Red Hat Bugzilla – Bug 195977
Targeted policy blocking TFTP daemon LDAP access
Last modified: 2007-11-30 17:11:35 EST
Description of problem:
Add the TFTP daemon /usr/sbin/in.tftpd to the list of programs that tries
to contact the LDAP server when nss_ldap is enabled. Voluminous audit
messages available on request.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Enable nss_ldap
2. Enable tftp
3. Attempt to retrieve a file via tftp
4. Watch attempt timeout
nss_ldap attempts to contact the LDAP server to get supplemental group
info for the 'nobody' user. SELinux denies connection.
Policy should allow connection (or see workaround below).
Workaround is to add 'nobody' to nss_initgroups_ignoreusers line in
Does it work even with the denial. IE If I just dontaudit the connection to
ldap will tftp still work?
(In reply to comment #1)
> Does it work even with the denial. IE If I just dontaudit the connection to
> ldap will tftp still work?
Nope. I was using it for PXE installations (does anyone use TFTP for anything
else?), and the system just sat there. Once I added 'nobody' to
nss_initgroups_ignoreusers things started working again. (Now there may an
argument that 'nobody' should be there by default; that's a question for the
Yes I talked to him about this, but I believe we would have the same problem
with NIS. So I think we need to allow the priv. Just kind of scary that you
need to give all these privs to an app just so it can fail to find nobody. We
could change tftp to not fail if initgroups fails...
I am reassiging to tftp, to stop it failing if the netgroups call fails.
Created attachment 131343 [details]
Suggested patch for when initgroups fails.
I think initgroups should fail over to using setgroups. That way SELinux does
not need to add lots of access.
(In reply to comment #3)
> Yes I talked to him about this, but I believe we would have the same problem
> with NIS. So I think we need to allow the priv. Just kind of scary that you
> need to give all these privs to an app just so it can fail to find nobody. We
> could change tftp to not fail if initgroups fails...
> I am reassiging to tftp, to stop it failing if the netgroups call fails.
Wouldn't the same argument apply to other daemons? xfs seems to be a fit the
bill -- bug #192555. Personally, I find this whole thing of network groups for
local users to be a bit dicey -- something that should probably be off by default.
I can confirm that this bug is fixed in selinux-policy-targeted-2.3.3-8.fc5.