Bug 1595667 - allow user add for gnome-control-center
Summary: allow user add for gnome-control-center
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.6
Hardware: x86_64
OS: Linux
high
high
Target Milestone: rc
: ---
Assignee: Lukas Vrabec
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-06-27 10:15 UTC by Martin Krajnak
Modified: 2018-10-30 10:06 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-10-30 10:05:54 UTC
Target Upstream Version:


Attachments (Terms of Use)
error msg screenshot (86.27 KB, image/png)
2018-06-27 10:15 UTC, Martin Krajnak
no flags Details


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:3111 None None None 2018-10-30 10:06:24 UTC

Description Martin Krajnak 2018-06-27 10:15:49 UTC
Created attachment 1454993 [details]
error msg screenshot

Description of problem:
I am not able to simply add new user through control center

Version-Release number of selected component (if applicable):
control-center-3.28.1-2.el7.x86_64

How reproducible:
always

Steps to Reproduce:
1.Search for setting in Gnome-shell and open control-center
2.Open Details
3.Open Users
4.Click Unlock in upper corner
5.Click Add User in upper corner
6.Type just username test2 and click Add

Actual results:
Failed to add account
running 'usr/sbin/useradd' failed: Child process killed by signal 9

Expected results:
New user should be created and shown in Users section

Additional info:
I tried running 'control-center --verbose' from terminal but I am not able to to click Unlock button in step 4. it looks like it is disabled somehow

Comment 2 Martin Krajnak 2018-06-27 10:22:57 UTC
I also tried to add user via terminal:
sudo useradd test2

the user is created and it is shown in control center but when I try to delete him, the same error message is shown

Comment 3 Martin Krajnak 2018-06-27 10:24:45 UTC
the reproducer is working in RHEL 7.5

Comment 5 Martin Krajnak 2018-06-27 11:27:31 UTC
ok I was pointed out by vbenes that it is caused by Selinux

SELinux is preventing /usr/sbin/useradd from map access on the file /usr/sbin/useradd.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that useradd should be allowed map access on the useradd file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'useradd' --raw | audit2allow -M my-useradd
# semodule -i my-useradd.pp

Additional Information:
Source Context                system_u:system_r:accountsd_t:s0
Target Context                system_u:object_r:useradd_exec_t:s0
Target Objects                /usr/sbin/useradd [ file ]
Source                        useradd
Source Path                   /usr/sbin/useradd
Port                          <Unknown>
Host                          localhost.localdomain
Source RPM Packages           shadow-utils-4.1.5.1-25.el7.x86_64
Target RPM Packages           shadow-utils-4.1.5.1-25.el7.x86_64
Policy RPM                    selinux-policy-3.13.1-204.el7.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     localhost.localdomain
Platform                      Linux localhost.localdomain 3.10.0-906.el7.x86_64
                              #1 SMP Fri Jun 15 18:16:49 EDT 2018 x86_64 x86_64
Alert Count                   1
First Seen                    2018-06-22 09:31:20 CEST
Last Seen                     2018-06-22 09:31:20 CEST
Local ID                      ad060923-32ee-471e-bade-5b52acf573fa

Raw Audit Messages
type=AVC msg=audit(1529652680.321:670): avc:  denied  { map } for  pid=4781 comm="useradd" path="/usr/sbin/useradd" dev="dm-0" ino=2306799 scontext=system_u:system_r:accountsd_t:s0 tcontext=system_u:object_r:useradd_exec_t:s0 tclass=file permissive=0


type=SYSCALL msg=audit(1529652680.321:670): arch=x86_64 syscall=execve success=no exit=EACCES a0=5561572e49ab a1=7fff8daa0290 a2=7fff8daa0728 a3=7fff8da9f8e0 items=0 ppid=713 pid=4781 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=5 comm=useradd exe=/usr/sbin/useradd subj=system_u:system_r:accountsd_t:s0 key=(null)

Hash: useradd,accountsd_t,useradd_exec_t,file,map

Comment 9 errata-xmlrpc 2018-10-30 10:05:54 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3111


Note You need to log in before you can comment on or make changes to this bug.