Hide Forgot
Description of problem: The AVC was found during testing of https://bugzilla.redhat.com/show_bug.cgi?id=644971 . Version-Release number of selected component (if applicable): pam-1.1.1-8.el6.x86_64 pam-devel-1.1.1-8.el6.x86_64 selinux-policy-3.7.19-73.el6.noarch selinux-policy-targeted-3.7.19-73.el6.noarch How reproducible: not sure, but the AVC appears at least once every 10 minutes (default value of unlock_time) Steps to Reproduce: 1) get a RHEL-6.1 machine 2) run "yum -y install tigervnc-server" as root 3) run "yum -y groupinstall Desktop Fonts" as root 4) run "useradd testuser" as root 5) run "passwd testuser" as root 6) run "vncserver" under the identity of testuser 7) replace /etc/pam.d/password-auth and /etc/pam.d/system-auth with attached files 8) connect via vncviewer from your machine to the VNC server running on the RHEL-6.1 machine 9) click on Menu->System-> Lock Screen 10) enter bad password at least 3 times 11) enter good password, the account is locked for 10 minutes 12) wait for the AVC Actual results: ---- time->Wed Mar 9 04:12:50 2011 type=SYSCALL msg=audit(1299661970.158:223): arch=c000003e syscall=2 success=no exit=-13 a0=2162000 a1=2 a2=180 a3=8 items=0 ppid=3592 pid=6060 auid=501 uid=501 gid=502 euid=0 suid=0 fsuid=0 egid=502 sgid=502 fsgid=502 tty=pts0 ses=6 comm="polkit-agent-he" exe="/usr/libexec/polkit-1/polkit-agent-helper-1" subj=unconfined_u:unconfined_r:policykit_auth_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1299661970.158:223): avc: denied { search } for pid=6060 comm="polkit-agent-he" name="faillock" dev=dm-0 ino=1835773 scontext=unconfined_u:unconfined_r:policykit_auth_t:s0-s0:c0.c1023 tcontext=system_u:object_r:pam_var_run_t:s0 tclass=dir ---- Expected results: no AVCs
Created attachment 483137 [details] modified /etc/pam.d/system-auth file
Created attachment 483138 [details] modified /etc/pam.d/password-auth file
These AVCs are visible on all architectures. I forgot the mention polkit packages: polkit-gnome-0.96-3.el6.x86_64 polkit-0.96-2.el6.x86_64 polkit-desktop-policy-0.96-2.el6.noarch
Ok, so this is caused by account required pam_faillock.so What all AVC msgs are you seeing?
The only AVC I see is already mentioned above.
I guess we will need to allow it in auth_use_pam. Milos is testing it in permissive mode.
The AVC mentioned above appeared in enforcing mode. Following AVCs appeared in permissive mode: ---- time->Wed Mar 9 08:14:06 2011 type=SYSCALL msg=audit(1299676446.095:44): arch=c000003e syscall=2 success=yes exit=3 a0=a6d000 a1=2 a2=180 a3=8 items=0 ppid=2314 pid=2407 auid=501 uid=501 gid=502 euid=0 suid=0 fsuid=0 egid=502 sgid=502 fsgid=502 tty=ttyS0 ses=2 comm="polkit-agent-he" exe="/usr/libexec/polkit-1/polkit-agent-helper-1" subj=unconfined_u:unconfined_r:policykit_auth_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1299676446.095:44): avc: denied { open } for pid=2407 comm="polkit-agent-he" name="root" dev=dm-0 ino=1836837 scontext=unconfined_u:unconfined_r:policykit_auth_t:s0-s0:c0.c1023 tcontext=system_u:object_r:pam_var_run_t:s0 tclass=file type=AVC msg=audit(1299676446.095:44): avc: denied { read write } for pid=2407 comm="polkit-agent-he" name="root" dev=dm-0 ino=1836837 scontext=unconfined_u:unconfined_r:policykit_auth_t:s0-s0:c0.c1023 tcontext=system_u:object_r:pam_var_run_t:s0 tclass=file type=AVC msg=audit(1299676446.095:44): avc: denied { search } for pid=2407 comm="polkit-agent-he" name="faillock" dev=dm-0 ino=1835773 scontext=unconfined_u:unconfined_r:policykit_auth_t:s0-s0:c0.c1023 tcontext=system_u:object_r:pam_var_run_t:s0 tclass=dir ---- time->Wed Mar 9 08:14:06 2011 type=SYSCALL msg=audit(1299676446.095:45): arch=c000003e syscall=73 success=yes exit=0 a0=3 a1=2 a2=0 a3=8 items=0 ppid=2314 pid=2407 auid=501 uid=501 gid=502 euid=0 suid=0 fsuid=0 egid=502 sgid=502 fsgid=502 tty=ttyS0 ses=2 comm="polkit-agent-he" exe="/usr/libexec/polkit-1/polkit-agent-helper-1" subj=unconfined_u:unconfined_r:policykit_auth_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1299676446.095:45): avc: denied { lock } for pid=2407 comm="polkit-agent-he" path="/var/run/faillock/root" dev=dm-0 ino=1836837 scontext=unconfined_u:unconfined_r:policykit_auth_t:s0-s0:c0.c1023 tcontext=system_u:object_r:pam_var_run_t:s0 tclass=file ---- time->Wed Mar 9 08:14:06 2011 type=SYSCALL msg=audit(1299676446.095:46): arch=c000003e syscall=5 success=yes exit=0 a0=3 a1=7fff30298780 a2=7fff30298780 a3=8 items=0 ppid=2314 pid=2407 auid=501 uid=501 gid=502 euid=0 suid=0 fsuid=0 egid=502 sgid=502 fsgid=502 tty=ttyS0 ses=2 comm="polkit-agent-he" exe="/usr/libexec/polkit-1/polkit-agent-helper-1" subj=unconfined_u:unconfined_r:policykit_auth_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1299676446.095:46): avc: denied { getattr } for pid=2407 comm="polkit-agent-he" path="/var/run/faillock/root" dev=dm-0 ino=1836837 scontext=unconfined_u:unconfined_r:policykit_auth_t:s0-s0:c0.c1023 tcontext=system_u:object_r:pam_var_run_t:s0 tclass=file ----
Probably yes.
Actually auth_rw_pam_pid($1) to auth_domtrans_chk_passwd() would resolve this. --- But how about add faillog_t label for pam_faillock dir/files. Then we would add auth_manage_faillog($1) to auth_login_pgm_domain() And auth_domtrans_chk_passwd() already has auth_rw_faillog($1) Dan, what do you think?
Yes that looks good.
Fixed in selinux-policy-3.7.19-78.el6 Milos, could you also test it with this release which is available from brew.
No AVCs appeared when I tested with selinux-policy-3.7.19-78.el6.
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2011-0526.html