Bug 2231077 - avc found in saslauthd when running cyrus-imapd tests
Summary: avc found in saslauthd when running cyrus-imapd tests
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: cyrus-sasl
Version: 39
Hardware: Unspecified
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Jakub Jelen
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-08-10 13:34 UTC by František Hrdina
Modified: 2023-08-16 08:14 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Type: ---
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker FC-920 0 None None None 2023-08-10 13:35:44 UTC

Description František Hrdina 2023-08-10 13:34:14 UTC
AVC found on fedora-rawhide when running these cyrus-imapd tests

/CoreOS/cyrus-imapd/Security/CVE-2011-3481-cyrus-imapd-NULL-pointer-dereference-via-crafted
/CoreOS/cyrus-imapd/Regression/imapd-never-close-the-connect-to-the-client-upon
/CoreOS/cyrus-imapd/Sanity/basic

https://beaker.engineering.redhat.com/recipes/14401711#tasks

Package cyrus-sasl-plain-2.1.28-11.fc39.x86_64 is already installed.
Package cyrus-imapd-3.6.0-9.fc39.x86_64 is already installed.
Package cyrus-sasl-2.1.28-11.fc39.x86_64 is already installed.
Package net-tools-2.0-0.67.20160912git.fc39.x86_64 is already installed.
Package expect-5.45.4-20.fc39.x86_64 is already installed.



Reproducible: Always

Steps to Reproduce:
Running tests
/CoreOS/cyrus-imapd/Security/CVE-2011-3481-cyrus-imapd-NULL-pointer-dereference-via-crafted
/CoreOS/cyrus-imapd/Regression/imapd-never-close-the-connect-to-the-client-upon
/CoreOS/cyrus-imapd/Sanity/basic
Actual Results:  
tests fails with AVC

SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      33
selinux-policy-38.24-1.fc39.noarch
----
time->Thu Aug 10 08:38:55 2023
type=AVC msg=audit(1691671135.966:375): avc:  denied  { dac_read_search } for  pid=18853 comm="saslauthd" capability=2  scontext=system_u:system_r:saslauthd_t:s0 tcontext=system_u:system_r:saslauthd_t:s0 tclass=capability permissive=0
----
time->Thu Aug 10 08:38:55 2023
type=AVC msg=audit(1691671135.966:376): avc:  denied  { dac_override } for  pid=18853 comm="saslauthd" capability=1  scontext=system_u:system_r:saslauthd_t:s0 tcontext=system_u:system_r:saslauthd_t:s0 tclass=capability permissive=0
----
time->Thu Aug 10 08:38:56 2023
type=AVC msg=audit(1691671136.020:377): avc:  denied  { dac_read_search } for  pid=18853 comm="saslauthd" capability=2  scontext=system_u:system_r:saslauthd_t:s0 tcontext=system_u:system_r:saslauthd_t:s0 tclass=capability permissive=0
----
time->Thu Aug 10 08:38:56 2023
type=AVC msg=audit(1691671136.020:378): avc:  denied  { dac_override } for  pid=18853 comm="saslauthd" capability=1  scontext=system_u:system_r:saslauthd_t:s0 tcontext=system_u:system_r:saslauthd_t:s0 tclass=capability permissive=0
----
time->Thu Aug 10 08:38:56 2023
type=AVC msg=audit(1691671136.124:380): avc:  denied  { dac_read_search } for  pid=18853 comm="saslauthd" capability=2  scontext=system_u:system_r:saslauthd_t:s0 tcontext=system_u:system_r:saslauthd_t:s0 tclass=capability permissive=0
----
time->Thu Aug 10 08:38:56 2023
type=AVC msg=audit(1691671136.124:381): avc:  denied  { dac_override } for  pid=18853 comm="saslauthd" capability=1  scontext=system_u:system_r:saslauthd_t:s0 tcontext=system_u:system_r:saslauthd_t:s0 tclass=capability permissive=0

Expected Results:  
tests PASSED without AVC

Comment 1 Fedora Release Engineering 2023-08-16 08:14:12 UTC
This bug appears to have been reported against 'rawhide' during the Fedora Linux 39 development cycle.
Changing version to 39.


Note You need to log in before you can comment on or make changes to this bug.