Bug 1663444
| Summary: | Keepalived triggers a SELinux AVC when it tries to switch to the user supplied in script_user | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Oliver Falk <ofalk> | |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> | |
| Status: | CLOSED WONTFIX | QA Contact: | Milos Malik <mmalik> | |
| Severity: | medium | Docs Contact: | ||
| Priority: | medium | |||
| Version: | 7.7 | CC: | bperkins, cluster-maint, lvrabec, mmalik, ofalk, peter.vreman, plautrba, rohara, ssekidde, tjaros, vmojzis, zpytela | |
| Target Milestone: | rc | Keywords: | Reopened | |
| Target Release: | --- | |||
| Hardware: | All | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1743450 (view as bug list) | Environment: | ||
| Last Closed: | 2019-08-09 15:16:22 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1122832, 1743450 | |||
Where is the script located? Please note that all keepalived scripts should reside in the /usr/libexec/keepalived/ directory. Also, this should be filed against the selinux-policy component, not keepalived. The setuid() and setgid() syscall that changes the uid/gid of the current running process and has nothing to do with a directory location The SElinux problem was only trigger after adding the 'script_user nobody nobody' to the config, before the configuration was working flawless Moving bug to selinux-policy. Thx Ryan for the hint. (In reply to Peter Vreman from comment #3) > The setuid() and setgid() syscall that changes the uid/gid of the current > running process and has nothing to do with a directory location Running keepalived with selinux enabled requires scripts (if any) to be located in the /usr/libexec/keepalived/ directory. When I see a BZ related to keepalived and selinux, my first reaction is to make sure the script is located in the correct place. If it is not, you will run into AVCs. I know perfectly well what setuid and setgid do. I moved my script to /usr/libexec/keepalived/. But the SELinux AVC is still there.
See below that it does is the script_user nobody that triggers that violation. Because when i change it back to script_user root the issue dissaapears:
-----------
[crash/LI] root@li-lc-1443:~# date
Fri Jan 4 14:55:12 UTC 2019
[crash/LI] root@li-lc-1443:~# systemctl restart keepalived
[crash/LI] root@li-lc-1443:~# grep -i keepal /var/log/messages | tail -n10
Jan 4 14:55:22 li-lc-1443 Keepalived_vrrp[22260]: Opening file '/etc/keepalived/keepalived.conf'.
Jan 4 14:55:22 li-lc-1443 Keepalived_vrrp[22260]: VRRP_Instance(VI_111) removing protocol VIPs.
Jan 4 14:55:22 li-lc-1443 Keepalived_vrrp[22260]: Using LinkWatch kernel netlink reflector...
Jan 4 14:55:22 li-lc-1443 Keepalived_vrrp[22260]: VRRP_Instance(VI_111) Entering BACKUP STATE
Jan 4 14:55:22 li-lc-1443 Keepalived_vrrp[22260]: VRRP sockpool: [ifindex(2), proto(112), unicast(0), fd(10,11)]
Jan 4 14:55:22 li-lc-1443 Keepalived_vrrp[22260]: Remote SMTP server [127.0.0.1]:25 connected.
Jan 4 14:55:22 li-lc-1443 Keepalived_vrrp[22261]: Couldn't setuid: 99 (Operation not permitted)
Jan 4 14:55:22 li-lc-1443 Keepalived_vrrp[22260]: VRRP_Script(testscript) succeeded
Jan 4 14:55:22 li-lc-1443 Keepalived_vrrp[22260]: SMTP alert successfully sent.
