Bug 685116 - mls: selinux blocks console login
mls: selinux blocks console login
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy (Show other bugs)
6.1
Unspecified Unspecified
high Severity high
: rc
: ---
Assigned To: Miroslav Grepl
BaseOS QE Security Team
:
Depends On:
Blocks: 682670 RHEL62CCC 846801 846802
  Show dependency treegraph
 
Reported: 2011-03-15 06:54 EDT by Karel Srot
Modified: 2013-06-13 08:03 EDT (History)
4 users (show)

See Also:
Fixed In Version: selinux-policy-3.7.19-79.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2011-05-19 08:24:30 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
audit.log after console login (81.37 KB, text/plain)
2011-03-15 09:44 EDT, Karel Srot
no flags Details

  None (edit)
Description Karel Srot 2011-03-15 06:54:11 EDT
Description of problem:

1. installed RHEL6.1-20110311.3 with mls policy
2. updated grub kernel line with console=ttyS0
3. opened console:  virsh console rhel6-64
4. system start up logs into the console but I do not get the login prompt

Following module fixes the problem for me but it is not probably the best solution.

module mypoltty 1.0;

require {
	type etc_t;
	type initrc_t;
	class file write;
}

#============= initrc_t ==============
allow initrc_t etc_t:file write;


Version-Release number of selected component (if applicable):
selinux-policy-mls-3.7.19-78.el6
RHEL6.1-20110311.3

How reproducible:
always

Steps to Reproduce:
above
  
Actual results:
no login prompt

type=SYSCALL msg=audit(1300185968.999:7): arch=c000003e syscall=2 success=no exit=-13 a0=400f08 a1=2 a2=18 a3=7fff03200aa0 items=0 ppid=1 pid=1229 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="securetty" exe="/sbin/securetty" subj=system_u:system_r:initrc_t:s0-s15:c0.c1023 key=(null)
type=AVC msg=audit(1300185968.999:7): avc:  denied  { write } for  pid=1229 comm="securetty" name="securetty" dev=dm-0 ino=19310 scontext=system_u:system_r:initrc_t:s0-s15:c0.c1023 tcontext=system_u:object_r:etc_t:s0 tclass=file
Comment 1 Karel Srot 2011-03-15 07:40:52 EDT
securetty is trying to add "ttyS0" to /etc/securetty. 
1. Is securetty supposed to do it in MLS?
2. I cannot login even if it is already there, this seems to be some initscript bug.
Comment 2 Daniel Walsh 2011-03-15 08:20:52 EDT
I do not think they are related.   Not sure why you can not login via the console?  What platform is this happing on?  ppc?
Comment 3 Daniel Walsh 2011-03-15 08:21:51 EDT
Looks like we might need a policy for securetty
Comment 4 Daniel Walsh 2011-03-15 08:24:18 EDT
Or change the label on /etc/securetty to etc_runtime_t.

chcon -t etc_runtime_t /etc/securetty 

Should elminate the AVC.

Can you execute semodule -DB and see if their are avcs relabeled to console_device_t when you login?
Comment 5 Miroslav Grepl 2011-03-15 08:56:36 EDT
I am seeing the same issue. 


I think we should add the etc_runtime_t label for now. And I can try to write a policy for that.
Comment 6 Miroslav Grepl 2011-03-15 09:38:45 EDT
Karel,
it works fine for me with

chcon -t etc_runtime_t /etc/securetty 


And I am not seeing AVC msgs which Dan mentioned in the comment #4.
Comment 7 Karel Srot 2011-03-15 09:44:15 EDT
Created attachment 484502 [details]
audit.log after console login

I am testing on virtual (kvm/qemu) x86_64 host on x86_64 RHEL6 guest.
Changing the context allowed me to login, I am adding the audit.log as the attachment.
Comment 8 Daniel Walsh 2011-03-15 10:07:11 EDT
Well if you are able to login with the securetty completing successfull, no other changes need to be made other then changing the label on /etc/securettys
Comment 9 Daniel Walsh 2011-03-15 10:08:08 EDT
The only concern with changing this label would be if other confined domains need to read it and can not.  I think all login domains can read it, not sure what else would read it.
Comment 11 Linda Knippers 2011-03-16 17:34:09 EDT
The 'chcon -t etc_runtime_t /etc/securetty' command suggested in the BZ
resolved an AVC I was seeing and also allows the getty to start on the 
console of my RHEL6.1 mls test system.
Comment 12 Miroslav Grepl 2011-03-17 06:29:04 EDT
Fixed in selinux-policy-3.7.19-79.el6
Comment 16 errata-xmlrpc 2011-05-19 08:24:30 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-0526.html

Note You need to log in before you can comment on or make changes to this bug.