Red Hat Bugzilla – Bug 185433
SELinux denying nscd access to system config files
Last modified: 2007-11-30 17:07:23 EST
Description of problem:
(This RFE applies to nscd, not glibc as a whole.) Several times we've had
system config files end up with incorrect SELinux security contexts. This tends
to cause a number of problems with name resolution if nscd is running, since
SELinux denies nscd permission to access the files.
The system could be made more resilient and could automatically correct these
errors if /etc/init.d/nscd would automatically call restorecon on the
appropriate config files (/etc/resolv.conf, /etc/nsswitch.conf, /etc/ldap.conf,
possibly others) before starting nscd.
Alternatively or additionally, nscd should be noisier about complaining if it
can't read its config files.
Version-Release number of selected component (if applicable):
always (if files are labelled incorrectly)
Steps to Reproduce:
1. Create /etc/resolv.conf with an incorrect security context.
2. Restart nscd.
"getent hosts" doesn't work.
System recognizes error and either fixes it or complains loudly about it.
That's a bad idea. Running restorecon would only unnecessarily slow
nscd startup down in the 99.99% cases where files are properly labeled.
Audit messages if SELinux denies access to some file are IMHO quite informative.
I thought that restorecon runs quickly enough, and nscd is started rarely
enough, that a small delay would be acceptable in order to prevent certain
classes of errors.
I noticed that Red Hat takes a similar approach for other services now - ldap,
dhcp, and httpd all perform certain checks before starting or restarting in
order to cut down on configuration errors. Since nscd is a core system
component, I thought it would be worth taking the same approach here.
I don't think that the system is as informative as it should be when trying to
diagnose these kinds of errors - nscd gives no error messages to the console or
syslog, name lookups comes back negative rather than failing with any sort of
error message, name resolution works when nscd isn't running but fails when it
is (I wouldn't expect a cache to alter behavior in this manner). The audit
messages are informative, but I may not check the syslog immediately in case of
an error, and the audit messages are only logged at boot (which may be due to
some other bug on my system).
I'd like to see RHEL make it easier to diagnose or prevent this condition. If
calling restorecon in /etc/init.d/nscd isn't the way to do it, then could I log
an RFE for what I perceive as some of the other problems that I listed above
(lack of messages from nscd, name lookups coming back negative instead of