Description of problem: Add the TFTP daemon /usr/sbin/in.tftpd to the list of programs that tries to contact the LDAP server when nss_ldap is enabled. Voluminous audit messages available on request. Version-Release number of selected component (if applicable): selinux-policy-targeted-2.2.43-4.fc5 How reproducible: 100% Steps to Reproduce: 1. Enable nss_ldap 2. Enable tftp 3. Attempt to retrieve a file via tftp 4. Watch attempt timeout Actual results: nss_ldap attempts to contact the LDAP server to get supplemental group info for the 'nobody' user. SELinux denies connection. Expected results: Policy should allow connection (or see workaround below). Additional info: Workaround is to add 'nobody' to nss_initgroups_ignoreusers line in /etc/ldap.conf.
Does it work even with the denial. IE If I just dontaudit the connection to ldap will tftp still work?
(In reply to comment #1) > Does it work even with the denial. IE If I just dontaudit the connection to > ldap will tftp still work? Nope. I was using it for PXE installations (does anyone use TFTP for anything else?), and the system just sat there. Once I added 'nobody' to nss_initgroups_ignoreusers things started working again. (Now there may an argument that 'nobody' should be there by default; that's a question for the nss_ldap guys.)
Yes I talked to him about this, but I believe we would have the same problem with NIS. So I think we need to allow the priv. Just kind of scary that you need to give all these privs to an app just so it can fail to find nobody. We could change tftp to not fail if initgroups fails... I am reassiging to tftp, to stop it failing if the netgroups call fails.
Created attachment 131343 [details] Suggested patch for when initgroups fails. I think initgroups should fail over to using setgroups. That way SELinux does not need to add lots of access.
(In reply to comment #3) > Yes I talked to him about this, but I believe we would have the same problem > with NIS. So I think we need to allow the priv. Just kind of scary that you > need to give all these privs to an app just so it can fail to find nobody. We > could change tftp to not fail if initgroups fails... > > I am reassiging to tftp, to stop it failing if the netgroups call fails. Wouldn't the same argument apply to other daemons? xfs seems to be a fit the bill -- bug #192555. Personally, I find this whole thing of network groups for local users to be a bit dicey -- something that should probably be off by default.
I can confirm that this bug is fixed in selinux-policy-targeted-2.3.3-8.fc5.
Closing bugs