Bug 1811556 - SELinux is preventing sssd from 'read' accesses on the directory resolve.
Summary: SELinux is preventing sssd from 'read' accesses on the directory resolve.
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 31
Hardware: x86_64
OS: Unspecified
medium
medium
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:60921a00e3064f93c9b12d8584e...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-03-09 08:45 UTC by Carlos Mogas da Silva
Modified: 2020-04-02 09:54 UTC (History)
6 users (show)

Fixed In Version: selinux-policy-3.14.4-50.fc31
Clone Of:
Environment:
Last Closed: 2020-04-02 09:54:45 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Carlos Mogas da Silva 2020-03-09 08:45:26 UTC
Description of problem:
Happens during startup
SELinux is preventing sssd from 'read' accesses on the directory resolve.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that sssd should be allowed read access on the resolve directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'sssd' --raw | audit2allow -M my-sssd
# semodule -X 300 -i my-sssd.pp

Additional Information:
Source Context                system_u:system_r:sssd_t:s0
Target Context                system_u:object_r:systemd_resolved_var_run_t:s0
Target Objects                resolve [ dir ]
Source                        sssd
Source Path                   sssd
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.14.4-49.fc31.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 5.5.7-200.fc31.x86_64 #1 SMP Fri
                              Feb 28 17:18:37 UTC 2020 x86_64 x86_64
Alert Count                   2
First Seen                    2020-03-09 08:43:22 WET
Last Seen                     2020-03-09 08:43:32 WET
Local ID                      cad31eae-cc88-4b34-a0d3-7e0664518ba3

Raw Audit Messages
type=AVC msg=audit(1583743412.664:249): avc:  denied  { read } for  pid=1036 comm="sssd" name="resolve" dev="tmpfs" ino=13512 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:systemd_resolved_var_run_t:s0 tclass=dir permissive=0


Hash: sssd,sssd_t,systemd_resolved_var_run_t,dir,read

Version-Release number of selected component:
selinux-policy-3.14.4-49.fc31.noarch

Additional info:
component:      selinux-policy
reporter:       libreport-2.12.0
hashmarkername: setroubleshoot
kernel:         5.5.7-200.fc31.x86_64
type:           libreport

Comment 1 Zdenek Pytela 2020-03-09 09:35:55 UTC
I've just submitted a Fedora PR to address the issue:

https://github.com/fedora-selinux/selinux-policy-contrib/pull/215

Comment 2 Lukas Vrabec 2020-03-09 11:34:20 UTC
commit 5406e9a4f4ae4a95e15fea717ccfa63fe4835264 (HEAD -> rawhide, origin/rawhide, origin/HEAD)
Author: Zdenek Pytela <zpytela>
Date:   Mon Mar 9 10:24:18 2020 +0100

    Allow sssd read systemd-resolved runtime directory
    
    Resolves: rhbz#1811556

Backported to Fedora 31 and 30.

Comment 3 Fedora Update System 2020-03-24 09:40:47 UTC
FEDORA-2020-5afc749ee7 has been pushed to the Fedora 31 testing repository.
In short time you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2020-5afc749ee7`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2020-5afc749ee7

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 4 Fedora Update System 2020-04-02 09:54:45 UTC
FEDORA-2020-5afc749ee7 has been pushed to the Fedora 31 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.