Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
DescriptionChristian Heimes
2023-07-17 10:02:14 UTC
Description of problem:
I'm getting an SELinux violation every time I attempt to log in with an external IdP user account: "SELinux is preventing /usr/libexec/sssd/oidc_child from using the dac_override capability."
Version-Release number of selected component (if applicable):
selinux-policy-38.1.11-2.el9_2.3.noarch
sssd-idp-2.8.2-2.el9.x86_64
ipa-server-4.10.1-7.el9_2.x86_64
How reproducible:
always
Steps to Reproduce:
1. Install IPA server on RHEL 9.2
2. Configure an external IdP provider
3. Add user account and configure it for external IdP auth
4. kinit -n -c armor
5. kinit -T armor username
Actual results:
/usr/lib/systemd/system/ipa-otpd@.service:10: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing th>
Created slice Slice /system/ipa-otpd.
Started ipa-otpd service (PID 40758/UID 0).
LDAP: ldapi://%2Frun%2Fslapd-IPAHCC-TEST.socket
cheimes: request received
cheimes: user query start
cheimes: user query end: uid=cheimes,cn=users,cn=accounts,dc=ipahcc,dc=test
cheimes: idp query start: cn=stage sso,cn=idp,dc=ipahcc,dc=test
cheimes: idp query end: stage sso
cheimes: oauth2 start: Get device code
Starting SETroubleshoot daemon for processing new SELinux denial logs...
Started SETroubleshoot daemon for processing new SELinux denial logs.
cheimes: Received: []
oauth2.c:088: Child finished with status [1].
cheimes: sent: 0 data: 20
cheimes: ..sent: 20 data: 20
cheimes: response sent: Access-Reject
Socket closed, shutting down...
ipa-otpd: Deactivated successfully.
Started dbus-:1.1-org.fedoraproject.SetroubleshootPrivileged.
SELinux is preventing /usr/libexec/sssd/oidc_child from using the dac_read_search capability. For complete SELinux messages run: sealert -l f8cb10de-e375-487b-b4ad-ec9a41f7dff3
# sealert -l f8cb10de-e375-487b-b4ad-ec9a41f7dff3
SELinux is preventing /usr/libexec/sssd/oidc_child from using the dac_read_search capability.
***** Plugin dac_override (91.4 confidence) suggests **********************
If you want to help identify if domain needs this access or you have a file with the wrong permissions on your system
Then turn on full auditing to get path information about the offending file and generate the error again.
Do
Turn on full auditing
# auditctl -w /etc/shadow -p w
Try to recreate AVC. Then execute
# ausearch -m avc -ts recent
If you see PATH record check ownership/permissions on file, and fix it,
otherwise report as a bugzilla.
***** Plugin catchall (9.59 confidence) suggests **************************
If you believe that oidc_child should have the dac_read_search capability by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'oidc_child' --raw | audit2allow -M my-oidcchild
# semodule -X 300 -i my-oidcchild.pp
Additional Information:
Source Context system_u:system_r:ipa_otpd_t:s0
Target Context system_u:system_r:ipa_otpd_t:s0
Target Objects Unknown [ capability ]
Source oidc_child
Source Path /usr/libexec/sssd/oidc_child
Port <Unknown>
Host server. .test
Source RPM Packages sssd-idp-2.8.2-2.el9.x86_64
Target RPM Packages
SELinux Policy RPM selinux-policy-targeted-38.1.11-2.el9_2.3.noarch
Local Policy RPM ipa-selinux-4.10.1-7.el9_2.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Permissive
Host Name server.ipahcc
Platform Linux server.ipahcc
5.14.0-284.21.1.el9_2.x86_64 #1 SMP
PREEMPT_DYNAMIC Thu Jun 22 09:53:03 EDT 2023
x86_64 x86_64
Alert Count 9
First Seen 2023-07-17 05:15:26 EDT
Last Seen 2023-07-17 05:18:04 EDT
Local ID f8cb10de-e375-487b-b4ad-ec9a41f7dff3
Raw Audit Messages
type=AVC msg=audit(1689585484.18:7276): avc: denied { dac_read_search } for pid=77100 comm="oidc_child" capability=2 scontext=system_u:system_r:ipa_otpd_t:s0 tcontext=system_u:system_r:ipa_otpd_t:s0 tclass=capability permissive=1
type=SYSCALL msg=audit(1689585484.18:7276): arch=x86_64 syscall=openat success=yes exit=E2BIG a0=ffffff9c a1=7fc876bb99d1 a2=80000 a3=0 items=0 ppid=77099 pid=77100 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=oidc_child exe=/usr/libexec/sssd/oidc_child subj=system_u:system_r:ipa_otpd_t:s0 key=(null)
