+++ This bug was initially created as a clone of Bug #746265 +++ Description of problem: The fix for https://bugzilla.redhat.com/show_bug.cgi?id=743841 included creating a symlink to a dbus socket in the /var/lib/sss/pipes/private directory. However, the selinux-policy must be tweaked in order to allow SSSD to manage symlinks there. This BZ is a dependency of https://bugzilla.redhat.com/show_bug.cgi?id=743841 Version-Release number of selected component (if applicable): selinux-policy-3.7.19-117.el6 How reproducible: always Steps to Reproduce: 1. install RHEL6.2 candidate SSSD (sssd-1.5.1-56 or newer) 2. service sssd start 3. Actual results: AVC denials Expected results: no AVC denials Additional info: Code-wise, we do: * symlink * stat * readlink * unlink symlink, readlink and unlink on the symlink are only be called from sssd_be now, stat is done from the other sssd processes as well --- Additional comment from jhrozek on 2011-10-14 11:12:46 EDT --- type=AVC msg=audit(1318596215.810:92920): avc: denied { create } for pid=19521 comm="sssd_be" name="sbus-dp_AD" scontext=unconfined_u:system_r:sssd_t:s0 tcontext=unconfined_u:object_r:sssd_var_lib_t:s0 tclass=lnk_file type=AVC msg=audit(1318597994.204:92998): avc: denied { read } for pid=19521 comm="sssd_be" name="sbus-dp_AD" dev=dm-0 ino=1833784 scontext=unconfined_u:system_r:sssd_t:s0 tcontext=unconfined_u:object_r:sssd_var_lib_t:s0 tclass=lnk_file type=AVC msg=audit(1318597994.204:92999): avc: denied { unlink } for pid=19521 comm="sssd_be" name="sbus-dp_AD" dev=dm-0 ino=1833784 scontext=unconfined_u:system_r:sssd_t:s0 tcontext=unconfined_u:object_r:sssd_var_lib_t:s0 tclass=lnk_file type=AVC msg=audit(1318596216.167:92921): avc: denied { read } for pid=19522 comm="sssd_nss" name="sbus-dp_AD" dev=dm-0 ino=1833784 scontext=unconfined_u:system_r:sssd_t:s0 tcontext=unconfined_u:object_r:sssd_var_lib_t:s0 tclass=lnk_file
Also added to Rawhide.
Stephen, I think we must hold off releasing 1.5.14 (in updates-testing now), until this is fixed, otherwise we'd break all enforcing sssd installations.
Miroslav, we need this bug fixed in Fedora 15 and 16 as well. Please perform a Koji build and tell me the package NVR. I will add that version of the selinux-policy package to the Bodhi update containing SSSD 1.5.14 and 1.6.2 (F15 and F16, respectively).
Looks like it was added to F16 as of selinux-policy-3.10.0-41.f16 And F15 seems to have it in selinux-policy-3.9.16-44.fc15
Ok, I've added those to the following Bodhi Updates: * https://admin.fedoraproject.org/updates/FEDORA-2011-14639 (Fedora 15) * https://admin.fedoraproject.org/updates/FEDORA-2011-14614 (Fedora 16)