Bug 575179 - sssd requires manage privileges on krb5_host_rcache_t
Summary: sssd requires manage privileges on krb5_host_rcache_t
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 12
Hardware: All
OS: Linux
low
medium
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-03-19 16:54 UTC by Eugene Indenbom
Modified: 2010-03-30 02:11 UTC (History)
2 users (show)

Fixed In Version: selinux-policy-3.6.32-106.fc12
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-03-30 02:11:56 UTC
Type: ---


Attachments (Terms of Use)

Description Eugene Indenbom 2010-03-19 16:54:24 UTC
Description of problem:
When sssd krb5_validate domain option is True (see man sssd-krb5), sss authentication fails as sssd is not able to use /var/tmp/host_0 credential cache for ticket validation.

Please, note that krb5_validate = True is the default in IPA domain.

Version-Release number of selected component (if applicable): 3.6.32-99.fc12

How reproducible:

Steps to Reproduce:
1. Configure sssd for domain with kerberos authentication and set krb5_validate = True
2. Turn on sssd authentication using authconfig
3. It is not possible to login using network credentials
  
Actual results:
Users can not login using network credentials. selinux alert log contains audit messages about denied access from sssd_t to krb5_host_rcache_t

Expected results:
Users can login using network credentials


Additional info:
The problem is fixed by adding to policy:
kerberos_manage_host_rcache(sssd_t)

Comment 1 Daniel Walsh 2010-03-22 14:23:55 UTC
Miroslav add it.

Comment 2 Miroslav Grepl 2010-03-23 12:30:56 UTC
Fixed in selinux-policy-3.6.32-106.fc12

Comment 3 Fedora Update System 2010-03-23 18:03:39 UTC
selinux-policy-3.6.32-106.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-106.fc12

Comment 4 Fedora Update System 2010-03-24 23:30:48 UTC
selinux-policy-3.6.32-106.fc12 has been pushed to the Fedora 12 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update selinux-policy'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-106.fc12

Comment 5 Fedora Update System 2010-03-30 02:10:20 UTC
selinux-policy-3.6.32-106.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.