Bug 1716418

+++ This bug was initially created as a clone of Bug #1715844 +++

Description of problem:

dhcpd daemon start produces the following AVC denial:

time->Fri May 31 13:57:32 2019
type=PROCTITLE msg=audit(1559303852.249:413): proctitle=6468637064002D6366002F746D702F646863702E636F6E66002D6368726F6F74002F7661722F6C69622F6468637064002D6C66002F64622F64686370642E6C6561736573002D75736572006468637064002D67726F7570006468637064002D7066002F7661722F72756E2F64686370642E7069640064756D6D7930
type=SYSCALL msg=audit(1559303852.249:413): arch=c000003e syscall=9 success=yes exit=140067871424512 a0=0 a1=208490 a2=5 a3=802 items=0 ppid=5987 pid=5988 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="dhcpd" exe="/usr/sbin/dhcpd" subj=system_u:system_r:dhcpd_t:s0 key=(null)
type=AVC msg=audit(1559303852.249:413): avc:  denied  { execute } for  pid=5988 comm="dhcpd" path="/lib64/libnss_sss.so.2" dev="dm-0" ino=5752596 scontext=system_u:system_r:dhcpd_t:s0 tcontext=system_u:object_r:dhcpd_state_t:s0 tclass=file permissive=1

the dhcpd service appears to work, but might be missing some features do to the above when selinux is in enforcing mode (default).

Version-Release number of selected component (if applicable):
selinux-policy-3.13.1-249.el7.noarch

How reproducible:
always

Steps to Reproduce:
1. install, configure and start dhcpd
2.
3.

Actual results:
daemon starts, AVC denial logged

Expected results:
no AVC denials

Additional info:

--- Additional comment from Milos Malik on 2019-05-31 14:37:49 UTC ---

The /lib64/libnss_sss.so.2 is mislabeled.

Correct label is:
# matchpathcon /lib64/libnss_sss.so.2
/lib64/libnss_sss.so.2	system_u:object_r:lib_t:s0
#

Following command will repair the problem:
# restorecon -Rv /lib64

--- Additional comment from Lukas Vrabec on 2019-06-03 11:49:45 UTC ---

Patrick, 

Could you please confirm that solution from comment#2 is working for you? 

Thanks,
Lukas.

--- Additional comment from Patrik Hagara on 2019-06-03 12:08:29 UTC ---

Actually, the bug appears to be on the cluster resource agent side -- I'm running this in as a pacemaker cluster resource, sorry for not mentioning that in the description.

The resource agent defaults to running dhcpd in a chroot and copies config files and required libraries (libnss_sss.so.2 among them) into the chroot [1]. The "-p/--preserve" option of `cp` does not appear to preserve selinux context of the copied files (unless it's explicitly requested) and so the AVCs occur.

IIUC, this should be fixed in the resource agent itself and not selinux-policy. Is that correct?


[1] https://github.com/ClusterLabs/resource-agents/blob/master/heartbeat/dhcpd#L331

--- Additional comment from Zdenek Pytela on 2019-06-03 12:57:55 UTC ---

I'd suggest including xattr into the preserved set or use all, see cp(1):

       -p     same as --preserve=mode,ownership,timestamps

       --preserve[=ATTR_LIST]
              preserve the specified attributes (default: mode,ownership,timestamps), if possi‐
              ble additional attributes: context, links, xattr, all

or alternatively use restorecon after the cp command finishes.

Note -a has "all":

       -a, --archive
              same as -dR --preserve=all