Bug 558418 - SELinux is preventing /usr/bin/chsh "execute" access on nxserver.
Summary: SELinux is preventing /usr/bin/chsh "execute" access on nxserver.
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 12
Hardware: x86_64
OS: Linux
low
medium
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: setroubleshoot_trace_hash:34f06e00fd4...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-01-25 10:01 UTC by Jan Teichmann
Modified: 2010-02-02 01:23 UTC (History)
2 users (show)

Fixed In Version: 3.6.32-78.fc12
Clone Of:
Environment:
Last Closed: 2010-02-02 01:23:11 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Jan Teichmann 2010-01-25 10:01:11 UTC
Summary:

SELinux is preventing /usr/bin/chsh "execute" access on nxserver.

Detailed Description:

[SELinux is in permissive mode. This access was not denied.]

SELinux denied access requested by chsh. It is not expected that this access is
required by chsh and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://(removed).redhat.com/docs/selinux-faq-fc5/#id2961385) Please file a bug
report.

Additional Information:

Source Context                unconfined_u:unconfined_r:chfn_t:s0-s0:c0.c1023
Target Context                system_u:object_r:nx_server_exec_t:s0
Target Objects                nxserver [ file ]
Source                        chsh
Source Path                   /usr/bin/chsh
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           util-linux-ng-2.16.2-5.fc12
Target RPM Packages           
Policy RPM                    selinux-policy-3.6.32-66.fc12
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Plugin Name                   catchall
Host Name                     (removed)
Platform                      Linux (removed) 2.6.31.9-174.fc12.x86_64 #1 SMP Mon
                              Dec 21 05:33:33 UTC 2009 x86_64 x86_64
Alert Count                   2
First Seen                    Thu 14 Jan 2010 12:23:33 CET
Last Seen                     Thu 14 Jan 2010 12:30:36 CET
Local ID                      1d67d726-c7da-49fd-9641-ac0d92655dac
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1263468636.741:23474): avc:  denied  { execute } for  pid=20753 comm="chsh" name="nxserver" dev=dm-1 ino=428603 scontext=unconfined_u:unconfined_r:chfn_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nx_server_exec_t:s0 tclass=file

node=(removed) type=SYSCALL msg=audit(1263468636.741:23474): arch=c000003e syscall=21 success=yes exit=0 a0=7faedbd115a0 a1=1 a2=726576 a3=7fff2067f610 items=0 ppid=20751 pid=20753 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=13 comm="chsh" exe="/usr/bin/chsh" subj=unconfined_u:unconfined_r:chfn_t:s0-s0:c0.c1023 key=(null)



Hash String generated from  selinux-policy-3.6.32-66.fc12,catchall,chsh,chfn_t,nx_server_exec_t,file,execute
audit2allow suggests:

#============= chfn_t ==============
allow chfn_t nx_server_exec_t:file execute;

Comment 1 Daniel Walsh 2010-01-25 19:16:14 UTC
Why would chsh be executing the nxserver?  Is this the login shell?

Comment 2 Jan Teichmann 2010-01-25 19:38:14 UTC
it happens on the system start-up. my login shell should be bash but maybe the starting nxserver try to change the shell. but the nxserver is also working with this restriction.

Comment 3 Daniel Walsh 2010-01-25 19:48:36 UTC
Any chance nxserver is listed in /etc/shells?

chsh might be checking which shells are executables?  is nxserver in the /etc/passwd?

Comment 4 Jan Teichmann 2010-01-25 19:59:03 UTC
the nxserver is not in the /etc/shells but in /etc/passwd:
nx:x:491:475::/usr/NX/home/nx:/usr/NX/bin/nxserver

and I noticed that's the NoMachine server... I completely forgot that I changed to the proprietary one some months ago.

Comment 5 Daniel Walsh 2010-01-25 20:26:44 UTC
Miroslav, add

optional_policy(`
	nx_exec_server(chfn_t)
')

to usermanage.te

and

########################################
## <summary>
##	Execute the NX server.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`nx_exec_server',`
	gen_require(`
		type nx_server_exec_t;
	')

	can_exec($1, nx_server_exec_t)
')

to nx.if

Comment 6 Miroslav Grepl 2010-01-26 13:46:42 UTC
Fixed in selinux-policy-3.6.32-78.fc12

Comment 7 Fedora Update System 2010-01-28 09:23:43 UTC
selinux-policy-3.6.32-78.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-78.fc12

Comment 8 Fedora Update System 2010-01-29 03:28:56 UTC
selinux-policy-3.6.32-78.fc12 has been pushed to the Fedora 12 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update selinux-policy'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2010-1207

Comment 9 Fedora Update System 2010-02-02 01:21:02 UTC
selinux-policy-3.6.32-78.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.