Bug 1413509
| Summary: | Failed to login the remote host on cockpit login page. | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Wei Wang <weiwang> | ||||||||||||
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> | ||||||||||||
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> | ||||||||||||
| Severity: | high | Docs Contact: | |||||||||||||
| Priority: | unspecified | ||||||||||||||
| Version: | 7.4 | CC: | bugs, cshao, dperpeet, huzhao, leiwang, lvrabec, mgrepl, mmalik, plautrba, pvolpe, pvrabec, qiyuan, rbarry, ssekidde, weiwang, yaniwang, ycui | ||||||||||||
| Target Milestone: | alpha | Keywords: | Extras, Regression | ||||||||||||
| Target Release: | 7.4 | ||||||||||||||
| Hardware: | All | ||||||||||||||
| OS: | Linux | ||||||||||||||
| Whiteboard: | |||||||||||||||
| Fixed In Version: | selinux-policy-3.13.1-142.el7 | Doc Type: | If docs needed, set a value | ||||||||||||
| Doc Text: | Story Points: | --- | |||||||||||||
| Clone Of: | Environment: | ||||||||||||||
| Last Closed: | 2017-08-01 15:20:12 UTC | Type: | Bug | ||||||||||||
| Regression: | --- | Mount Type: | --- | ||||||||||||
| Documentation: | --- | CRM: | |||||||||||||
| Verified Versions: | Category: | --- | |||||||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||||||
| Embargoed: | |||||||||||||||
| Attachments: |
|
||||||||||||||
Created attachment 1241154 [details]
picture for login page
Created attachment 1241155 [details]
picture for dashboard
This bug doesn't occur with redhat-virtualization-host-4.1-20170104.0, it is a regression bug. Looks like a selinux issue:
type=AVC msg=audit(1484554225.187:549): avc: denied { execute } for pid=22870 comm="cockpit-ws" name="cockpit-ssh" dev="dm-3" ino=13376792 scontext=system_u:system_r:cockpit_ws_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file
type=AVC msg=audit(1484554292.663:552): avc: denied { execute } for pid=22881 comm="cockpit-ws" name="cockpit-ssh" dev="dm-3" ino=13376792 scontext=system_u:system_r:cockpit_ws_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file
type=AVC msg=audit(1484554814.523:564): avc: denied { execute } for pid=22915 comm="cockpit-ws" name="cockpit-ssh" dev="dm-3" ino=13376792 scontext=system_u:system_r:cockpit_ws_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file
type=AVC msg=audit(1484555170.282:569): avc: denied { execute } for pid=22941 comm="cockpit-ws" name="cockpit-ssh" dev="dm-3" ino=13376792 scontext=system_u:system_r:cockpit_ws_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file
type=AVC msg=audit(1484555322.157:572): avc: denied { execute } for pid=22960 comm="cockpit-ws" name="cockpit-ssh" dev="dm-3" ino=13376792 scontext=system_u:system_r:cockpit_ws_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file
Please provide version and release of selinux-policy* packages: # rpm -qa selinux-policy\* (In reply to Milos Malik from comment #5) > Please provide version and release of selinux-policy* packages: > > # rpm -qa selinux-policy\* # rpm -qa selinux-policy\* selinux-policy-3.13.1-102.el7_3.7.noarch selinux-policy-targeted-3.13.1-102.el7_3.7.noarch Peter, Where is "cockpit-ssh" stored? Thanks. /usr/libexec Hi, Could you label cockpit-ssh as cockpit_session_exec_t: # semanage fcontext -a -t cockpit_session_exec_t /usr/libexec/cockpit-ssh # restorecon -v /usr/libexec/cockpit-ssh And then try to reproduce your issue. THanks. Test Version:
redhat-virtualization-host-4.1-0.20170112.0
cockpit-ovirt-dashboard-0.10.7-0.0.3.el7ev.noarch
cockpit-ws-126-1.el7.x86_64
imgbased-0.9.4-0.1.el7ev.noarch
Steps to Reproduce:
1. Two machines(A and B) are installed with RHVH 4.1
2. Create cockpit.conf on host A: vi /etc/cockpit/cockpit.conf
[SSH-Login]
host = <B IP>
allowUnknown = true
3. Label cockpit-ssh as cockpit_session_exec_t
# semanage fcontext -a -t cockpit_session_exec_t /usr/libexec/cockpit-ssh
# restorecon -v /usr/libexec/cockpit-ssh
4. Start cockpit service
5. Input username or password and "other options" with host B's IP in host A cockpit UI
6. Click "Log In" and check
Another error displays as "Unable to connect to that address".
Created attachment 1260287 [details]
log files
Created attachment 1260288 [details]
picture
The /var/log/audit/audit.log file, which is part of the log files attachment, contains following SELinux denial:
type=AVC msg=audit(1488784111.418:186): avc: denied { name_connect } for pid=20965 comm="cockpit-ssh" dest=22 scontext=system_u:system_r:cockpit_session_t:s0 tcontext=system_u:object_r:ssh_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1488784111.418:186): arch=c000003e syscall=42 success=no exit=-13 a0=6 a1=7f619597ff90 a2=10 a3=5 items=0 ppid=20962 pid=20965 auid=4294967295 uid=995 gid=992 euid=995 suid=995 fsuid=995 egid=992 sgid=992 fsgid=992 tty=(none) ses=4294967295 comm="cockpit-ssh" exe="/usr/libexec/cockpit-ssh" subj=system_u:system_r:cockpit_session_t:s0 key=(null)
type=AVC msg=audit(1488784119.233:187): avc: denied { name_connect } for pid=20966 comm="cockpit-ssh" dest=22 scontext=system_u:system_r:cockpit_session_t:s0 tcontext=system_u:object_r:ssh_port_t:s0 tclass=tcp_socket
but appropriate allow rule is dependent on the nis_enabled boolean:
# rpm -qa selinux-policy\*
selinux-policy-minimum-3.13.1-141.el7.noarch
selinux-policy-devel-3.13.1-140.el7.noarch
selinux-policy-mls-3.13.1-141.el7.noarch
selinux-policy-targeted-3.13.1-141.el7.noarch
selinux-policy-3.13.1-141.el7.noarch
# sesearch -s cockpit_session_t -t ssh_port_t -c tcp_socket -p name_connect -A -C
Found 2 semantic av rules:
DT allow cockpit_session_t reserved_port_type : tcp_socket name_connect ; [ nis_enabled ]
DT allow nsswitch_domain reserved_port_type : tcp_socket name_connect ; [ nis_enabled ]
#
This scenario has nothing to do with NIS/YP, therefore we need an unconditional allow rule.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:1861 |
Created attachment 1241153 [details] log files Description of problem: Login to the remote host is failed via cockpit login page. Version-Release number of selected component (if applicable): redhat-virtualization-host-4.1-0.20170112.0 cockpit-ovirt-dashboard-0.10.7-0.0.3.el7ev.noarch cockpit-ws-126-1.el7.x86_64 imgbased-0.9.4-0.1.el7ev.noarch How reproducible: 100% Steps to Reproduce: 1. Two machines(A and B) are installed with RHVH 4.1 2. Create cockpit.conf on host A: vi /etc/cockpit/cockpit.conf [SSH-Login] host = <B IP> allowUnknown = true 3. Start cockpit-ws 4. Input username or password and "other options" with host B's IP in host A cockpit UI 5. Click "Log In" and check Actual results: Login to the remote host is failed, "Internal error in login process" is displayed. Expected results: Login to the remote host is successful. Additional info: Add the remote host to dashboard also failed after login cockpit.