Bug 446482 - selinux policy prevens nscd to use krb5.conf
selinux policy prevens nscd to use krb5.conf
Status: CLOSED NEXTRELEASE
Product: Fedora
Classification: Fedora
Component: krb5 (Show other bugs)
9
x86_64 Linux
low Severity high
: ---
: ---
Assigned To: Nalin Dahyabhai
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2008-05-14 15:59 EDT by Javier Palacios
Modified: 2008-05-19 20:30 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-05-17 10:25:35 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Javier Palacios 2008-05-14 15:59:56 EDT
I'm using kerberos/GSSAPI authentication for nss-ldap, and the default selinux
policy produces the message:
SELinux is preventing nscd (nscd_t) "getattr" to /etc/krb5.conf (krb5_conf_t).

changing the type form krb5_conf_t to etc_t is enough to avoid the message
Comment 1 Javier Palacios 2008-05-15 10:07:24 EDT
Setting the SElinux enforcing mode to permisive does also works, but produces
plenty of similar messages coming for different applications and source
contexts: polkit-read-aut, restorecond, pam_console_app.
Comment 2 Daniel Walsh 2008-05-15 14:06:19 EDT
You can allow this for now.

# audit2allow -M mypol -l -i /var/log/audit/audit.log
# semodule -i mypol.pp

Fixed in selinux-policy-3.3.1-52.fc9.noarch
Comment 3 Javier Palacios 2008-05-17 07:15:50 EDT
I've performed a new install, to get the minimal required policy, and now I get
some issues that seems more related to nscd itself.

Is there any way to load the text file generated by audit2allow? I pretend to
enable them on the kickstart postinstall.
Comment 4 Javier Palacios 2008-05-17 10:25:35 EDT
As the intially reported problem is actually solved, I'll close this ticket,
leaving the remaing problems for bug 446482, which I believe is the proper place.
Comment 5 Javier Palacios 2008-05-18 14:04:04 EDT
The bug pointed on previous note was 446499.

Besides nscd_t, I've got similar messages, where the acces is denied for
semanage_t and setroubleshootd_t going for krb5_conf_t
Comment 6 Daniel Walsh 2008-05-19 14:38:50 EDT
Ok so I guess you have setup a situation where every confined application that
needs to use nsswitch now needs to read the kerberos configuration.

I will make this change in policy.

Fixed in selinux-policy-3.3.1-53.fc9.noarch
Comment 7 Javier Palacios 2008-05-19 17:43:43 EDT
Can I download the updated package, to check that no more friends come to this
party?
Comment 8 Daniel Walsh 2008-05-19 20:30:07 EDT
Should be available shortly in koji.  I will be releasing it to updates-testing
tomorrow.

Note You need to log in before you can comment on or make changes to this bug.