Bug 250194 – saslauthd fails to work with pamd + nss_ldap because of SELinux

Bug 250194 - saslauthd fails to work with pamd + nss_ldap because of SELinux

Summary:	saslauthd fails to work with pamd + nss_ldap because of SELinux

Status:	CLOSED NOTABUG

Aliases:	None

Product:	Red Hat Enterprise Linux 5
Classification:	Red Hat
Component:	cyrus-sasl (Show other bugs)
Sub Component:
Version:	5.0
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Tomas Mraz
QA Contact:	Brian Brock
Docs Contact:

URL:
Whiteboard:
Keywords:

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2007-07-30 18:41 EDT by Nathaniel McCallum
Modified:	2008-10-03 08:33 EDT (History)
CC List:	0 users

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2008-10-03 08:33:25 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Nathaniel McCallum 2007-07-30 18:41:52 EDT

On a stock install of RHEL5, I install cyrus-sasl and nss_ldap.  I then
configure /etc/ldap.conf and the relavent files in /etc/pam.d.  saslauthd is
then unable to process authentication events through pam.  The logged events are:

kernel: audit(1185169532.791:24): avc:  denied  { read } for  pid=2055
comm="saslauthd" name="imap" dev=xvda1 ino=2162692
scontext=root:system_r:saslauthd_t:s0 tcontext=root:object_r:tmp_t:s0 tclass=file
kernel: audit(1185172800.708:42): avc:  denied  { getattr } for  pid=5906
comm="saslauthd" name="imap" dev=xvda1 ino=2162691
scontext=root:system_r:saslauthd_t:s0 tcontext=root:object_r:tmp_t:s0 tclass=file

I am able to work around the problem by doing 'allow saslauthd_t tmp_t:file {
getattr read };'

Comment 2 Tomas Mraz 2008-07-02 02:26:55 EDT

I suppose the imap file is pam configuration for the imap service? Then
restorecon on that file should be able to set the proper context on it.

Note You need to log in before you can comment on or make changes to this bug.