Bug 1558428 - Selinux AVC : deny execution of /usr/bin/net for adcli process
Summary: Selinux AVC : deny execution of /usr/bin/net for adcli process
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy
Version: 6.10
Hardware: x86_64
OS: Linux
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Lukas Vrabec
QA Contact: Milos Malik
Lucie Maňásková
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-03-20 08:39 UTC by Amith
Modified: 2018-05-25 09:21 UTC (History)
16 users (show)

Fixed In Version:
Doc Type: Known Issue
Doc Text:
Updating a machine account password with *adcli* in some cases fails with SELinux error When attempting to update the machine account password using the *adcli* tool in Red Hat Enterprise Linux 6.10, the system security services daemon (SSSD) sometimes tries to update an internal Samba database that contains also the machine account password. As a consequence, the SELinux access vector cache (AVC) states that SSSD and its subprocesses are not allowed to run Samba's `net` command to update the internal Samba database. To work around this problem, you can add a local SELinux policy by creating a `sssd_samba.te` file with the following content: module sssd_samba 1.0; require { type sssd_t; type samba_net_exec_t; class file execute; } #============= sssd_t ============== allow sssd_t samba_net_exec_t:file execute; And then enter the following commands: # yum install selinux-policy-devel # make -f /usr/share/selinux/devel/Makefile sssd_samba.pp # semodule -i sssd_samba.pp As a result, SSSD with *adcli* can update Samba's internal database without an SELinux AVC error.
Clone Of:
Environment:
Last Closed: 2018-03-26 11:23:31 UTC


Attachments (Terms of Use)

Description Amith 2018-03-20 08:39:23 UTC
Description of problem:
Observed AVC denials during the recent rhel-6.10 regression runs of ad_parameter test suite. The "adcli" process was denied execution of file "/usr/bin/net" on a file system hosted on the "dm-0" device. This file has inode number "949886" and has the security context "system_u:object_r:samba_net_exec_t:s0" assigned to it. The "adcli" process is running with security context "unconfined_u:system_r:sssd_t:s0".

ERROR:
 - type=SYSCALL msg=audit(1521532221.642:731): arch=c000003e syscall=21 success=no exit=-13 a0=111e450 a1=1 a2=0 a3=3637373838333337 items=0 ppid=4695 pid=14877 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=7 comm="adcli" exe="/usr/sbin/adcli" subj=unconfined_u:system_r:sssd_t:s0 key=(null)

 - type=AVC msg=audit(1521532231.099:732): avc:  denied  { execute } for  pid=14969 comm="adcli" name="net" dev=dm-0 ino=949886 scontext=unconfined_u:system_r:sssd_t:s0 tcontext=system_u:object_r:samba_net_exec_t:s0 tclass=file

I reproduced this error by:
 - Adding "ad_machine_account_password_renewal_opts = 10:30" to the domain section of SSSD.conf file. 
 - Restart SSSD service and monitor /var/log/audit/audit.log file.

Version-Release number of selected component (if applicable):
sssd-1.13.3-60.el6.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Configure sssd.conf as given below:

[sssd]
config_file_version = 2
services = nss, pam
domains = sssdad.com
user = 

[nss]
filter_groups = root
filter_users = root
default_shell = /bin/bash
override_homedir = /home/%u

[domain/sssdad.com]
debug_level = 0xFFF0
id_provider = ad
ad_domain = sssdad.com
krb5_realm = SSSDAD
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
ldap_schema = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad
ad_machine_account_password_renewal_opts = 10:30

2. Clear the cache and restart sssd service.

3. Monitor /var/log/audit/audit.log for AVC denial errors.

Actual results:
Beaker job during regression run fails due to AVC denials.
x86_64 : https://beaker.engineering.redhat.com/jobs/2368015
x86_64 : https://beaker.engineering.redhat.com/jobs/2376288

Expected results:
Successful regression round without AVC denials.


Additional info:

Following is the analysis of "sealert" utility :
SELinux is preventing /usr/sbin/adcli from execute access on the file /usr/bin/net.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that adcli should be allowed execute access on the net file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep adcli /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp


Additional Information:
Source Context                unconfined_u:system_r:sssd_t:s0
Target Context                system_u:object_r:samba_net_exec_t:s0
Target Objects                /usr/bin/net [ file ]
Source                        adcli
Source Path                   /usr/sbin/adcli
Port                          <Unknown>
Host                          <Unknown>
Source RPM Packages           
Target RPM Packages           samba-common-3.6.23-50.el6.x86_64
Policy RPM                    selinux-policy-3.7.19-312.el6.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     vm-idm-034.sssdad.com
Platform                      Linux vm-idm-034.sssdad.com 2.6.32-742.el6.x86_64
                              #1 SMP Fri Mar 2 22:40:54 EST 2018 x86_64 x86_64
Alert Count                   2
First Seen                    Tue Mar 20 13:20:41 2018
Last Seen                     Tue Mar 20 13:20:41 2018
Local ID                      9cb5ee0d-74e1-4e00-af3d-b06c8a98a5ae

Raw Audit Messages
type=AVC msg=audit(1521532241.20:735): avc:  denied  { execute } for  pid=15061 comm="adcli" name="net" dev=dm-0 ino=949886 scontext=unconfined_u:system_r:sssd_t:s0 tcontext=system_u:object_r:samba_net_exec_t:s0 tclass=file

Comment 2 Sumit Bose 2018-03-20 09:04:27 UTC
Hi,

would it still be possible to enhance the SELinux policy for RHEL-6.10 to allow sssd_t processes to execute samba_net_exec_t files? Or is there a work-arounf to make it work with the existing policy?

In 6.10 adcli is able to update the host account password in Samba's internal tdb files with the help of the net command. This was added to allow RHEL6 clients to join AD domains where SMB1 is disabled. When SSSD calls adcli to update an old host account password Samba's internal tdbs must be updated with the new password as well.

bye,
Sumit


Note You need to log in before you can comment on or make changes to this bug.