Getting the following AVC when trying to harden dirsrv service units by setting NoNewPrivileges and MemoryDenyWriteExecute:



type=AVC msg=audit(1775741107.400:9691): avc:  denied  { nnp_transition } for  pid=980206 comm="(ns-slapd)" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:dirsrv_t:s0 tclass=process2 permissive=0
type=AVC msg=audit(1775833368.436:10776): avc:  denied  { nnp_transition } for  pid=1113882 comm="(ap-agent)" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:dirsrv_snmp_t:s0 tclass=process2 permissive=0
type=AVC msg=audit(1775833368.442:10778): avc:  denied  { read } for  pid=1113882 comm="ldap-agent" name="ldap-agent.conf" dev="dm-0" ino=12772110 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:dirsrv_config_t:s0 tclass=file permissive=0
type=AVC msg=audit(1775834425.008:10833): avc:  denied  { dac_override } for  pid=1114135 comm="ldap-agent" capability=1  scontext=system_u:system_r:dirsrv_snmp_t:s0 tcontext=system_u:system_r:dirsrv_snmp_t:s0 tclass=capability permissive=0

So we need the following rules:

;============= init_t ==============

;!!!! This avc is allowed in the current policy
(allow init_t dirsrv_config_t (file (read)))

;!!!! This avc is allowed in the current policy
(allow init_t dirsrv_snmp_t (process2 (nnp_transition)))

;!!!! This avc is allowed in the current policy
(allow init_t dirsrv_t (process2 (nnp_transition)))



What is the impact of this issue to you?

Please provide the package NVR for which the bug is seen:
I saw it first with selinux-policy-42.24-1.fc42 but our original target is RHEL 10.3 

How reproducible is this bug?:
systematic








Reproducible: Always

Steps to Reproduce:
# install ldap directory server package:
dnf install -y 389-ds-base
# Create an ldap directory server instance:
echo "
[general]
[slapd]
instance_name = i
root_password = secret12
create_suffix_entry = True
sample_entries = yes
suffix = dc=example,dc=com
" > dirsrv-i.conf
dscreate from-file $PWD/dirsrv-i.conf
# Stop dirsrv instance
systemctl dirsrv@i stop
# 
cp /usr/lib/systemd/system/dirsrv@.service.d/custom.conf /etc/systemd/system/dirsrv@.service.d/custom.conf
# Edit /etc/systemd/system/dirsrv@.service.d/custom.conf to add the following in [Service] Section:
NoNewPrivileges=yes
MemoryDenyWriteExecute=yes
SystemCallFilter=~memfd_create
# - reload systemd configuration: 
systemctl daemon-reload
# - restart the dirsrv service: 
systemctl restart dirsrv
# Without the proper SELinux policy the service fails to start
# Delete ldap directory server instance i
dsctl i delete --do-it

Actual Results:
dirsrv@i service and dirsrv-snmp services fails to start once service units are hardened

Expected Results:
dirsrv@i service and dirsrv-snmp services should start successfully

Additional Information:
Prevent hardening security of dirsrv service by blocking issue https://github.com/389ds/389-ds-base/issues/7391
and RHEL 10.3 ticket https://redhat.atlassian.net/browse/RHEL-153372