Bug 1303709 - coolkey modules wants to access files in /var/cache/coolkey/ and p11_child is currently not allowed to access those files
coolkey modules wants to access files in /var/cache/coolkey/ and p11_child is...
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy (Show other bugs)
7.2
All Linux
high Severity high
: rc
: ---
Assigned To: Lukas Vrabec
Eva Mrakova
:
Depends On: 1303214
Blocks: 1330983
  Show dependency treegraph
 
Reported: 2016-02-01 12:42 EST by Roshni
Modified: 2016-11-03 22:41 EDT (History)
9 users (show)

See Also:
Fixed In Version: selinux-policy-3.13.1-60.el7_2.3
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 1330983 (view as bug list)
Environment:
Last Closed: 2016-11-03 22:41:38 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2016:2283 normal SHIPPED_LIVE selinux-policy bug fix and enhancement update 2016-11-03 09:36:25 EDT

  None (edit)
Description Roshni 2016-02-01 12:42:47 EST
Description of problem:
coolkey modules wants to access files in /var/cache/coolkey/ and p11_child is currently not allowed to access those files

Version-Release number of selected component (if applicable):
coolkey-1.1.0-33.el7

How reproducible:
always

Steps to Reproduce:
1. Changes to https://bugzilla.redhat.com/show_bug.cgi?id=1303214 may block IPA Smartcard login
2.
3.

Actual results:


Expected results:


Additional info:
Comment 2 Milos Malik 2016-02-02 01:53:32 EST
Please attach AVCs that you see when reproducing this scenario.
Comment 3 Roshni 2016-02-05 10:18:26 EST
I have not yet reproduced this issue on RHEL 7 but once https://bugzilla.redhat.com/show_bug.cgi?id=1303214 is fixed we will be running into this issue. The same happened on RHEL 6.8, the AVC's on RHEl 6.8 can be found here https://bugzilla.redhat.com/show_bug.cgi?id=1299066#c7
Comment 4 Milos Malik 2016-02-05 11:00:00 EST
Some of the AVCs listed in BZ#1299066 contain "success=no", which means they appeared in enforcing mode. The selinux-policy developers need to see all AVCs triggered by the scenario to fix it properly in policy. Could you switch the sssd_t type to permissive and repeat your scenario?

# setenforce 1
# semanage permissive -a sssd_t
(repeat your scenario)
# semanage permissive -d sssd_t
Comment 5 Roshni 2016-02-08 17:39:42 EST
AVC messages on RHEL 6.8 based on the instructions in comment 4: 

[root@dhcp123-129 ~]# ausearch -ts recent -m AVC
time->Mon Feb  8 17:35:12 2016
type=SYSCALL msg=audit(1454970912.959:15): arch=40000003 syscall=5 success=yes exit=12 a0=8ded6d0 a1=20002 a2=180 a3=8ded6b8 items=0 ppid=1847 pid=3538 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="p11_child" exe="/usr/libexec/sssd/p11_child" subj=system_u:system_r:sssd_t:s0 key=(null)
type=AVC msg=audit(1454970912.959:15): avc:  denied  { read write } for  pid=3538 comm="p11_child" name=636F6F6C6B6579706B3131734F6D6E694B657920436172644D616E20333132312030302030302D30 dev=dm-0 ino=654671 scontext=system_u:system_r:sssd_t:s0 tcontext=unconfined_u:object_r:auth_cache_t:s0 tclass=file
Comment 6 Lukas Vrabec 2016-05-04 10:49:37 EDT
Roshini, 

This is rhel7 bug and AVC si fixed in:
[root@hp-dl380pgen8-02-vm-5 ~]# rpm -q selinux-policy 
selinux-policy-3.13.1-60.el7_2.3.noarch

Can we close this for RHEL7?
Comment 7 Roshni 2016-05-23 11:21:44 EDT
Lukas,

Can you change this bug to ON_QA status? I will verify it and close.
Comment 11 errata-xmlrpc 2016-11-03 22:41:38 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2283.html

Note You need to log in before you can comment on or make changes to this bug.