Kaleem,

The krb5_0.rcache2 file has smbd_tmp_t type which does not seem to be correct. Do you know how this file was created?

(In reply to Zdenek Pytela from comment #1)
> Kaleem,
> 
> The krb5_0.rcache2 file has smbd_tmp_t type which does not seem to be
> correct. Do you know how this file was created?

I think this is needed in case of trust scenario with windows but putting needinfo on Alexander for confirming this.

I have seen this too. Well, if two daemons running under root use Kerberos, it is libkrb5 they use produces a replay cache in the same location. Who does it first, gets the label.

May be we shouldn't apply the per-app type to this specific file? May be we should make a type that is allowed to both apps?

This bug has not been acknowledged by the subsystem to be resolved during the RHEL 8.3 development and testing phase.
If you believe the decision needs to be reconsidered, please adjust severity accordingly and bring out justification.

Since this affects all RHEL IdM installations in the default configuration and wasn't a problem in RHEL 8.2, it is pretty much a regression and blocker from RHEL IdM point of view.

We need to have this fixed before the issue gets to produce increase of customer cases.

I've submitted a Fedora PR to address the issue:
https://github.com/fedora-selinux/selinux-policy-contrib/pull/312

*** Bug 1857253 has been marked as a duplicate of this bug. ***

*** Bug 1847221 has been marked as a duplicate of this bug. ***

Zdenek, 

The scenario I mentioned in #26 is still failing. I see that smbd creates /var/tmp/krb5_0.rcache2 with type krb5_host_rcache_t but sshd still creates it with type user_tmp_t.

# rpm -q selinux-policy
selinux-policy-3.14.3-51.el8.noarch

Here is my test:
Setup:
=====
hostnamectl set-hostname master.test.ipa
dnf module reset idm -y
dnf module enable -y idm:DL1/dns
dnf install -y ipa-server-dns ipa-server-trust-ad samba-client
systemctl stop firewalld
ipa-server-install -a Secret123 -p Secret123 --setup-dns --auto-forwarders -n test.ipa -U -r TEST.IPA
echo Secret123 | kinit admin
ipa-adtrust-install -a Secret123 --add-sids -U
mkdir /bz1073829
chcon -t samba_share_t /bz1073829
setfacl -m g:admins:rwx /bz1073829
net conf setparm 'share' 'comment' 'Trust test share'
net conf setparm 'share' 'read only' 'no'
net conf setparm 'share' 'path' '/bz1073829'


Test1 (fails):
======
# rm /var/tmp/krb5_0.rcache2  -f
# ssh admin@`hostname` whoami
admin
# ls -lZ  /var/tmp/krb5_0.rcache2
-rw-------. 1 root root system_u:object_r:user_tmp_t:s0 3008 Aug 11 13:02 /var/tmp/krb5_0.rcache2
# smbclient -k //master.test.ipa/share -c dir
lp_load_ex: changing to config backend registry
gse_get_client_auth_token: gss_init_sec_context failed with [Unspecified GSS failure.  Minor code may provide more information: Generic error (see e-text)](2529638972)
gensec_spnego_client_negTokenTarg_step: SPNEGO(gse_krb5) login failed: NT_STATUS_LOGON_FAILURE
session setup failed: NT_STATUS_LOGON_FAILURE

Test2 (pass):
======
# rm /var/tmp/krb5_0.rcache2  -f
# smbclient -k //master.test.ipa/share -c dir
lp_load_ex: changing to config backend registry
  .                                   D        0  Tue Aug 11 12:53:06 2020
  ..                                  D        0  Tue Aug 11 12:53:06 2020

		20960236 blocks of size 1024. 18028512 blocks available
# ls -lZ  /var/tmp/krb5_0.rcache2
-rw-------. 1 root root system_u:object_r:krb5_host_rcache_t:s0 16032 Aug 11 13:05 /var/tmp/krb5_0.rcache2
# ssh admin@`hostname` whoami
admin
# ls -lZ  /var/tmp/krb5_0.rcache2
-rw-------. 1 root root system_u:object_r:krb5_host_rcache_t:s0 16032 Aug 11 13:05 /var/tmp/krb5_0.rcache2


I do not see AVC failures after Test1, but if I disable dontaudit and repeat the test, I see this:

time->Tue Aug 11 13:09:23 2020
type=PROCTITLE msg=audit(1597165763.137:1062): proctitle=2F7573722F7362696E2F736D6264002D2D666F726567726F756E64002D2D6E6F2D70726F636573732D67726F7570
type=SYSCALL msg=audit(1597165763.137:1062): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=55fdcbd0d010 a2=20042 a3=180 items=0 ppid=14373 pid=15255 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="smbd" exe="/usr/sbin/smbd" subj=system_u:system_r:smbd_t:s0 key=(null)
type=AVC msg=audit(1597165763.137:1062): avc:  denied  { write } for  pid=15255 comm="smbd" name="krb5_0.rcache2" dev="vda1" ino=582881 scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:user_tmp_t:s0 tclass=file permissive=0

If sshd can be the first to create the rcache file, then yes, this permission was missing.
https://github.com/fedora-selinux/selinux-policy/pull/406

Sergey, do we have any test available to run before respin?

Zdenek, 
You can use tests from #33, they cover two scenarios - when sshd creates keytab first and when smbd does the same.
I just checked them and they do work on newlly provisione VM without any modifications. Just ignore "Could not chdir to home directory" in output of ssh command.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:4528