Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
It appears that on a fresh IPA install, there may be issues with SELinux and/or permissions set for /var/lib/ipa/gssproxy/http.keytab.
With SELinux in enforcing mode, we see ipa commands fail and AVC denials.
[root@rhel7-2 audit]# ipa user-find
ipa: ERROR: No valid Negotiate header in server response
[root@rhel7-2 audit]# cat audit.log|audit2allow
#============= gssproxy_t ==============
allow gssproxy_t self:capability { dac_override dac_read_search };
With some digging, we see the following failure in /var/log/messages from when gssproxy started:
Apr 11 15:00:57 rhel7-2 gssproxy: gssproxy[6803]: (OID: { 1 2 840 113554 1 2 2 }) Unspecified GSS failure. Minor code may provide more information, Keytab FILE:/var/lib/ipa/gssproxy/http.keytab is nonexistent or empty
Looking at the directory and file:
[root@rhel7-2 ~]# ls -ldZ /var/lib/ipa/gssproxy
drwx------. root root system_u:object_r:ipa_var_lib_t:s0 /var/lib/ipa/gssproxy
[root@rhel7-2 ~]# ls -ldZ /var/lib/ipa/gssproxy/http.keytab
-rw-------. apache apache unconfined_u:object_r:ipa_var_lib_t:s0 /var/lib/ipa/gssproxy/http.keytab
Version-Release number of selected component (if applicable):
ipa-server-4.5.0-5.el7.x86_64
gssproxy-0.7.0-3.el7.x86_64
How reproducible:
always if gssproxy is started when SELinux in enforcing mode.
Steps to Reproduce:
1. ipa-server-install*
2. setenforce 1
3. ipactl restart
4. ipa user-find
*note that due to some other unrelated AVC work still being finished, this had to be run with in permissive mode.
Actual results:
Throws errors and AVCs
Expected results:
No errors or AVCs
Additional info:
Maybe because gssproxy in enforcing mode failed to access keytab, it probably tried another method and caused a new AVC that I haven't been able to get in permissive mode.
Description of problem: It appears that on a fresh IPA install, there may be issues with SELinux and/or permissions set for /var/lib/ipa/gssproxy/http.keytab. With SELinux in enforcing mode, we see ipa commands fail and AVC denials. [root@rhel7-2 audit]# ipa user-find ipa: ERROR: No valid Negotiate header in server response [root@rhel7-2 audit]# cat audit.log|audit2allow #============= gssproxy_t ============== allow gssproxy_t self:capability { dac_override dac_read_search }; With some digging, we see the following failure in /var/log/messages from when gssproxy started: Apr 11 15:00:57 rhel7-2 gssproxy: gssproxy[6803]: (OID: { 1 2 840 113554 1 2 2 }) Unspecified GSS failure. Minor code may provide more information, Keytab FILE:/var/lib/ipa/gssproxy/http.keytab is nonexistent or empty Looking at the directory and file: [root@rhel7-2 ~]# ls -ldZ /var/lib/ipa/gssproxy drwx------. root root system_u:object_r:ipa_var_lib_t:s0 /var/lib/ipa/gssproxy [root@rhel7-2 ~]# ls -ldZ /var/lib/ipa/gssproxy/http.keytab -rw-------. apache apache unconfined_u:object_r:ipa_var_lib_t:s0 /var/lib/ipa/gssproxy/http.keytab Version-Release number of selected component (if applicable): ipa-server-4.5.0-5.el7.x86_64 gssproxy-0.7.0-3.el7.x86_64 How reproducible: always if gssproxy is started when SELinux in enforcing mode. Steps to Reproduce: 1. ipa-server-install* 2. setenforce 1 3. ipactl restart 4. ipa user-find *note that due to some other unrelated AVC work still being finished, this had to be run with in permissive mode. Actual results: Throws errors and AVCs Expected results: No errors or AVCs Additional info: