Bug 1665058
| Summary: | with-smartcard-required feature requires Smartcard authentication for more services than in RHEL7 | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Sumit Bose <sbose> |
| Component: | authselect | Assignee: | Pavel Březina <pbrezina> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Steeve Goveas <sgoveas> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 8.0 | CC: | aakkiang, cpelland, mkosek, rpattath, sbose, spoore, wchadwic |
| Target Milestone: | rc | Keywords: | Regression, TestBlocker |
| Target Release: | 8.0 | Flags: | rule-engine:
mirror+
|
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | authselect-1.0-12.el8 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-06-14 00:56:50 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1652753 | ||
|
Description
Sumit Bose
2019-01-10 12:21:39 UTC
Using sssd-2.0.0-36.el8 I am seeing the issue mentioned in https://bugzilla.redhat.com/show_bug.cgi?id=1649277#c13. Sumit suggested to try the following config Add 'require_cert_auth' to the 'auth sufficient pam_sss.so allow_missing_name' line in /etc/pam.d/smartcard-auth, restart gdm and try again. I tried but I still see the issue. I see there is a secalert in provided logs from c#14: Jan 10 11:26:25 dhcp129-43 platform-python[6466]: SELinux is preventing /usr/libexec/sssd/p11_child from search access on the directory .config.#012#012***** Plugin catchall (100. confidence) suggests **************************#012#012If you believe that p11_child should be allowed search access on the .config directory by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this access.#012Do#012allow this access for now by executing:#012# ausearch -c 'p11_child' --raw | audit2allow -M my-p11child#012# semodule -X 300 -i my-p11child.pp#012 Perhaps it would help to fix this? See the end of the message: #012Do#012allow this access for now by executing:#012# ausearch -c 'p11_child' --raw | audit2allow -M my-p11child#012# semodule -X 300 -i my-p11child.pp#012 (In reply to Pavel Březina from comment #5) > I see there is a secalert in provided logs from c#14: > > Jan 10 11:26:25 dhcp129-43 platform-python[6466]: SELinux is preventing > /usr/libexec/sssd/p11_child from search access on the directory > .config.#012#012***** Plugin catchall (100. confidence) suggests > **************************#012#012If you believe that p11_child should be > allowed search access on the .config directory by default.#012Then you > should report this as a bug.#012You can generate a local policy module to > allow this access.#012Do#012allow this access for now by executing:#012# > ausearch -c 'p11_child' --raw | audit2allow -M my-p11child#012# semodule -X > 300 -i my-p11child.pp#012 > > Perhaps it would help to fix this? See the end of the message: > #012Do#012allow this access for now by executing:#012# ausearch -c > 'p11_child' --raw | audit2allow -M my-p11child#012# semodule -X 300 -i > my-p11child.pp#012 There is a know issue in p11-kit https://bugzilla.redhat.com/show_bug.cgi?id=1624930. Ok, so it is unrelated to the issue in gdm? If I understand it correctly, the bug described in the first comment of this page can be fixed by changing to: auth [success=1 default=ignore] pam_succeed_if.so service notin login:gdm:xdm:kdm:xscreensaver:gnome-screensaver:kscreensaver quiet use_uid Is that correct? Is there any progress on the second issue described at https://bugzilla.redhat.com/show_bug.cgi?id=1649277#c13 ? Upstream PR: https://github.com/pbrezina/authselect/pull/135 Using authselect-1.0-12.el8.x86_64 I am able to su to root after smartcard login when authconfig --enablesssd --enablesssdauth --enablesmartcard --enablerequiresmartcard --updateall but I still see https://bugzilla.redhat.com/show_bug.cgi?id=1649277#c13 (In reply to Roshni from comment #13) > Using authselect-1.0-12.el8.x86_64 I am able to su to root after smartcard > login when authconfig --enablesssd --enablesssdauth --enablesmartcard > --enablerequiresmartcard --updateall but I still see > https://bugzilla.redhat.com/show_bug.cgi?id=1649277#c13 Yes, that's expected since authselect-1.0-12.el8.x86_64 does not include a fix for this. This issue is tracked separately in https://bugzilla.redhat.com/show_bug.cgi?id=1674397. Thank you Sumit. Based on comment 13 marking this bug verified. |