Bug 1311294 - nsd-keygen can't start with selinux enabled
nsd-keygen can't start with selinux enabled
Status: CLOSED EOL
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
23
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Lukas Vrabec
Fedora Extras Quality Assurance
:
Depends On: 1293140
Blocks:
  Show dependency treegraph
 
Reported: 2016-02-23 15:28 EST by Ed Marshall
Modified: 2016-12-20 13:58 EST (History)
10 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-12-20 13:58:47 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Ed Marshall 2016-02-23 15:28:35 EST
Description of problem:
nsd-keygen.service won't start on a fresh install with selinux enabled (and looking at the permissions involved, it might not be able to start even with selinux disabled).

Version-Release number of selected component (if applicable):
4.1.7-4

How reproducible:
Every time

Steps to Reproduce:
1. dnf install nsd
2. systemctl start nsd-keygen.service
3. startup fails

Actual results:

# dnf install nsd
Last metadata expiration check performed 2:28:43 ago on Tue Feb 23 17:45:03 2016.
Dependencies resolved.
========================================================
 Package    Arch      Version         Repository   Size
========================================================
Installing:
 nsd        x86_64    4.1.7-4.fc23    updates     845 k

Transaction Summary
========================================================
Install  1 Package

Total download size: 845 k
Installed size: 2.5 M
Is this ok [y/N]: y
Downloading Packages:
nsd-4.1.7-4.fc23.x86_64.rpm 619 kB/s | 845 kB     00:01
--------------------------------------------------------
Total                       150 kB/s | 845 kB     00:05
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Installing  : nsd-4.1.7-4.fc23.x86_64              1/1
  Verifying   : nsd-4.1.7-4.fc23.x86_64              1/1

Installed:
  nsd.x86_64 4.1.7-4.fc23

Complete!
# id nsd
uid=497(nsd) gid=497(nsd) groups=497(nsd)
# systemctl start nsd-keygen.service
Job for nsd-keygen.service failed because the control process exited with error code. See "systemctl status nsd-keygen.service" and "journalctl -xe" for details.
# systemctl status nsd-keygen.service -l
● nsd-keygen.service - NSD Control Key And Certificate Generator
   Loaded: loaded (/usr/lib/systemd/system/nsd-keygen.service; disabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Tue 2016-02-23 20:14:29 UTC; 6s ago
  Process: 5627 ExecStart=/usr/sbin/nsd-control-setup -d /etc/nsd/ (code=exited, status=1/FAILURE)
 Main PID: 5627 (code=exited, status=1/FAILURE)

Feb 23 20:14:29 hostname nsd-control-setup[5627]: setup in directory /etc/nsd/
Feb 23 20:14:29 hostname nsd-control-setup[5627]: generating nsd_server.key
Feb 23 20:14:29 hostname nsd-control-setup[5627]: nsd_server.key: Permission denied
Feb 23 20:14:29 hostname nsd-control-setup[5627]: 140409816348536:error:0200100D:system library:fopen:Permission denied:bss_file.c:398:fopen('nsd_server.key','w')
Feb 23 20:14:29 hostname nsd-control-setup[5627]: 140409816348536:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:400:
Feb 23 20:14:29 hostname nsd-control-setup[5627]: /usr/sbin/nsd-control-setup fatal error: could not genrsa
Feb 23 20:14:29 hostname systemd[1]: nsd-keygen.service: Main process exited, code=exited, status=1/FAILURE
Feb 23 20:14:29 hostname systemd[1]: Failed to start NSD Control Key And Certificate Generator.
Feb 23 20:14:29 hostname systemd[1]: nsd-keygen.service: Unit entered failed state.
Feb 23 20:14:29 hostname systemd[1]: nsd-keygen.service: Failed with result 'exit-code'.

Additional journal entries (note the AVC denial):

Feb 23 20:14:29 hostname systemd[1]: Starting NSD Control Key And Certificate Generator...
Feb 23 20:14:29 hostname nsd-control-setup[5627]: setup in directory /etc/nsd/
Feb 23 20:14:29 hostname nsd-control-setup[5627]: generating nsd_server.key
Feb 23 20:14:29 hostname audit[5628]: AVC avc:  denied  { write } for  pid=5628 comm="openssl" name="nsd" dev="vda1" ino=133622 scontext=system_u:system_r:nsd_t:s0 tcontext=system_u:object_r:nsd_conf_t:s0 tclass=dir permissive=0
Feb 23 20:14:29 hostname nsd-control-setup[5627]: nsd_server.key: Permission denied
Feb 23 20:14:29 hostname nsd-control-setup[5627]: 140409816348536:error:0200100D:system library:fopen:Permission denied:bss_file.c:398:fopen('nsd_server.key','w')
Feb 23 20:14:29 hostname nsd-control-setup[5627]: 140409816348536:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:400:
Feb 23 20:14:29 hostname nsd-control-setup[5627]: /usr/sbin/nsd-control-setup fatal error: could not genrsa
Feb 23 20:14:29 hostname systemd[1]: nsd-keygen.service: Main process exited, code=exited, status=1/FAILURE
Feb 23 20:14:29 hostname systemd[1]: Failed to start NSD Control Key And Certificate Generator.
Feb 23 20:14:29 hostname systemd[1]: nsd-keygen.service: Unit entered failed state.

Expected results:
nsd-control-setup generates keys appropriately and exits successfully.

Additional info:
There are additional problems starting nsd once key generation has completed successfully, but I'll put those in a separate bug.
Comment 1 d. johnson 2016-02-23 20:25:29 EST
/usr/sbin/nsd-control-setup should likely be run before the daemon starts up.

Your AVC above is trying to "allow nsd_t nsd_conf_t:dir write;" but in general, the daemon should likely not be writing to the directory.

From the docs, you would "After running the script as root, turn on control-enable in nsd.conf." ref/ http://www.nlnetlabs.nl/projects/nsd/nsd-control.8.html
Comment 2 Fedora End Of Life 2016-11-24 10:43:58 EST
This message is a reminder that Fedora 23 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 23. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as EOL if it remains open with a Fedora  'version'
of '23'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora 23 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.
Comment 3 Fedora End Of Life 2016-12-20 13:58:47 EST
Fedora 23 changed to end-of-life (EOL) status on 2016-12-20. Fedora 23 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.

Note You need to log in before you can comment on or make changes to this bug.