Bug 1781806
| Summary: | SELinux prevents NetworkManager from getting status of winbind service | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Milos Malik <mmalik> |
| Component: | selinux-policy | Assignee: | Patrik Koncity <pkoncity> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 8.2 | CC: | amahdal, lvrabec, mmalik, orion, pkoncity, plautrba, psklenar, sorlov, ssekidde, thaller, zpytela |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | 8.4 | Flags: | pm-rhel:
mirror+
|
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | No Doc Update | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-05-18 14:57:35 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Reproducible in 1minutetip: # yum -y install NetworkManager\* samba\* # reboot # ausearch -m avc -m user_avc -i The only SELinux denial that appears in permissive mode is:
----
type=USER_AVC msg=audit(12/12/2019 14:06:20.850:349) : pid=1 uid=root auid=unset ses=unset subj=system_u:system_r:init_t:s0 msg='avc: denied { status } for auid=unset uid=root gid=root path=/usr/lib/systemd/system/winbind.service cmdline="" scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:samba_unit_file_t:s0 tclass=service permissive=1 exe=/usr/lib/systemd/systemd sauid=root hostname=? addr=? terminal=?'
----
Same denial occurs when changing host name:
# yum install samba-winbind
# systemctl start winbind
# hostnamectl set-hostname hello
# ausearch -m USER_AVC
----
time->Mon Jan 6 09:26:15 2020
type=USER_AVC msg=audit(1578320775.851:299): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: denied { status } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/winbind.service" cmdline="" scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:samba_unit_file_t:s0 tclass=service permissive=0 exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
----
time->Mon Jan 6 09:26:15 2020
type=USER_AVC msg=audit(1578320775.867:300): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: denied { status } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/winbind.service" cmdline="" scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:samba_unit_file_t:s0 tclass=service permissive=0 exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
Also I see "access denied in journalctl":
Jan 06 09:26:15 ci-vm-10-0-137-193.hosted.upshift.rdu2.redhat.com dbus-daemon[671]: [system] Activating via systemd: service name='org.freedesktop.hostname1' unit='dbus-org.freedesktop.hostname1.service' requested by ':1.30' (uid=0 pid=5
371 comm="hostnamectl set-hostname hello " label="unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023")
Jan 06 09:26:15 ci-vm-10-0-137-193.hosted.upshift.rdu2.redhat.com systemd[1]: Starting Hostname Service...
Jan 06 09:26:15 ci-vm-10-0-137-193.hosted.upshift.rdu2.redhat.com dbus-daemon[671]: [system] Successfully activated service 'org.freedesktop.hostname1'
Jan 06 09:26:15 ci-vm-10-0-137-193.hosted.upshift.rdu2.redhat.com systemd[1]: Started Hostname Service.
Jan 06 09:26:15 hello systemd-hostnamed[5372]: Changed static host name to 'hello'
Jan 06 09:26:15 hello NetworkManager[746]: <info> [1578320775.8128] hostname: hostname changed from "ci-vm-10-0-137-193.hosted.upshift.rdu2.redhat.com" to "hello"
Jan 06 09:26:15 hello dbus-daemon[671]: [system] Activating via systemd: service name='org.freedesktop.nm_dispatcher' unit='dbus-org.freedesktop.nm-dispatcher.service' requested by ':1.8' (uid=0 pid=746 comm="/usr/sbin/NetworkManager --n
o-daemon " label="system_u:system_r:NetworkManager_t:s0")
Jan 06 09:26:15 hello systemd[1]: Starting Network Manager Script Dispatcher Service...
Jan 06 09:26:15 hello systemd-hostnamed[5372]: Changed host name to 'hello'
Jan 06 09:26:15 hello NetworkManager[746]: <info> [1578320775.8324] policy: set-hostname: set hostname to 'hello' (from system configuration)
Jan 06 09:26:15 hello dbus-daemon[671]: [system] Successfully activated service 'org.freedesktop.nm_dispatcher'
Jan 06 09:26:15 hello systemd[1]: Started Network Manager Script Dispatcher Service.
Jan 06 09:26:15 hello nm-dispatcher[5373]: Failed to retrieve unit state: Access denied
Jan 06 09:26:15 hello nm-dispatcher[5373]: Failed to retrieve unit state: Access denied
*** Bug 1817989 has been marked as a duplicate of this bug. *** *** Bug 1874929 has been marked as a duplicate of this bug. *** *** Bug 1879619 has been marked as a duplicate of this bug. *** Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2021:1639 |
Description of problem: Version-Release number of selected component (if applicable): NetworkManager-1.22.0-0.2.el8.x86_64 NetworkManager-adsl-1.22.0-0.2.el8.x86_64 NetworkManager-config-server-1.22.0-0.2.el8.noarch NetworkManager-libnm-1.22.0-0.2.el8.x86_64 NetworkManager-team-1.22.0-0.2.el8.x86_64 NetworkManager-tui-1.22.0-0.2.el8.x86_64 NetworkManager-wifi-1.22.0-0.2.el8.x86_64 samba-4.11.2-4.el8.x86_64 samba-client-4.11.2-4.el8.x86_64 samba-client-libs-4.11.2-4.el8.x86_64 samba-common-4.11.2-4.el8.noarch samba-common-libs-4.11.2-4.el8.x86_64 samba-common-tools-4.11.2-4.el8.x86_64 samba-libs-4.11.2-4.el8.x86_64 samba-winbind-4.11.2-4.el8.x86_64 samba-winbind-clients-4.11.2-4.el8.x86_64 samba-winbind-modules-4.11.2-4.el8.x86_64 selinux-policy-3.14.3-29.el8.noarch selinux-policy-devel-3.14.3-29.el8.noarch selinux-policy-doc-3.14.3-29.el8.noarch selinux-policy-minimum-3.14.3-29.el8.noarch selinux-policy-mls-3.14.3-29.el8.noarch selinux-policy-sandbox-3.14.3-29.el8.noarch selinux-policy-targeted-3.14.3-29.el8.noarch How reproducible: * multiple USER_AVCs after each reboot Actual results: ---- type=USER_AVC msg=audit(12/10/2019 16:44:20.803:166) : pid=1 uid=root auid=unset ses=unset subj=system_u:system_r:init_t:s0 msg='avc: denied { status } for auid=unset uid=root gid=root path=/usr/lib/systemd/system/winbind.service cmdline="" scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:samba_unit_file_t:s0 tclass=service permissive=0 exe=/usr/lib/systemd/systemd sauid=root hostname=? addr=? terminal=?' ---- Expected results: * no SELinux denials