Bug 1824823
| Summary: | sssd p11_child avc name_connect denied for unreserved_port_t | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Scott Poore <spoore> | |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> | |
| Status: | CLOSED WONTFIX | QA Contact: | Milos Malik <mmalik> | |
| Severity: | unspecified | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 7.8 | CC: | lvrabec, mmalik, plautrba, sbose, ssekidde, vmojzis, zpytela | |
| Target Milestone: | rc | |||
| Target Release: | --- | |||
| Hardware: | Unspecified | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1826748 (view as bug list) | Environment: | ||
| Last Closed: | 2020-04-21 16:38:16 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1826748 | |||
It seems that the nis_enabled boolean was disabled. # getsebool nis_enabled Could you enable the boolean and re-run your scenario? # setsebool -P nis_enabled on Yes that works: [root@ipaclient1 ~]# !su su - ipauser1 -c 'su - ipauser1 -c whoami' Password: su: Authentication failure [root@ipaclient1 ~]# setsebool -P nis_enabled on [root@ipaclient1 ~]# su - ipauser1 -c 'su - ipauser1 -c whoami' PIN for kdcuser2 (kdcuser2) ipauser1 However, nis_enabled appears to set a LOT of allow rules not related to SSSD: [root@ipaclient1 ~]# sesearch -b nis_enabled -A|grep -v sssd|wc -l 3795 That's why I was hesitant to set that initially. So, is that the best solution here or can we get something that enables much less? This issue was not selected to be included in Red Hat Enterprise Linux 7 because it is seen either as low or moderate impact to a small number of use-cases. Red Hat Enterprise Linux 7 is in Maintenance Support 1 Phase, which means that qualified Critical and Important Security errata advisories (RHSAs) and Urgent Priority Bug Fix errata advisories (RHBAs) may be released as they become available. We will now close this issue, but if you believe that it qualifies for the Maintenance Support 1 Phase, please re-open; otherwise, we recommend moving the request to Red Hat Enterprise Linux 8 if applicable. Along with a change made to any service configuration, SELinux configuration needs to be adjusted, too: After the change is made and the new ldap port number is already known, assign a label to the picked port. For the 20389/tcp port in the example, use a command like this: # semanage port -a -t ldap_port_t -p tcp 20389 This change is permanent. Alternatively, you can also create a custom policy module to allow sssd access to an attribute assigned to a group of ports. The most complete set is port_type, but also other sets can be used. Hi Lukas, hi Zdenek, thanks for your comments and workarounds, I think for RHEL7 this is fine. Do I understand correctly from Milos' comment #2 that 'setsebool -P nis_enabled on' would be a valid workaround as well, only that it allows even more acccess than the more specific 'semanage port -a -t ldap_port_t -p tcp 20389' ? bye, Sumit Sumit, You were right the nis_enabled boolean allows too much of additional rules, but can be considered as a workaround or a valid solution, depending on the use case. The recommended solution is to tailor the allow rule exactly to the change made to the configuration of a service, in this case the semanage port command. |
Description of problem: During Smart Card authentication with sssd, the p11_child process tries to connect to the OCSP responder to verify the certificates, and fails. After some investigation, I can see this AVC: ---- time->Thu Apr 16 08:56:17 2020 type=PROCTITLE msg=audit(1587045377.163:13504): proctitle=2F7573722F6C6962657865632F737373642F7031315F6368696C64002D2D64656275672D6D6963726F7365636F6E64733D30002D2D64656275672D74696D657374616D70733D31002D2D64656275672D66643D3139002D2D64656275672D6C6576656C3D307866376630002D2D707265002D2D6E73736462002F6574632F706B type=SYSCALL msg=audit(1587045377.163:13504): arch=c000003e syscall=42 success=no exit=-13 a0=8 a1=7ffea7445590 a2=10 a3=b items=0 ppid=15650 pid=15887 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="p11_child" exe="/usr/libexec/sssd/p11_child" subj=system_u:system_r:sssd_t:s0 key=(null) type=AVC msg=audit(1587045377.163:13504): avc: denied { name_connect } for pid=15887 comm="p11_child" dest=20080 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket permissive=0 Version-Release number of selected component (if applicable): sssd-1.16.4-37.el7.x86_64 selinux-policy-3.13.1-266.el7.noarch How reproducible: Always. Steps to Reproduce: 1. Setup IPA Server and Client for Smart Card Authentication 2. Using Smart Card with certificates from another CA with OCSP defined using an unreserved port 3. Attempt to authenticate (can use su): su - ipauser1 -c 'su - ipauser1 -c whoami' 4. Check for AVCs Actual results: Prompts for password instead of PIN Shows AVC above Expected results: Prompts for PIN and no AVCs. Additional info: