Bug 2114902
| Summary: | selinux-policy AVC denials during ipa trust-add | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | anuja <amore> | |
| Component: | selinux-policy | Assignee: | Nikola Knazekova <nknazeko> | |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Milos Malik <mmalik> | |
| Severity: | medium | Docs Contact: | ||
| Priority: | medium | |||
| Version: | 9.1 | CC: | frenaud, lvrabec, mmalik, nknazeko, rcritten, ssekidde, tscherf, zpytela | |
| Target Milestone: | rc | Keywords: | Reopened, Triaged | |
| Target Release: | 9.2 | Flags: | pm-rhel:
mirror+
|
|
| Hardware: | Unspecified | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | No Doc Update | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | 2106006 | |||
| : | 2117199 2168961 (view as bug list) | Environment: | ||
| Last Closed: | 2023-02-10 18:04:35 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | 2115691 | |||
| Bug Blocks: | 2168961 | |||
|
Description
anuja
2022-08-03 13:39:09 UTC
The same problem was reported in bz#2102084 and is expected be fixed. * Fri Jul 15 2022 Nikola Knazekova <nknazeko> - 34.1.38-1 - Allow some domains use sd_notify() Resolves: rhbz#2056565 - Revert "Allow rabbitmq to use systemd notify" Resolves: rhbz#2056565 - Update winbind_rpcd_t Resolves: rhbz#2102084 ^^^ Can you ensure the latest policy was used? What are the AVC denials? In pipeline we are using [root@master ~]# rpm -qa ipa-server selinux-policy selinux-policy-34.1.38-1.el9.noarch ipa-server-4.10.0-5.el9.x86_64 avc logs and steps are attached. Reported new bug in upstream fedora36 for new AVC failures https://bugzilla.redhat.com/show_bug.cgi?id=2115691 Hi frenaud, the fix was based on reported AVC messages from Anuja. Nothing has changed in our policy. Feel free to close it. Reopening as the failure happens on RHEL 9.1
# rpm -qa ipa-server ipa-selinux selinux-policy
selinux-policy-34.1.43-1.el9_1.1.noarch
ipa-selinux-4.10.0-8.el9_1.noarch
ipa-server-4.10.0-8.el9_1.x86_64
It looks like one patch was not backported to RHEL 9.1:
# sesearch --source smbd_t --target winbind_rpcd_t --allow
allow domain domain:fd use; [ domain_fd_use ]:True
allow domain domain:key { link search };
allow smbd_t winbind_rpcd_t:process transition;
allow smbd_t winbind_rpcd_t:unix_stream_socket connectto;
On RHEL 9.2 (where the test is succeeding), the same command shows:
# sesearch --source smbd_t --target winbind_rpcd_t --allow
allow domain domain:anon_inode { create getattr ioctl map read write };
allow domain domain:fd use; [ domain_fd_use ]:True
allow domain domain:key { link search };
allow smbd_t winbind_rpcd_t:process { noatsecure transition }; <<<< This is the missing patch
allow smbd_t winbind_rpcd_t:unix_stream_socket connectto;
If I add the following module on RHEL 9.1, the test passes:
(allow smbd_t winbind_rpcd_t (process (noatsecure)))
Moving to selinux-policy component.
Justification for z-stream request: this issue prevents using the trust feature in selinux enforcing mode. This feature is important to many IdM customers and RHEL 9.1 is the most recent version available on RHEL 9. |