Bug 1419957 - selinux prevents iptables.init from reading modprobe.d directory
Summary: selinux prevents iptables.init from reading modprobe.d directory
Keywords:
Status: CLOSED DUPLICATE of bug 1418391
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.3
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: rc
: ---
Assignee: Lukas Vrabec
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-02-07 13:50 UTC by Zdenek Pytela
Modified: 2020-04-15 15:14 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-02-08 14:38:38 UTC
Target Upstream Version:

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Comment 1 Zdenek Pytela 2017-02-07 14:05:05 UTC 
Description of problem:
SELinux policy prevents legacy commands iptables.init and ip6tables.init from accessing /etc/modprobe.d directory.

Version-Release number of selected component (if applicable):
selinux-policy-3.13.1-102.el7_3.13.noarch
iptables-services-1.4.21-17.el7.x86_64


How reproducible:
always


Steps to Reproduce:
1. systemctl start ip6tables
2. systemctl status ip6tables
3. ausearch -i -ts recent

Actual results:
----
type=SYSCALL msg=audit(02/07/17 14:55:51.092:2378) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=0xffffffffffffff9c a1=0x1b76e50 a2=O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC a3=0x0 items=0 ppid=1 pid=9434 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=ip6tables.init exe=/usr/bin/bash subj=system_u:system_r:iptables_t:s0 key=(null)
type=AVC msg=audit(02/07/17 14:55:51.092:2378) : avc:  denied  { read } for  pid=9434 comm=ip6tables.init name=modprobe.d dev="dm-0" ino=512041 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:modules_conf_t:s0 tclass=dir
----


Expected results:
<no avc>

Additional info:
seems similar to #1373220
Comment 2 Milos Malik 2017-02-07 15:00:40 UTC 
Already seen in https://bugzilla.redhat.com/show_bug.cgi?id=1367520#c8.
Comment 3 Lukas Vrabec 2017-02-08 14:38:38 UTC 

*** This bug has been marked as a duplicate of bug 1418391 ***
Note You need to log in before you can comment on or make changes to this bug.