Bug 250194 - saslauthd fails to work with pamd + nss_ldap because of SELinux
saslauthd fails to work with pamd + nss_ldap because of SELinux
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: cyrus-sasl (Show other bugs)
All Linux
low Severity low
: ---
: ---
Assigned To: Tomas Mraz
Brian Brock
Depends On:
  Show dependency treegraph
Reported: 2007-07-30 18:41 EDT by Nathaniel McCallum
Modified: 2008-10-03 08:33 EDT (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2008-10-03 08:33:25 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Nathaniel McCallum 2007-07-30 18:41:52 EDT
On a stock install of RHEL5, I install cyrus-sasl and nss_ldap.  I then
configure /etc/ldap.conf and the relavent files in /etc/pam.d.  saslauthd is
then unable to process authentication events through pam.  The logged events are:

kernel: audit(1185169532.791:24): avc:  denied  { read } for  pid=2055
comm="saslauthd" name="imap" dev=xvda1 ino=2162692
scontext=root:system_r:saslauthd_t:s0 tcontext=root:object_r:tmp_t:s0 tclass=file
kernel: audit(1185172800.708:42): avc:  denied  { getattr } for  pid=5906
comm="saslauthd" name="imap" dev=xvda1 ino=2162691
scontext=root:system_r:saslauthd_t:s0 tcontext=root:object_r:tmp_t:s0 tclass=file

I am able to work around the problem by doing 'allow saslauthd_t tmp_t:file {
getattr read };'
Comment 2 Tomas Mraz 2008-07-02 02:26:55 EDT
I suppose the imap file is pam configuration for the imap service? Then
restorecon on that file should be able to set the proper context on it.

Note You need to log in before you can comment on or make changes to this bug.