Bug 639074 - NetworkManager writing out resolv.conf with wrong context
Summary: NetworkManager writing out resolv.conf with wrong context
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy
Version: 6.0
Hardware: All
OS: Linux
high
medium
Target Milestone: rc
: ---
Assignee: Miroslav Grepl
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks: 580448 609355 644808
TreeView+ depends on / blocked
 
Reported: 2010-09-30 18:39 UTC by Mark Chappell
Modified: 2012-10-15 13:51 UTC (History)
2 users (show)

Fixed In Version: selinux-policy-3.7.19-56.el6
Doc Type: Bug Fix
Doc Text:
With SELinux running in the enforcing mode, resuming the system from the Suspend mode failed, because the /etc/resolv.conf file did not have the correct security context. This was caused by NetworkManager, which was running under wrong SELinux domain, "devicekit_power_t". With this update, the proper SELinux domain transition from DeviceKit-power to NetworkManager has been added, and resuming from the Suspend mode now works as expected.
Clone Of:
Environment:
Last Closed: 2011-05-19 11:56:38 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2011:0526 normal SHIPPED_LIVE selinux-policy bug fix and enhancement update 2011-05-19 09:37:41 UTC

Description Mark Chappell 2010-09-30 18:39:12 UTC
Description of problem:

When resuming from suspend NetworkManager is writing out /etc/resolv.conf.tmp which is being created as etc_t this is then being moved to replace the existing /etc/resolv.conf

This is I think the related create...

type=AVC msg=audit(1285868806.229:1625): avc:  granted  { create } for  pid=28423 comm="NetworkManager" name="resolv.conf.tmp" scontext=system_u:system_r:devicekit_power_t:s0-s0:c0.c1023 tcontext=system_u:object_r:etc_t:s0 tclass=file

It's then failing to unlink the resolv.conf it created, when I try to reconnect leaving DNS config in a wonky state.

Version-Release number of selected component (if applicable):

[mchappel@mchappel ~]$ rpm -q selinux-policy
selinux-policy-3.7.19-54.el6.noarch

How reproducible:

Every time

Steps to Reproduce:
1. Connect to network using NetworkManager
2. Suspend machine
3. Restart machine
  
Actual results:

/etc/resolv.conf and /etc/hosts have a context of system_u:object_r:etc_t:s0

Expected results:

/etc/resolv.conf and /etc/hosts have a context of system_u:object_r:net_conf_t:s0

Comment 2 Daniel Walsh 2010-09-30 19:23:22 UTC
Miroslav add


optional_policy(`
	networkmanager_domtrans(devicekit_power_t)
')

Comment 4 Miroslav Grepl 2010-10-06 08:37:00 UTC
Fixed in selinux-policy-3.7.19-56.el6.noarch

Comment 7 Jaromir Hradilek 2010-10-21 08:54:06 UTC
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
With SELinux running in the enforcing mode, resuming the system from the Suspend mode failed, because the /etc/resolv.conf file did not have the correct security context. This was caused by NetworkManager, which was running under wrong SELinux domain, "devicekit_power_t". With this update, the proper SELinux domain transition from DeviceKit-power to NetworkManager has been added, and resuming from the Suspend mode now works as expected.

Comment 10 errata-xmlrpc 2011-05-19 11:56:38 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-0526.html


Note You need to log in before you can comment on or make changes to this bug.