Bug 1660116 - oddjob-mkhomedir fails to create home dir when executed from cron daemon
Summary: oddjob-mkhomedir fails to create home dir when executed from cron daemon
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.6
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Lukas Vrabec
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-12-17 14:27 UTC by Renaud Métrich
Modified: 2019-02-28 19:04 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-02-28 19:04:16 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description Renaud Métrich 2018-12-17 14:27:19 UTC
Description of problem:

When oddjob-mkhomedir is executed from the cron daemon, it fails to create the user's home directory.
The following AVC and USER_AVC are seen:

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

type=USER_AVC msg=audit(1545054661.514:262): pid=612 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=error error_name=com.redhat.oddjob.Error.Exec dest=:1.37 spid=26993 tpid=26994 scontext=system_u:system_r:oddjob_t:s0-s0:c0.c1023 tcontext=system_u:system_r:crond_t:s0-s0:c0.c1023 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
type=PROCTITLE msg=audit(1545054661.511:261): proctitle=2F7573722F7362696E2F6F64646A6F6264002D6E002D70002F7661722F72756E2F6F64646A6F62642E706964002D7400333030
type=SYSCALL msg=audit(1545054661.511:261): arch=c000003e syscall=59 success=no exit=-13 a0=55fb5d3800a0 a1=55fb5d381b90 a2=55fb5d390340 a3=3a30732d30733a74 items=0 ppid=26993 pid=26996 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="oddjobd" exe="/usr/sbin/oddjobd" subj=system_u:system_r:oddjob_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1545054661.511:261): avc:  denied  { transition } for  pid=26996 comm="oddjobd" path="/usr/libexec/oddjob/mkhomedir" dev="dm-0" ino=8703477 scontext=system_u:system_r:oddjob_t:s0-s0:c0.c1023 tcontext=system_u:system_r:crond_t:s0-s0:c0.c1023 tclass=process
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

audit2allow proposes to add the following and prints an odd message related to mislabeling:

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
#============= oddjob_t ==============
allow oddjob_t crond_t:dbus send_msg;

#!!!! The file '/usr/libexec/oddjob/mkhomedir' is mislabeled on your system.  
#!!!! Fix with $ restorecon -R -v /usr/libexec/oddjob/mkhomedir
allow oddjob_t crond_t:process transition;
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------


If I add the latter to a custom policy, then oddjob will continue to fail with the following AVC:

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
type=PROCTITLE msg=audit(1545056341.770:510): proctitle=2F7573722F7362696E2F6F64646A6F6264002D6E002D70002F7661722F72756E2F6F64646A6F62642E706964002D7400333030
type=SYSCALL msg=audit(1545056341.770:510): arch=c000003e syscall=59 success=no exit=-13 a0=55fb5d3800a0 a1=55fb5d38d680 a2=55fb5d38a770 a3=3a30732d30733a74 items=0 ppid=26993 pid=29759 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="oddjobd" exe="/usr/sbin/oddjobd" subj=system_u:system_r:oddjob_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1545056341.770:510): avc:  denied  { entrypoint } for  pid=29759 comm="oddjobd" path="/usr/libexec/oddjob/mkhomedir" dev="dm-0" ino=8703477 scontext=system_u:system_r:crond_t:s0-s0:c0.c1023 tcontext=system_u:object_r:oddjob_mkhomedir_exec_t:s0 tclass=file
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------


Version-Release number of selected component (if applicable):

selinux-policy-3.13.1-192.el7_5.7.noarch and selinux-policy-3.13.1-229.el7_6.6.100.noarch


How reproducible:

Always


Steps to Reproduce:
1. Install and enable oddjob-mkhomedir

  yum -y install oddjob-mkhomedir
  authconfig --update --enablemkhomedir

2. Create a user without home dir

  useradd -M renaud

3. Add a cron entry to the user

  crontab -u renaud -e
  <vi opens>
  * * * * * ls -l

4. Wait for 1 minute and check audit


Actual results:

- AVC + USER_AVC
- no /home/renaud created


Expected results:

- /home/renaud created


Additional info:

Doesn't happen on RHEL8

Comment 2 Zdenek Pytela 2019-02-28 19:04:16 UTC
This issue was not selected to be included in Red Hat Enterprise Linux 7.7 because it is seen either as low or moderate impact to a small number of use-cases. The next release will be in Maintenance Support 1 Phase, which means that qualified Critical and Important Security errata advisories (RHSAs) and Urgent Priority Bug Fix errata advisories (RHBAs) may be released as they become available.

We will now close this issue, but if you believe that it qualifies for the Maintenance Support 1 Phase, please re-open; otherwise, we recommend moving the request to Red Hat Enterprise Linux 8 if applicable.


Note You need to log in before you can comment on or make changes to this bug.