Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Prior to this update, running the passwd command in the single user mode (that is, runlevel 1) failed when SELinux was enabled. To address this issue, the SELinux rules have been updated, so that passwd can now access the console, as well as all terminals (TTYs) and pseudo terminals (PTYs).
Created attachment 450843[details]
AVC errors from dmesg after failed passwd attempt
Description of problem:
The passwd command doesn't function when used in runlevel 1 because of an SELinux violation. It is expected that passwd can be used in runlevel 1 to recover a system with an unknown root password.
Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.7.19-54.el6.noarch
How reproducible:
Always
Steps to Reproduce:
1. Boot system into runlevel 1
2. Execute passwd command
Actual results:
passwd command pauses then shell returns prompt. No prompting is given to provide the new password.
Expected results:
passwd command should prompt for new password.
Additional info:
Changing SELinux into permissive mode before executing passwd restores desired functionality. Passwd will prompt and update passwords.
One difference we noticed between single and rl 5 was that passwd is
transitioning into system_u:system_r:passwd_t in runlevel single and
unconfined_u:unconfined_r:passwd_t in runlevel 5.
The other odd thing was that passwd seems to be trying to read a pipe
associated with fd 9 in the bash process in runlevel single.
Not sure what that pipe's there for. fd 0 1 2 and 255 all point to
/dev/console.
The actual AVC:
type=1400 audit(1285871927.977:4): avc: denied { read } for pid=819 comm="passwd" path="pipe:[10143]" dev=pipefs ino=10143 scontext=system_u:system_r:passwd_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=fifo_file
The difference is that the terminal in single user mode is labeled console_device_t and passwd is not allowed to use this.
Comment 10Steve Bonneville
2010-09-30 20:26:33 UTC
Ah. And that was masked by a dontaudit rule.
The business with the avc for fd 9 is almost certainly related to the discussion in bug #618995#c6, coming from Upstart init.
Comment 15Jaromir Hradilek
2010-10-21 08:54:47 UTC
Technical note added. If any revisions are required, please edit the "Technical Notes" field
accordingly. All revisions will be proofread by the Engineering Content Services team.
New Contents:
Prior to this update, running the passwd command in the single user mode (that is, runlevel 1) failed when SELinux was enabled. To address this issue, the SELinux rules have been updated, so that passwd can now access the console, as well as all terminals (TTYs) and pseudo terminals (PTYs).
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.
http://rhn.redhat.com/errata/RHBA-2011-0526.html
Created attachment 450843 [details] AVC errors from dmesg after failed passwd attempt Description of problem: The passwd command doesn't function when used in runlevel 1 because of an SELinux violation. It is expected that passwd can be used in runlevel 1 to recover a system with an unknown root password. Version-Release number of selected component (if applicable): selinux-policy-targeted-3.7.19-54.el6.noarch How reproducible: Always Steps to Reproduce: 1. Boot system into runlevel 1 2. Execute passwd command Actual results: passwd command pauses then shell returns prompt. No prompting is given to provide the new password. Expected results: passwd command should prompt for new password. Additional info: Changing SELinux into permissive mode before executing passwd restores desired functionality. Passwd will prompt and update passwords.