Bug 1679745

Description of problem:

After upgrading from `systemd-219-62.el7_6.3` to `systemd-219-62.el7_6.5` this issue appeared.

When running any `sudo` command from a `staff_u` selinux confined user, the sudo invocation takes 25 seconds to complete.

Downgrading resolves the issue.

Removing `-session optional pam_systemd.so` from /etc/pam.d/system-auth resolves the issue.

Setting selinux to permissive also resolves the issue.

Installing a selinux module with:

> allow staff_sudo_t systemd_logind_sessions_t:fifo_file write;

Also resolves the issue. However that particular selinux deny also appears with `systemd-219-62.el7_6.3` (without affecting sudo), which is why we do not think it solves the root cause.

Making the user `unconfined_u` resolves the issue.

Version-Release number of selected component (if applicable):

systemd-219-62.el7_6.3 works
systemd-219-62.el7_6.5 broken

How reproducible:

Always

Steps to Reproduce:

* see below *

Actual results:

Sudo is really slow

Expected results:

Sudo is fast

Additional info:

Debugged on freenode #centos with Kosch and sfix

Steps to Reproduce (continued):

From a clean CentOS 7 minimal installation with all updates applied.

> [root@proclidev03 ~]# sudo yum install policycoreutils-python -y
> [...]
> [root@proclidev03 ~]# getenforce
> Enforcing
> [root@proclidev03 ~]# semodule -DB
> [root@proclidev03 ~]# useradd bacon
> [root@proclidev03 ~]# gpasswd -a bacon wheel
> Adding user bacon to group wheel
> [root@proclidev03 ~]# passwd bacon
> Changing password for user bacon.
> New password: 
> BAD PASSWORD: The password is shorter than 8 characters
> Retype new password: 
> passwd: all authentication tokens updated successfully.
> [root@proclidev03 ~]# 

Open another SSH session to the `bacon` user.

> [bacon@proclidev03 ~]$ date; sudo date
> Thu Feb 21 17:55:40 UTC 2019
> [sudo] password for bacon: 
> Thu Feb 21 17:55:41 UTC 2019

Go back to the `root` session.

> [root@proclidev03 ~]# semanage login -a -s 'staff_u' bacon
> [root@proclidev03 ~]# semanage login -l
> 
> Login Name           SELinux User         MLS/MCS Range        Service
> 
> __default__          unconfined_u         s0-s0:c0.c1023       *
> bacon                staff_u              s0-s0:c0.c1023       *
> root                 unconfined_u         s0-s0:c0.c1023       *
> system_u             system_u             s0-s0:c0.c1023       *
> [root@proclidev03 ~]# restorecon -RF /home/bacon

Logout from the `bacon` session and back in.

> [bacon@proclidev03 ~]$ date; sudo date
> Thu Feb 21 17:58:15 UTC 2019
> [sudo] password for bacon: 
> Thu Feb 21 17:58:42 UTC 2019

When we look at /var/log/audit/audit.log we see the following entry:

> type=AVC msg=audit(1550772716.488:303): avc:  denied  { write } for  pid=24706 comm="sudo" path="/run/systemd/sessions/5.ref" dev="tmpfs" ino=50169 scontext=staff_u:staff_r:staff_sudo_t:s0-s0:c0.c1023 tcontext=system_u:object_r:systemd_logind_sessions_t:s0 tclass=fifo_file permissive=0

The audit2allow utility suggests we apply the following rule:

> allow staff_sudo_t systemd_logind_sessions_t:fifo_file write;

By installing a SELinux module that allows this rule, sudo once again becomes responsive.

> [root@proclidev03 ~]# echo 'type=AVC msg=audit(1550772716.488:303): avc:  denied  { write } for  pid=24706 comm="sudo" path="/run/systemd/sessions/5.ref" dev="tmpfs" ino=50169 scontext=staff_u:staff_r:staff_sudo_t:s0-s0:c0.c1023 tcontext=system_u:object_r:systemd_logind_sessions_t:s0 tclass=fifo_file permissive=0' | audit2allow -a -M logindtest
> ******************** IMPORTANT ***********************
> To make this policy package active, execute:
> 
> semodule -i logindtest.pp
> 
> [root@proclidev03 ~]# semodule -i logindtest.pp

Go back to the `bacon` session.
 
> [bacon@proclidev03 ~]$ date; sudo date
> Thu Feb 21 18:15:30 UTC 2019
> Thu Feb 21 18:15:30 UTC 2019

Please note that we observe the same SELinux deny with `systemd-219-62.el7_6.3` along with the exact same suggestion from `audit2allow`. However, with the older systemd version, the sudo command is not affected with this slowness as demonstrated earlier.