Bug 2026598

Description of problem:

Confined users mapped to user_u or staff_u cannot execute Kerberos related commands such as "kinit", "klist" or "kdestroy", which prevents proper authentication from happening.
This happens in non-SSSD configurations, typically when Kerberized NFS is used.

See also RHEL7 BZ #2026593.

2 kind of AVCs are seen on RHEL7:

- three related to reading /etc/keytab (krb5_keytab_t context)

  -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
  avc:  denied  { open } for  pid=8521 comm=klist path=/etc/krb5.keytab dev="dm-0" ino=139801 scontext=staff_u:staff_r:staff_t:s0 tcontext=system_u:object_r:krb5_keytab_t:s0 tclass=file
  avc:  denied  { open } for  pid=8521 comm=klist path=/etc/krb5.keytab dev="dm-0" ino=139801 scontext=staff_u:staff_r:staff_t:s0 tcontext=system_u:object_r:krb5_keytab_t:s0 tclass=file
  avc:  denied  { lock } for  pid=8521 comm=klist path=/etc/krb5.keytab dev="dm-0" ino=139801 scontext=staff_u:staff_r:staff_t:s0 tcontext=system_u:object_r:krb5_keytab_t:s0 tclass=file
  -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

- three related to reading keys labeled with gssd_t

  -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
  avc:  denied  { read } for  pid=7896 comm=kinit scontext=staff_u:staff_r:staff_t:s0 tcontext=system_u:system_r:gssd_t:s0 tclass=key
  avc:  denied  { view } for  pid=7896 comm=kinit scontext=staff_u:staff_r:staff_t:s0 tcontext=system_u:system_r:gssd_t:s0 tclass=key
  avc:  denied  { write } for  pid=7896 comm=kinit scontext=staff_u:staff_r:staff_t:s0 tcontext=system_u:system_r:gssd_t:s0 tclass=key
  -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

I don't have a RHEL8 setup to test, but comparing the RHEL7 and RHEL8 policy I can already state that this doesn't work fully on RHEL8 as well.
In particular:

- the "gssd_t" AVCs WILL HAPPEN on RHEL8 for all users since RHEL8 has no rules as well
- the "krb5_keytab_t" AVCs won't happen for "user_t" and "staff_t", but WILL HAPPEN for "auditadm_t" and "secadm_t" users


Version-Release number of selected component (if applicable):

selinux-policy-3.14.3-80.el8.noarch


How reproducible:

Not tested yet, I don't have a local reproducer.


Steps to Reproduce:
1. Setup a Kerberized NFS server
2. On a NFS client system, setup Kerberos for authentication


Additional info:

By comparing RHEL7 and RHEL8 policies and doing BZ #2026593 analysis, I was able to come with the following custom module:

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
policy_module(local_users_kerberos, 1.0)

gen_require(`
    type auditadm_t, secadm_t, staff_t, sysadm_t, user_t ;
    attribute sudodomain, su_domain_type ;
')

# Allow users to read keytab file (klist)
kerberos_read_keytab(auditadm_t)
kerberos_read_keytab(secadm_t)

# Allow users to write keys (kinit, klist, kdestroy)
rpc_rw_gssd_keys(auditadm_t)
rpc_rw_gssd_keys(secadm_t)
rpc_rw_gssd_keys(staff_t)
rpc_rw_gssd_keys(sysadm_t)
rpc_rw_gssd_keys(user_t)
rpc_rw_gssd_keys(sudodomain)
rpc_rw_gssd_keys(su_domain_type)
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------