Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
Bug 1539416 - ipsec service with seccomp support and selinux denials
ipsec service with seccomp support and selinux denials
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy (Show other bugs)
7.5
All Linux
high Severity high
: rc
: ---
Assigned To: Lukas Vrabec
Ondrej Moriš
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2018-01-28 14:30 EST by Ondrej Moriš
Modified: 2018-04-10 08:50 EDT (History)
10 users (show)

See Also:
Fixed In Version: selinux-policy-3.13.1-188.el7
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2018-04-10 08:49:36 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:0763 None None None 2018-04-10 08:50 EDT

  None (edit)
Description Ondrej Moriš 2018-01-28 14:30:01 EST
Description of problem:

When seccomp filtering is enabled in ipsec service (ie. libreswan) and actual filtering happens (eg. during pluto seccomp selftest), service is restarted but some service actions are denied:

...
002 "test" #2: route-host output: /usr/libexec/ipsec/_updown.netkey: line 496: /usr/sbin/ip: Permission denied
...

# ausearch -ts recent -m AVC
type=PROCTITLE msg=audit(01/28/2018 20:24:31.687:956) : proctitle=/bin/sh /usr/libexec/ipsec/_updown.netkey 
type=SYSCALL msg=audit(01/28/2018 20:24:31.687:956) : arch=x86_64 syscall=execve success=no exit=EACCES(Permission denied) a0=0x14f5670 a1=0x14cae10 a2=0x14f8740 a3=0x7fff74ec99c0 items=0 ppid=25598 pid=25600 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=_updown.netkey exe=/usr/bin/bash subj=system_u:system_r:ipsec_t:s0 key=(null) 
type=AVC msg=audit(01/28/2018 20:24:31.687:956) : avc:  denied  { execute_no_trans } for  pid=25600 comm=_updown.netkey path=/usr/sbin/ip dev="dm-0" ino=171957 scontext=system_u:system_r:ipsec_t:s0 tcontext=system_u:object_r:ifconfig_exec_t:s0 tclass=file 
type=SELINUX_ERR msg=audit(01/28/2018 20:24:31.687:956) : op=security_bounded_transition seresult=denied oldcontext=system_u:system_r:ipsec_t:s0 newcontext=system_u:system_r:ifconfig_t:s0 

When the following rule is loaded into policy or selinux is in permissive mode, problem disappear:

allow ipsec_t ifconfig_exec_t:file execute_no_trans;

Version-Release number of selected component (if applicable):

selinux-policy-3.13.1-166.el7.noarch
libreswan-3.23-1.el7
kernel-3.10.0-693.el7

How reproducible:

100%

Steps to Reproduce:

Non-trivial but I can share if needed.
Comment 2 Ondrej Moriš 2018-01-29 12:23:07 EST
Paul Wouters noticed one interesting point - there is SELINUX_ERR event which is not really expected, right? Also, Paul suggested that the selinux policy has sysnet_domtrans_ifconfig(ipsec_t) which means ipsec_t should domtrans to ifconfig_t when running ip command and this domain transition in selinux doesn't work when seccomp is enabled for pluto (ipsec daemon).
Comment 3 Milos Malik 2018-01-30 05:41:57 EST
Ondrej Moris and me will test the fix as soon as the new build becomes available.
Comment 4 Lukas Vrabec 2018-02-01 05:18:09 EST
Ondrej, Milos: 

if you create local policy proposed in description, is the scenario working? 

Thanks,
Lukas.
Comment 5 Ondrej Moriš 2018-02-05 03:19:10 EST
(In reply to Lukas Vrabec from comment #4)

> if you create local policy proposed in description, is the scenario working? 

Yes.
Comment 16 errata-xmlrpc 2018-04-10 08:49:36 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:0763

Note You need to log in before you can comment on or make changes to this bug.