Bug 740180 - SELinux is preventing pwupdate from getattr operation on /bin/mailx
Summary: SELinux is preventing pwupdate from getattr operation on /bin/mailx
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy
Version: 6.2
Hardware: All
OS: Linux
unspecified
low
Target Milestone: rc
: ---
Assignee: Miroslav Grepl
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-09-21 08:43 UTC by Milos Malik
Modified: 2015-12-15 13:22 UTC (History)
3 users (show)

Fixed In Version: selinux-policy-3.7.19-113.el6
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-12-06 10:19:20 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2011:1511 normal SHIPPED_LIVE selinux-policy bug fix and enhancement update 2011-12-06 00:39:17 UTC

Description Milos Malik 2011-09-21 08:43:01 UTC
Description of problem:
Seen today on 1 machine. I was not able to reproduce it again. Unfortunately the audit demon was not running at that time. Here is what dmesg output revealed.

Version-Release number of selected component (if applicable):
selinux-policy-mls-3.7.19-93.el6_1.7.noarch
selinux-policy-targeted-3.7.19-93.el6_1.7.noarch
selinux-policy-doc-3.7.19-93.el6_1.7.noarch
selinux-policy-minimum-3.7.19-93.el6_1.7.noarch
selinux-policy-3.7.19-93.el6_1.7.noarch
  
Actual results:
type=1400 audit(1316513253.185:23826): avc:  denied  { getattr } for  pid=5289 comm="pwupdate" path="/bin/mailx" dev=sda2 ino=819297 scontext=unconfined_u:system_r:yppasswdd_t:s0 tcontext=system_u:object_r:sendmail_exec_t:s0 tclass=file
type=1400 audit(1316513253.312:23827): avc:  denied  { getattr } for  pid=5289 comm="pwupdate" path="/bin/mailx" dev=sda2 ino=819297 scontext=unconfined_u:system_r:yppasswdd_t:s0 tcontext=system_u:object_r:sendmail_exec_t:s0 tclass=file
type=1400 audit(1316514226.592:23828): avc:  denied  { getattr } for  pid=9906 comm="pwupdate" path="/bin/mailx" dev=sda2 ino=819297 scontext=unconfined_u:system_r:yppasswdd_t:s0 tcontext=system_u:object_r:sendmail_exec_t:s0 tclass=file
type=1400 audit(1316514226.716:23829): avc:  denied  { getattr } for  pid=9906 comm="pwupdate" path="/bin/mailx" dev=sda2 ino=819297 scontext=unconfined_u:system_r:yppasswdd_t:s0 tcontext=system_u:object_r:sendmail_exec_t:s0 tclass=file
type=1400 audit(1316514468.247:23830): avc:  denied  { getattr } for  pid=11360 comm="pwupdate" path="/bin/mailx" dev=sda2 ino=819297 scontext=unconfined_u:system_r:yppasswdd_t:s0 tcontext=system_u:object_r:sendmail_exec_t:s0 tclass=file
type=1400 audit(1316514468.371:23831): avc:  denied  { getattr } for  pid=11360 comm="pwupdate" path="/bin/mailx" dev=sda2 ino=819297 scontext=unconfined_u:system_r:yppasswdd_t:s0 tcontext=system_u:object_r:sendmail_exec_t:s0 tclass=file

Expected results:
* no AVCs

Comment 1 Miroslav Grepl 2011-09-21 10:45:59 UTC
Does yppasswdd send a mail?

Comment 2 Honza Horak 2011-09-21 11:19:27 UTC
Not yppasswdd itself, but pwupdate script does (both in ypserv package, not yp-tools). And pwupdate is called by yppasswdd (fork+exec, don't know what is happening with context). 

What is pwupdate:
# This script is invoked by rpc.yppasswdd after changing the password in
# /etc/shadow or /etc/passwd and it should update the passwd.* and shadow.*
# maps for all domains served by this host.

A mail is sent if some error occurs while updating (which is a rare case).

Comment 3 Miroslav Grepl 2011-09-21 12:25:14 UTC
Ok, thanks Honzo.

Comment 7 errata-xmlrpc 2011-12-06 10:19:20 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2011-1511.html


Note You need to log in before you can comment on or make changes to this bug.