Bug 250194 - saslauthd fails to work with pamd + nss_ldap because of SELinux
Summary: saslauthd fails to work with pamd + nss_ldap because of SELinux
Status: CLOSED NOTABUG
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: cyrus-sasl   
(Show other bugs)
Version: 5.0
Hardware: All
OS: Linux
low
low
Target Milestone: ---
: ---
Assignee: Tomas Mraz
QA Contact: Brian Brock
URL:
Whiteboard:
Keywords:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2007-07-30 22:41 UTC by Nathaniel McCallum
Modified: 2008-10-03 12:33 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-10-03 12:33:25 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Description Nathaniel McCallum 2007-07-30 22:41:52 UTC 
On a stock install of RHEL5, I install cyrus-sasl and nss_ldap.  I then
configure /etc/ldap.conf and the relavent files in /etc/pam.d.  saslauthd is
then unable to process authentication events through pam.  The logged events are:

kernel: audit(1185169532.791:24): avc:  denied  { read } for  pid=2055
comm="saslauthd" name="imap" dev=xvda1 ino=2162692
scontext=root:system_r:saslauthd_t:s0 tcontext=root:object_r:tmp_t:s0 tclass=file
kernel: audit(1185172800.708:42): avc:  denied  { getattr } for  pid=5906
comm="saslauthd" name="imap" dev=xvda1 ino=2162691
scontext=root:system_r:saslauthd_t:s0 tcontext=root:object_r:tmp_t:s0 tclass=file

I am able to work around the problem by doing 'allow saslauthd_t tmp_t:file {
getattr read };'
Comment 2 Tomas Mraz 2008-07-02 06:26:55 UTC 
I suppose the imap file is pam configuration for the imap service? Then
restorecon on that file should be able to set the proper context on it.
Note You need to log in before you can comment on or make changes to this bug.