Bugzilla (bugzilla.redhat.com) will be under maintenance for infrastructure upgrades and will not be unavailable on July 31st between 12:30 AM - 05:30 AM UTC. We appreciate your understanding and patience. You can follow status.redhat.com for details.
Bug 1740642 - avc denied for sssd_be while searching kerberos keytab krb5_keytab_t
Summary: avc denied for sssd_be while searching kerberos keytab krb5_keytab_t
Keywords:
Status: CLOSED DUPLICATE of bug 1730144
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: selinux-policy
Version: 8.1
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: 8.0
Assignee: Lukas Vrabec
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-08-13 12:19 UTC by shridhar
Modified: 2019-08-22 16:21 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-08-13 16:51:08 UTC
Type: Bug
Target Upstream Version:


Attachments (Terms of Use)

Description shridhar 2019-08-13 12:19:57 UTC
Description of problem:
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      31
selinux-policy-3.14.3-13.el8.noarch
----
time->Tue Aug 13 02:19:39 2019
type=PROCTITLE msg=audit(1565642979.739:550): proctitle=2F7573722F6C6962657865632F737373642F737373645F6265002D2D646F6D61696E0061642E626173656F732E7165002D2D7569640030002D2D6769640030002D2D6C6F676765723D66696C6573
type=SYSCALL msg=audit(1565642979.739:550): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=5633a4ec57e0 a2=0 a3=0 items=0 ppid=11801 pid=11804 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sssd_be" exe="/usr/libexec/sssd/sssd_be" subj=system_u:system_r:sssd_t:s0 key=(null)
type=AVC msg=audit(1565642979.739:550): avc:  denied  { search } for  pid=11804 comm="sssd_be" name="krb5" dev="dm-0" ino=33723500 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:krb5_keytab_t:s0 tclass=dir permissive=0
----
time->Tue Aug 13 02:19:47 2019
type=PROCTITLE msg=audit(1565642987.275:554): proctitle=2F7573722F62696E2F6E73757064617465002D67
type=SYSCALL msg=audit(1565642987.275:554): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7efda0200db0 a2=0 a3=0 items=0 ppid=11804 pid=11876 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="isc-worker0000" exe="/usr/bin/nsupdate" subj=system_u:system_r:sssd_t:s0 key=(null)
type=AVC msg=audit(1565642987.275:554): avc:  denied  { search } for  pid=11876 comm="isc-worker0000" name="krb5" dev="dm-0" ino=33723500 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:krb5_keytab_t:s0 tclass=dir permissive=0
----
time->Tue Aug 13 02:19:50 2019
type=PROCTITLE msg=audit(1565642990.141:558): proctitle=2F7573722F62696E2F6E73757064617465002D67
type=SYSCALL msg=audit(1565642990.141:558): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7efda0201d00 a2=0 a3=0 items=0 ppid=11804 pid=11876 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="isc-worker0000" exe="/usr/bin/nsupdate" subj=system_u:system_r:sssd_t:s0 key=(null)
type=AVC msg=audit(1565642990.141:558): avc:  denied  { search } for  pid=11876 comm="isc-worker0000" name="krb5" dev="dm-0" ino=33723500 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:krb5_keytab_t:s0 tclass=dir permissive=0
----
time->Tue Aug 13 02:19:52 2019
type=PROCTITLE msg=audit(1565642992.178:559): proctitle=2F7573722F62696E2F6E73757064617465002D67
type=SYSCALL msg=audit(1565642992.178:559): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7f76cc2005c0 a2=0 a3=0 items=0 ppid=11804 pid=11922 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="isc-worker0000" exe="/usr/bin/nsupdate" subj=system_u:system_r:sssd_t:s0 key=(null)
type=AVC msg=audit(1565642992.178:559): avc:  denied  { search } for  pid=11922 comm="isc-worker0000" name="krb5" dev="dm-0" ino=33723500 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:krb5_keytab_t:s0 tclass=dir permissive=0
----
time->Tue Aug 13 02:19:54 2019
type=PROCTITLE msg=audit(1565642994.187:560): proctitle=2F7573722F62696E2F6E73757064617465002D67
type=SYSCALL msg=audit(1565642994.187:560): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7f76cc2018d0 a2=0 a3=0 items=0 ppid=11804 pid=11922 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="isc-worker0000" exe="/usr/bin/nsupdate" subj=system_u:system_r:sssd_t:s0 key=(null)
type=AVC msg=audit(1565642994.187:560): avc:  denied  { search } for  pid=11922 comm="isc-worker0000" name="krb5" dev="dm-0" ino=33723500 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:krb5_keytab_t:s0 tclass=dir permissive=0


Version-Release number of selected component (if applicable):

selinux-policy-3.14.3-13.el8.noarch
How reproducible:
always

Steps to Reproduce:
1. Running regression run for realmd
https://beaker.engineering.redhat.com/recipes/7230022#task97643445

messages are at
http://beaker-archive.host.prod.eng.bos.redhat.com/beaker-logs/2019/08/37243/3724304/7230022/97643445/448564820/avc.log

2.
3.

Actual results:
sssd_be is denied while searching for keytab

Expected results:
there should be no denial.

Additional info:

Comment 1 Lukas Vrabec 2019-08-13 16:51:08 UTC

*** This bug has been marked as a duplicate of bug 1730144 ***


Note You need to log in before you can comment on or make changes to this bug.