Bug 2083509
| Summary: | samba-dcerpcd and samba rpcd programs need selinux-policy permissions | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Pavel Filipensky <pfilipen> | |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> | |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> | |
| Severity: | medium | Docs Contact: | ||
| Priority: | medium | |||
| Version: | 9.1 | CC: | dkarpele, lvrabec, mmalik, qe-baseos-security, ssekidde, zpytela | |
| Target Milestone: | rc | Keywords: | AutoVerified, Triaged | |
| Target Release: | 9.1 | Flags: | pm-rhel:
mirror+
|
|
| Hardware: | All | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | selinux-policy-34.1.34-1.el9 | Doc Type: | No Doc Update | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | 2083504 | |||
| : | 2083511 (view as bug list) | Environment: | ||
| Last Closed: | 2022-11-15 11:13:50 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | 2083504 | |||
| Bug Blocks: | 2083511 | |||
|
Description
Pavel Filipensky
2022-05-10 09:30:05 UTC
Steps to Reproduce:
1) get a RHEL-9.1 machine (targeted policy is active)
2) install the latest samba* packages (4.16.1-100.el9)
3) start the winbind service
4) search for SELinux denials
Following SELinux denial appears multiple times in enforcing mode:
----
type=PROCTITLE msg=audit(05/10/2022 09:49:34.292:416) : proctitle=/usr/libexec/samba/rpcd_lsad --configfile=/etc/samba/smb.conf --worker-group=4 --worker-index=5 --debuglevel=0
type=SYSCALL msg=audit(05/10/2022 09:49:34.292:416) : arch=x86_64 syscall=setgroups success=no exit=EPERM(Operation not permitted) a0=0x0 a1=0x0 a2=0x7f3e02e7042b a3=0x0 items=0 ppid=16774 pid=16784 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=rpcd_lsad exe=/usr/libexec/samba/rpcd_lsad subj=system_u:system_r:winbind_t:s0 key=(null)
type=AVC msg=audit(05/10/2022 09:49:34.292:416) : avc: denied { setgid } for pid=16784 comm=rpcd_lsad capability=setgid scontext=system_u:system_r:winbind_t:s0 tcontext=system_u:system_r:winbind_t:s0 tclass=capability permissive=0
----
# rpm -qa selinux\* \*samba\* | sort
python3-samba-4.16.1-100.el9.x86_64
samba-4.16.1-100.el9.x86_64
samba-client-libs-4.16.1-100.el9.x86_64
samba-common-4.16.1-100.el9.noarch
samba-common-libs-4.16.1-100.el9.x86_64
samba-common-tools-4.16.1-100.el9.x86_64
samba-libs-4.16.1-100.el9.x86_64
samba-winbind-4.16.1-100.el9.x86_64
samba-winbind-modules-4.16.1-100.el9.x86_64
selinux-policy-34.1.30-2.el9.noarch
selinux-policy-targeted-34.1.30-2.el9.noarch
#
Following SELinux denial appears in permissive mode:
----
type=PROCTITLE msg=audit(05/10/2022 09:54:47.582:459) : proctitle=/usr/libexec/samba/rpcd_lsad --configfile=/etc/samba/smb.conf --worker-group=5 --worker-index=5 --debuglevel=0
type=SYSCALL msg=audit(05/10/2022 09:54:47.582:459) : arch=x86_64 syscall=setgroups success=yes exit=0 a0=0x0 a1=0x0 a2=0x7fbd9328942b a3=0x0 items=0 ppid=16893 pid=16903 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=rpcd_lsad exe=/usr/libexec/samba/rpcd_lsad subj=system_u:system_r:winbind_t:s0 key=(null)
type=AVC msg=audit(05/10/2022 09:54:47.582:459) : avc: denied { setgid } for pid=16903 comm=rpcd_lsad capability=setgid scontext=system_u:system_r:winbind_t:s0 tcontext=system_u:system_r:winbind_t:s0 tclass=capability permissive=1
----
To backport:
commit 7367896085db099d956d666b94601fa9fc9df92a
Author: Zdenek Pytela <zpytela>
Date: Wed Jun 1 12:55:02 2022 +0200
Add support for samba-dcerpcd
Additional one:
commit 044ed83f8ebde938bbc49f6e071a8548ddc8505d (HEAD -> rawhide, upstream/rawhide)
Author: Zdenek Pytela <zpytela>
Date: Wed Jun 8 16:24:15 2022 +0200
Update policy for samba-dcerpcd
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:8283 |