Hash: oidc_child,ipa_otpd_t,ipa_otpd_t,capability,dac_read_search
# ausearch -c 'oidc_child'
----
time->Mon Jul 17 05:17:33 2023
type=PROCTITLE msg=audit(1689585453.953:7268): proctitle=2F7573722F6C6962657865632F737373642F6F6964635F6368696C64002D2D6765742D6465766963652D636F6465002D2D6465766963652D617574682D656E64706F696E740068747470733A2F2F73736F2E73746167652E7265646861742E636F6D2F617574682F7265616C6D732F7265646861742D65787465726E616C2F70
type=SYSCALL msg=audit(1689585453.953:7268): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7fcce8fb99d1 a2=80000 a3=0 items=0 ppid=77081 pid=77082 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="oidc_child" exe="/usr/libexec/sssd/oidc_child" subj=system_u:system_r:ipa_otpd_t:s0 key=(null)
type=AVC msg=audit(1689585453.953:7268): avc: denied { dac_override } for pid=77082 comm="oidc_child" capability=1 scontext=system_u:system_r:ipa_otpd_t:s0 tcontext=system_u:system_r:ipa_otpd_t:s0 tclass=capability permissive=0
type=AVC msg=audit(1689585453.953:7268): avc: denied { dac_read_search } for pid=77082 comm="oidc_child" capability=2 scontext=system_u:system_r:ipa_otpd_t:s0 tcontext=system_u:system_r:ipa_otpd_t:s0 tclass=capability permissive=0
----
time->Mon Jul 17 05:18:04 2023
type=PROCTITLE msg=audit(1689585484.018:7276): proctitle=2F7573722F6C6962657865632F737373642F6F6964635F6368696C64002D2D6765742D6465766963652D636F6465002D2D6465766963652D617574682D656E64706F696E740068747470733A2F2F73736F2E73746167652E7265646861742E636F6D2F617574682F7265616C6D732F7265646861742D65787465726E616C2F70
type=SYSCALL msg=audit(1689585484.018:7276): arch=c000003e syscall=257 success=yes exit=7 a0=ffffff9c a1=7fc876bb99d1 a2=80000 a3=0 items=0 ppid=77099 pid=77100 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="oidc_child" exe="/usr/libexec/sssd/oidc_child" subj=system_u:system_r:ipa_otpd_t:s0 key=(null)
type=AVC msg=audit(1689585484.018:7276): avc: denied { dac_read_search } for pid=77100 comm="oidc_child" capability=2 scontext=system_u:system_r:ipa_otpd_t:s0 tcontext=system_u:system_r:ipa_otpd_t:s0 tclass=capability permissive=1
Expected results:
Additional info:
Description of problem: I'm getting an SELinux violation every time I attempt to log in with an external IdP user account: "SELinux is preventing /usr/libexec/sssd/oidc_child from using the dac_override capability." Version-Release number of selected component (if applicable): selinux-policy-38.1.11-2.el9_2.3.noarch sssd-idp-2.8.2-2.el9.x86_64 ipa-server-4.10.1-7.el9_2.x86_64 How reproducible: always Steps to Reproduce: 1. Install IPA server on RHEL 9.2 2. Configure an external IdP provider 3. Add user account and configure it for external IdP auth 4. kinit -n -c armor 5. kinit -T armor username Actual results: /usr/lib/systemd/system/ipa-otpd@.service:10: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing th> Created slice Slice /system/ipa-otpd. Started ipa-otpd service (PID 40758/UID 0). LDAP: ldapi://%2Frun%2Fslapd-IPAHCC-TEST.socket cheimes: request received cheimes: user query start cheimes: user query end: uid=cheimes,cn=users,cn=accounts,dc=ipahcc,dc=test cheimes: idp query start: cn=stage sso,cn=idp,dc=ipahcc,dc=test cheimes: idp query end: stage sso cheimes: oauth2 start: Get device code Starting SETroubleshoot daemon for processing new SELinux denial logs... Started SETroubleshoot daemon for processing new SELinux denial logs. cheimes: Received: [] oauth2.c:088: Child finished with status [1]. cheimes: sent: 0 data: 20 cheimes: ..sent: 20 data: 20 cheimes: response sent: Access-Reject Socket closed, shutting down... ipa-otpd: Deactivated successfully. Started dbus-:1.1-org.fedoraproject.SetroubleshootPrivileged. SELinux is preventing /usr/libexec/sssd/oidc_child from using the dac_read_search capability. For complete SELinux messages run: sealert -l f8cb10de-e375-487b-b4ad-ec9a41f7dff3 # sealert -l f8cb10de-e375-487b-b4ad-ec9a41f7dff3 SELinux is preventing /usr/libexec/sssd/oidc_child from using the dac_read_search capability. ***** Plugin dac_override (91.4 confidence) suggests ********************** If you want to help identify if domain needs this access or you