Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: When sssd krb5_validate domain option is True (see man sssd-krb5), sss authentication fails as sssd is not able to use /var/tmp/host_0 credential cache for ticket validation. Please, note that krb5_validate = True is the default in IPA domain. Version-Release number of selected component (if applicable): 3.6.32-99.fc12 How reproducible: Steps to Reproduce: 1. Configure sssd for domain with kerberos authentication and set krb5_validate = True 2. Turn on sssd authentication using authconfig 3. It is not possible to login using network credentials Actual results: Users can not login using network credentials. selinux alert log contains audit messages about denied access from sssd_t to krb5_host_rcache_t Expected results: Users can login using network credentials Additional info: The problem is fixed by adding to policy: kerberos_manage_host_rcache(sssd_t)
Miroslav add it.
Fixed in selinux-policy-3.6.32-106.fc12
selinux-policy-3.6.32-106.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-106.fc12
selinux-policy-3.6.32-106.fc12 has been pushed to the Fedora 12 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-106.fc12
selinux-policy-3.6.32-106.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.