Jan 4 14:55:27 li-lc-1443 setroubleshoot: SELinux is preventing /usr/sbin/keepalived from using the setuid capability. For complete SELinux messages run: sealert -l b4a3c379-200d-4d1d-ac29-f5265e66e941
[crash/LI] root@li-lc-1443:~# grep script /etc/keepalived/keepalived.conf
script_user nobody root
enable_script_security
vrrp_script testscript {
script "/usr/libexec/keepalived/testscript"
track_script {
testscript
[crash/LI] root@li-lc-1443:~# ls -l "/usr/libexec/keepalived/testscript"
-rwxr-xr-x. 1 root root 24 Jan 4 14:51 /usr/libexec/keepalived/testscript
[crash/LI] root@li-lc-1443:~# ls -lZ "/usr/libexec/keepalived/testscript"
-rwxr-xr-x. root root unconfined_u:object_r:keepalived_unconfined_script_exec_t:s0 /usr/libexec/keepalived/testscript
(reverse-i-search)`': ^C
(reverse-i-search)`mcedi': ^Cedit /etc/hammer/cli_config.yml
[crash/LI] root@li-lc-1443:~# mcedit /etc/keepalived/keepalived.conf
(reverse-i-search)`rest': systemctl ^Cstart keepalived
[crash/LI] root@li-lc-1443:~# date
Fri Jan 4 14:56:57 UTC 2019
[crash/LI] root@li-lc-1443:~# systemctl restart keepalived
[crash/LI] root@li-lc-1443:~# grep -i keepal /var/log/messages | tail -n10
Jan 4 14:57:00 li-lc-1443 Keepalived_vrrp[22395]: Registering Kernel netlink command channel
Jan 4 14:57:00 li-lc-1443 Keepalived_vrrp[22395]: Registering gratuitous ARP shared channel
Jan 4 14:57:00 li-lc-1443 Keepalived_vrrp[22395]: Opening file '/etc/keepalived/keepalived.conf'.
Jan 4 14:57:00 li-lc-1443 Keepalived_vrrp[22395]: VRRP_Instance(VI_111) removing protocol VIPs.
Jan 4 14:57:00 li-lc-1443 Keepalived_vrrp[22395]: Using LinkWatch kernel netlink reflector...
Jan 4 14:57:00 li-lc-1443 Keepalived_vrrp[22395]: VRRP_Instance(VI_111) Entering BACKUP STATE
Jan 4 14:57:00 li-lc-1443 Keepalived_vrrp[22395]: VRRP sockpool: [ifindex(2), proto(112), unicast(0), fd(10,11)]
Jan 4 14:57:00 li-lc-1443 Keepalived_vrrp[22395]: Remote SMTP server [127.0.0.1]:25 connected.
Jan 4 14:57:00 li-lc-1443 Keepalived_vrrp[22395]: VRRP_Script(testscript) succeeded
Jan 4 14:57:00 li-lc-1443 Keepalived_vrrp[22395]: SMTP alert successfully sent.
[crash/LI] root@li-lc-1443:~# grep script /etc/keepalived/keepalived.conf
script_user root root
enable_script_security
vrrp_script testscript {
script "/usr/libexec/keepalived/testscript"
track_script {
testscript
[crash/LI] root@li-lc-1443:~#
-----------
This issue was not selected to be included in Red Hat Enterprise Linux 7.7 because it is seen either as low or moderate impact to a small number of use-cases. The next release will be in Maintenance Support 1 Phase, which means that qualified Critical and Important Security errata advisories (RHSAs) and Urgent Priority Bug Fix errata advisories (RHBAs) may be released as they become available. We will now close this issue, but if you believe that it qualifies for the Maintenance Support 1 Phase, please re-open; otherwise, we recommend moving the request to Red Hat Enterprise Linux 8 if applicable. This issue was not selected to be included in Red Hat Enterprise Linux 7 because it is seen either as low or moderate impact to a small number of use-cases. The next minor release will be in Maintenance Support 1 Phase, which means that qualified Critical and Important Security errata advisories (RHSAs) and Urgent Priority Bug Fix errata advisories (RHBAs) may be released as they become available. We will now close this issue, but if you believe that it qualifies for the Maintenance Support 1 Phase, please re-open; otherwise, we recommend moving the request to Red Hat Enterprise Linux 8 if applicable. As a workaround, the following custom policy can be used to allow the requested capabilities on systems where it is required: # cat > local_keepalived.cil << EOF (allow keepalived_t keepalived_t (capability (setuid setgid))) EOF # semodule -i local_keepalived.cil |
Description of problem: Keepalived triggers a SELinux AVC when it tries to switch to the user supplied Jan 3 18:36:47 xxx setroubleshoot: SELinux is preventing /usr/sbin/keepalived from using the setuid capability. For complete SELinux messages run: sealert -l 0dc648b9-a9a5-4cc1-bc93-36140b628d4c Both the setuid and setgid calls are triggering the SELinux AVC. Fix for SELinux policy: ------ #============= keepalived_t ============== allow keepalived_t self:capability { setuid setgid }; ----- Version-Release number of selected component (if applicable): all How reproducible: Always Steps to Reproduce: 1. Create keepalived config with a script_command and add 'script_user nobody nobody' to the config Actual results: AVC denial Expected results: Script is executed with the user/group supplied in script_user Additional info: Customer case will be linked in a hurry.