have a file with the wrong permissions on your system Then turn on full auditing to get path information about the offending file and generate the error again. Do Turn on full auditing # auditctl -w /etc/shadow -p w Try to recreate AVC. Then execute # ausearch -m avc -ts recent If you see PATH record check ownership/permissions on file, and fix it, otherwise report as a bugzilla. ***** Plugin catchall (9.59 confidence) suggests ************************** If you believe that oidc_child should have the dac_read_search capability by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'oidc_child' --raw | audit2allow -M my-oidcchild # semodule -X 300 -i my-oidcchild.pp Additional Information: Source Context system_u:system_r:ipa_otpd_t:s0 Target Context system_u:system_r:ipa_otpd_t:s0 Target Objects Unknown [ capability ] Source oidc_child Source Path /usr/libexec/sssd/oidc_child Port <Unknown> Host server. .test Source RPM Packages sssd-idp-2.8.2-2.el9.x86_64 Target RPM Packages SELinux Policy RPM selinux-policy-targeted-38.1.11-2.el9_2.3.noarch Local Policy RPM ipa-selinux-4.10.1-7.el9_2.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name server.ipahcc Platform Linux server.ipahcc 5.14.0-284.21.1.el9_2.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Jun 22 09:53:03 EDT 2023 x86_64 x86_64 Alert Count 9 First Seen 2023-07-17 05:15:26 EDT Last Seen 2023-07-17 05:18:04 EDT Local ID f8cb10de-e375-487b-b4ad-ec9a41f7dff3 Raw Audit Messages type=AVC msg=audit(1689585484.18:7276): avc: denied { dac_read_search } for pid=77100 comm="oidc_child" capability=2 scontext=system_u:system_r:ipa_otpd_t:s0 tcontext=system_u:system_r:ipa_otpd_t:s0 tclass=capability permissive=1 type=SYSCALL msg=audit(1689585484.18:7276): arch=x86_64 syscall=openat success=yes exit=E2BIG a0=ffffff9c a1=7fc876bb99d1 a2=80000 a3=0 items=0 ppid=77099 pid=77100 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=oidc_child exe=/usr/libexec/sssd/oidc_child subj=system_u:system_r:ipa_otpd_t:s0 key=(null) Hash: oidc_child,ipa_otpd_t,ipa_otpd_t,capability,dac_read_search # ausearch -c 'oidc_child' ---- time->Mon Jul 17 05:17:33 2023 type=PROCTITLE msg=audit(1689585453.953:7268): proctitle=2F7573722F6C6962657865632F737373642F6F6964635F6368696C64002D2D6765742D6465766963652D636F6465002D2D6465766963652D617574682D656E64706F696E740068747470733A2F2F73736F2E73746167652E7265646861742E636F6D2F617574682F7265616C6D732F7265646861742D65787465726E616C2F70 type=SYSCALL msg=audit(1689585453.953:7268): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7fcce8fb99d1 a2=80000 a3=0 items=0 ppid=77081 pid=77082 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="oidc_child" exe="/usr/libexec/sssd/oidc_child" subj=system_u:system_r:ipa_otpd_t:s0 key=(null) type=AVC msg=audit(1689585453.953:7268): avc: denied { dac_override } for pid=77082 comm="oidc_child" capability=1 scontext=system_u:system_r:ipa_otpd_t:s0 tcontext=system_u:system_r:ipa_otpd_t:s0 tclass=capability permissive=0 type=AVC msg=audit(1689585453.953:7268): avc: denied { dac_read_search } for pid=77082 comm="oidc_child" capability=2 scontext=system_u:system_r:ipa_otpd_t:s0 tcontext=system_u:system_r:ipa_otpd_t:s0 tclass=capability permissive=0 ---- time->Mon Jul 17 05:18:04 2023 type=PROCTITLE msg=audit(1689585484.018:7276): proctitle=2F7573722F6C6962657865632F737373642F6F6964635F6368696C64002D2D6765742D6465766963652D636F6465002D2D6465766963652D617574682D656E64706F696E740068747470733A2F2F73736F2E73746167652E7265646861742E636F6D2F617574682F7265616C6D732F7265646861742D65787465726E616C2F70 type=SYSCALL msg=audit(1689585484.018:7276): arch=c000003e syscall=257 success=yes exit=7 a0=ffffff9c a1=7fc876bb99d1 a2=80000 a3=0 items=0 ppid=77099 pid=77100 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="oidc_child" exe="/usr/libexec/sssd/oidc_child" subj=system_u:system_r:ipa_otpd_t:s0 key=(null) type=AVC msg=audit(1689585484.018:7276): avc: denied { dac_read_search } for pid=77100 comm="oidc_child" capability=2 scontext=system_u:system_r:ipa_otpd_t:s0 tcontext=system_u:system_r:ipa_otpd_t:s0 tclass=capability permissive=1 Expected results: Additional info: