Bug 747608 - sssd needs to be allowed to create, delete and read symlinks in /var/lib/sss/pipes/private
sssd needs to be allowed to create, delete and read symlinks in /var/lib/sss/...
Status: CLOSED RAWHIDE
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
rawhide
All Linux
high Severity high
: ---
: ---
Assigned To: Miroslav Grepl
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2011-10-20 09:47 EDT by Jakub Hrozek
Modified: 2011-10-21 11:00 EDT (History)
9 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 746265
Environment:
Last Closed: 2011-10-20 09:51:16 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Jakub Hrozek 2011-10-20 09:47:37 EDT
+++ This bug was initially created as a clone of Bug #746265 +++

Description of problem:
The fix for https://bugzilla.redhat.com/show_bug.cgi?id=743841 included creating a symlink to a dbus socket in the /var/lib/sss/pipes/private directory. However, the selinux-policy must be tweaked in order to allow SSSD to manage symlinks there.

This BZ is a dependency of https://bugzilla.redhat.com/show_bug.cgi?id=743841

Version-Release number of selected component (if applicable):
selinux-policy-3.7.19-117.el6

How reproducible:
always

Steps to Reproduce:
1. install RHEL6.2 candidate SSSD (sssd-1.5.1-56 or newer)
2. service sssd start
3.
  
Actual results:
AVC denials

Expected results:
no AVC denials

Additional info:
Code-wise, we do:
 * symlink
 * stat
 * readlink
 * unlink

symlink, readlink and unlink on the symlink are only be called from sssd_be now, stat is done from the other sssd processes as well

--- Additional comment from jhrozek@redhat.com on 2011-10-14 11:12:46 EDT ---

type=AVC msg=audit(1318596215.810:92920): avc:  denied  { create } for  pid=19521 comm="sssd_be" name="sbus-dp_AD" scontext=unconfined_u:system_r:sssd_t:s0 tcontext=unconfined_u:object_r:sssd_var_lib_t:s0 tclass=lnk_file

type=AVC msg=audit(1318597994.204:92998): avc:  denied  { read } for  pid=19521 comm="sssd_be" name="sbus-dp_AD" dev=dm-0 ino=1833784 scontext=unconfined_u:system_r:sssd_t:s0 tcontext=unconfined_u:object_r:sssd_var_lib_t:s0 tclass=lnk_file

type=AVC msg=audit(1318597994.204:92999): avc:  denied  { unlink } for  pid=19521 comm="sssd_be" name="sbus-dp_AD" dev=dm-0 ino=1833784 scontext=unconfined_u:system_r:sssd_t:s0 tcontext=unconfined_u:object_r:sssd_var_lib_t:s0 tclass=lnk_file

type=AVC msg=audit(1318596216.167:92921): avc:  denied  { read } for  pid=19522 comm="sssd_nss" name="sbus-dp_AD" dev=dm-0 ino=1833784 scontext=unconfined_u:system_r:sssd_t:s0 tcontext=unconfined_u:object_r:sssd_var_lib_t:s0 tclass=lnk_file
Comment 1 Miroslav Grepl 2011-10-20 09:51:16 EDT
Also added to Rawhide.
Comment 2 Jakub Hrozek 2011-10-20 09:52:43 EDT
Stephen, I think we must hold off releasing 1.5.14 (in updates-testing now), until this is fixed, otherwise we'd break all enforcing sssd installations.
Comment 3 Stephen Gallagher 2011-10-21 10:20:44 EDT
Miroslav, we need this bug fixed in Fedora 15 and 16 as well. Please perform a Koji build and tell me the package NVR. I will add that version of the selinux-policy package to the Bodhi update containing SSSD 1.5.14 and 1.6.2 (F15 and F16, respectively).
Comment 4 Daniel Walsh 2011-10-21 10:42:37 EDT
Looks like it was added to F16 as of

selinux-policy-3.10.0-41.f16

And F15 seems to have it in 

selinux-policy-3.9.16-44.fc15
Comment 5 Stephen Gallagher 2011-10-21 11:00:26 EDT
Ok, I've added those to the following Bodhi Updates:
 * https://admin.fedoraproject.org/updates/FEDORA-2011-14639 (Fedora 15)
 * https://admin.fedoraproject.org/updates/FEDORA-2011-14614 (Fedora 16)

Note You need to log in before you can comment on or make changes to this bug.