Created attachment 1304689 [details]
Additional type enforcement rules for svnserve_t

Description of problem:

selinux-policy does not support svnserve running svn protocol using GSSAPI.

Version-Release number of selected component (if applicable):

7.4

How reproducible:

Happens every time with :-
1. Kerberised subversion server+client
2. selinux in enforcing mode on the server.
3. Client attempts to access server using the SVN protocol.


Steps to Reproduce:
1. (on the Kerberos KDC) Create a keytab for the server using the principal name "svn/<hostname>@<realm>"
2. Install OS on server, including subversion RPM.
3. Join server to realm (using adcli/realmd)
4. Create a local SVN repository on the server.
5. Copy keytab to server
6. Configure svnserve to use SASL2 + GSSAPI for authentication. Add the name of a realm user as authorized to read the repository.
7. From a remote client in the realm, log in as the realm user in step 6, and attempt to list the repository using "svn ls svn://<server>/<path to repo>"

Actual results:

Client error is : svn: E170001: Authentication error from server: SASL(-1): generic failure: GSSAPI Error: An invalid name was supplied (Permission denied)

On the server, an audit entry is made similar to the following.

----
time->Wed Jul 26 10:57:25 2017
type=SYSCALL msg=audit(1501063045.818:738): arch=c000003e syscall=4 success=no exit=-13 a0=7f8c96228378 a1=7ffd7ba5a490 a2=7ffd7ba5a490 a3=b items=0 ppid=22518 pid=22534 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="svnserve" exe="/usr/bin/svnserve" subj=system_u:system_r:svnserve_t:s0 key=(null)
type=AVC msg=audit(1501063045.818:738): avc:  denied  { getattr } for  pid=22534 comm="svnserve" path="/etc/krb5.conf" dev="dm-0" ino=16787959 scontext=system_u:system_r:svnserve_t:s0 tcontext=system_u:object_r:krb5_conf_t:s0 tclass=file


Expected results:

Repo listing on the client, and no AVC failure entries in the audit log.


Additional info:

The problem can be worked around by compiling and installing the attached .te file which contains the required policy entries to use svnserve with Kerberos.