: ---
Assignee: Lukas Vrabec
QA Contact: Eva Mrakova
URL:
Whiteboard:
Depends On: 1303214
Blocks: 1330983
TreeView+ depends on / blocked
 
Reported: 2016-02-01 17:42 UTC by Roshni
Modified: 2016-11-04 02:41 UTC (History)
9 users (show)

Fixed In Version: selinux-policy-3.13.1-60.el7_2.3
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 1330983 (view as bug list)
Environment:
Last Closed: 2016-11-04 02:41:38 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2016:2283 0 normal SHIPPED_LIVE selinux-policy bug fix and enhancement update 2016-11-03 13:36:25 UTC

Description Roshni 2016-02-01 17:42:47 UTC
Description of problem:
coolkey modules wants to access files in /var/cache/coolkey/ and p11_child is currently not allowed to access those files

Version-Release number of selected component (if applicable):
coolkey-1.1.0-33.el7

How reproducible:
always

Steps to Reproduce:
1. Changes to https://bugzilla.redhat.com/show_bug.cgi?id=1303214 may block IPA Smartcard login
2.
3.

Actual results:


Expected results:


Additional info:

Comment 2 Milos Malik 2016-02-02 06:53:32 UTC
Please attach AVCs that you see when reproducing this scenario.

Comment 3 Roshni 2016-02-05 15:18:26 UTC
I have not yet reproduced this issue on RHEL 7 but once https://bugzilla.redhat.com/show_bug.cgi?id=1303214 is fixed we will be running into this issue. The same happened on RHEL 6.8, the AVC's on RHEl 6.8 can be found here https://bugzilla.redhat.com/show_bug.cgi?id=1299066#c7

Comment 4 Milos Malik 2016-02-05 16:00:00 UTC
Some of the AVCs listed in BZ#1299066 contain "success=no", which means they appeared in enforcing mode. The selinux-policy developers need to see all AVCs triggered by the scenario to fix it properly in policy. Could you switch the sssd_t type to permissive and repeat your scenario?

# setenforce 1
# semanage permissive -a sssd_t
(repeat your scenario)
# semanage permissive -d sssd_t

Comment 5 Roshni 2016-02-08 22:39:42 UTC
AVC messages on RHEL 6.8 based on the instructions in comment 4: 

[root@dhcp123-129 ~]# ausearch -ts recent -m AVC
time->Mon Feb  8 17:35:12 2016
type=SYSCALL msg=audit(1454970912.959:15): arch=40000003 syscall=5 success=yes exit=12 a0=8ded6d0 a1=20002 a2=180 a3=8ded6b8 items=0 ppid=1847 pid=3538 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="p11_child" exe="/usr/libexec/sssd/p11_child" subj=system_u:system_r:sssd_t:s0 key=(null)
type=AVC msg=audit(1454970912.959:15): avc:  denied  { read write } for  pid=3538 comm="p11_child" name=636F6F6C6B6579706B3131734F6D6E694B657920436172644D616E20333132312030302030302D30 dev=dm-0 ino=654671 scontext=system_u:system_r:sssd_t:s0 tcontext=unconfined_u:object_r:auth_cache_t:s0 tclass=file

Comment 6 Lukas Vrabec 2016-05-04 14:49:37 UTC
Roshini, 

This is rhel7 bug and AVC si fixed in:
[root@hp-dl380pgen8-02-vm-5 ~]# rpm -q selinux-policy 
selinux-policy-3.13.1-60.el7_2.3.noarch

Can we close this for RHEL7?

Comment 7 Roshni 2016-05-23 15:21:44 UTC
Lukas,

Can you change this bug to ON_QA status? I will verify it and close.

Comment 11 errata-xmlrpc 2016-11-04 02:41:38 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2283.html


Note You need to log in before you can comment on or make changes to this bug.