Red Hat Bugzilla – Bug 1558428
Selinux AVC : deny execution of /usr/bin/net for adcli process
Last modified: 2018-05-25 05:21:24 EDT
Description of problem: Observed AVC denials during the recent rhel-6.10 regression runs of ad_parameter test suite. The "adcli" process was denied execution of file "/usr/bin/net" on a file system hosted on the "dm-0" device. This file has inode number "949886" and has the security context "system_u:object_r:samba_net_exec_t:s0" assigned to it. The "adcli" process is running with security context "unconfined_u:system_r:sssd_t:s0". ERROR: - type=SYSCALL msg=audit(1521532221.642:731): arch=c000003e syscall=21 success=no exit=-13 a0=111e450 a1=1 a2=0 a3=3637373838333337 items=0 ppid=4695 pid=14877 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=7 comm="adcli" exe="/usr/sbin/adcli" subj=unconfined_u:system_r:sssd_t:s0 key=(null) - type=AVC msg=audit(1521532231.099:732): avc: denied { execute } for pid=14969 comm="adcli" name="net" dev=dm-0 ino=949886 scontext=unconfined_u:system_r:sssd_t:s0 tcontext=system_u:object_r:samba_net_exec_t:s0 tclass=file I reproduced this error by: - Adding "ad_machine_account_password_renewal_opts = 10:30" to the domain section of SSSD.conf file. - Restart SSSD service and monitor /var/log/audit/audit.log file. Version-Release number of selected component (if applicable): sssd-1.13.3-60.el6.x86_64 How reproducible: Always Steps to Reproduce: 1. Configure sssd.conf as given below: [sssd] config_file_version = 2 services = nss, pam domains = sssdad.com user = [nss] filter_groups = root filter_users = root default_shell = /bin/bash override_homedir = /home/%u [domain/sssdad.com] debug_level = 0xFFF0 id_provider = ad ad_domain = sssdad.com krb5_realm = SSSDAD realmd_tags = manages-system joined-with-adcli cache_credentials = True ldap_schema = ad krb5_store_password_if_offline = True default_shell = /bin/bash use_fully_qualified_names = True fallback_homedir = /home/%u@%d access_provider = ad ad_machine_account_password_renewal_opts = 10:30 2. Clear the cache and restart sssd service. 3. Monitor /var/log/audit/audit.log for AVC denial errors. Actual results: Beaker job during regression run fails due to AVC denials. x86_64 : https://beaker.engineering.redhat.com/jobs/2368015 x86_64 : https://beaker.engineering.redhat.com/jobs/2376288 Expected results: Successful regression round without AVC denials. Additional info: Following is the analysis of "sealert" utility : SELinux is preventing /usr/sbin/adcli from execute access on the file /usr/bin/net. ***** Plugin catchall (100. confidence) suggests *************************** If you believe that adcli should be allowed execute access on the net file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep adcli /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context unconfined_u:system_r:sssd_t:s0 Target Context system_u:object_r:samba_net_exec_t:s0 Target Objects /usr/bin/net [ file ] Source adcli Source Path /usr/sbin/adcli Port <Unknown> Host <Unknown> Source RPM Packages Target RPM Packages samba-common-3.6.23-50.el6.x86_64 Policy RPM selinux-policy-3.7.19-312.el6.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name vm-idm-034.sssdad.com Platform Linux vm-idm-034.sssdad.com 2.6.32-742.el6.x86_64 #1 SMP Fri Mar 2 22:40:54 EST 2018 x86_64 x86_64 Alert Count 2 First Seen Tue Mar 20 13:20:41 2018 Last Seen Tue Mar 20 13:20:41 2018 Local ID 9cb5ee0d-74e1-4e00-af3d-b06c8a98a5ae Raw Audit Messages type=AVC msg=audit(1521532241.20:735): avc: denied { execute } for pid=15061 comm="adcli" name="net" dev=dm-0 ino=949886 scontext=unconfined_u:system_r:sssd_t:s0 tcontext=system_u:object_r:samba_net_exec_t:s0 tclass=file
Hi, would it still be possible to enhance the SELinux policy for RHEL-6.10 to allow sssd_t processes to execute samba_net_exec_t files? Or is there a work-arounf to make it work with the existing policy? In 6.10 adcli is able to update the host account password in Samba's internal tdb files with the help of the net command. This was added to allow RHEL6 clients to join AD domains where SMB1 is disabled. When SSSD calls adcli to update an old host account password Samba's internal tdbs must be updated with the new password as well. bye, Sumit