Bug 1478810 - nscd denied send_msg to dbus; causes 2 * 5 seconds delay on ssh login
nscd denied send_msg to dbus; causes 2 * 5 seconds delay on ssh login
Status: NEW
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted (Show other bugs)
26
Unspecified Linux
unspecified Severity medium
: ---
: ---
Assigned To: Lukas Vrabec
Ben Levenson
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2017-08-07 03:21 EDT by Edgar Hoch
Modified: 2018-05-03 04:36 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Audit denied messages of ncsd ("grep nscd /var/log/audit/audit.log|grep -v success") (9.49 KB, text/plain)
2017-08-07 03:21 EDT, Edgar Hoch
no flags Details
SELinux module that allows nscd to access dbus (539 bytes, text/plain)
2017-08-07 03:25 EDT, Edgar Hoch
no flags Details

  None (edit)
Description Edgar Hoch 2017-08-07 03:21:28 EDT
Created attachment 1309945 [details]
Audit denied messages of ncsd ("grep nscd /var/log/audit/audit.log|grep -v success")

Description of problem:
When running ypbind and nscd, there is a delay on ssh login on 10 seconds (two times each five seconds) until shell prompt appears. There may be delays on other operations that uses nscd.

I found in journalclt output that there are audit denied messages of nscd related in timestamps to my login time and to delay of login.

It seams that nscd should be allowed to access dbus?

I append audit messages about nscd and a selinux modul that solves the problem for me.


Version-Release number of selected component (if applicable):
nscd-2.25-7.fc26.x86_64
ypbind-1.38-10.fc26.x86_64
selinux-policy-targeted-3.13.1-260.3.fc26.noarch
kernel-4.11.11-300.fc26.x86_64


How reproducible:
Always.

Steps to Reproduce:
1. Configure and run ypbind (for example, with authconfig).
  (I don't know if it is neccessary.)
2. Start nscd.
3. ssh login to this host from another host.
   Remember the time until shell prompt appears.
4. Logout ssh session.
5. Temporary set selinux in permissive mode. (setenforce 0).
6. ssh login to this host from another host.
   Remember the time until shell prompt appears.
7. Logout ssh session.

Actual results:
There is a delay of about 10 seconds in step 3, but not in step 6.

Expected results:
There is no delay in step 3 and in step 6.
Comment 1 Edgar Hoch 2017-08-07 03:25 EDT
Created attachment 1309947 [details]
SELinux module that allows nscd to access dbus

Modul created by
ausearch --interpret|grep nscd|audit2allow -M nscd-dbus-delay
Comment 2 Fedora End Of Life 2018-05-03 04:36:40 EDT
This message is a reminder that Fedora 26 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 26. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as EOL if it remains open with a Fedora  'version'
of '26'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version'
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not
able to fix it before Fedora 26 is end of life. If you would still like
to see this bug fixed and are able to reproduce it against a later version
of Fedora, you are encouraged  change the 'version' to a later Fedora
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's
lifetime, sometimes those efforts are overtaken by events. Often a
more recent Fedora release includes newer upstream software that fixes
bugs or makes them obsolete.

Note You need to log in before you can comment on or make changes to this bug.