Bug 750840 - Denials when using CHIL crypto device in httpd
Summary: Denials when using CHIL crypto device in httpd
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy
Version: 6.2
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: 6.3
Assignee: Miroslav Grepl
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-11-02 14:00 UTC by Miroslav Vadkerti
Modified: 2011-11-02 18:37 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-11-02 18:37:45 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description Miroslav Vadkerti 2011-11-02 14:00:25 UTC
Description of problem:
When testing bug 693863 on RHEL6 with enabled netHSM 6000 hardware I got the denials below when trying to start httpd with SSLCryptoDevice chil:

time->Wed Nov  2 09:52:43 2011
type=SYSCALL msg=audit(1320241963.697:47230): arch=c000003e syscall=42 success=yes exit=0 a0=d a1=7fff1acdf470 a2=6e a3=9 items=0 ppid=23024 pid=23025 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=6096 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1320241963.697:47230): avc:  denied  { connectto } for  pid=23025 comm="httpd" path="/dev/nfast/nserver" scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=unix_stream_socket
type=AVC msg=audit(1320241963.697:47230): avc:  denied  { write } for  pid=23025 comm="httpd" name="nserver" dev=devtmpfs ino=18237 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=sock_file

The engine is installed in /opt and the it's libraries have
system_u:object_r:lib_t:s0 
context

Version-Release number of selected component (if applicable):
selinux-policy-3.7.19-120.el6.noarch

How reproducible:
100%

Steps to Reproduce:
1. Have a machine connected to netHSM 6000
2. Install mod_ssl and httpd
2. Add SSLCryptoDevice chil to ssl.conf
3. Restart httpd
  
Actual results:
httpd fails to start

Expected results:
httpd starts and crypto engine is usable

Additional info:
Setting bin_t context on the used library doesn't help:
# chcon -t bin_t /opt/nfast/toolkits/hwcrhk/libnfhwcrhk.so

Note to tester:
Please contact me when testing this bug

Comment 1 Daniel Walsh 2011-11-02 15:09:38 UTC
What is this and what should it be labeled? /dev/nfast/nserver

Comment 2 Miroslav Grepl 2011-11-02 15:15:34 UTC
Mirek,
also what does

# ps -eZ |grep initrc

Comment 4 Daniel Walsh 2011-11-02 15:27:59 UTC
I think we would need new policy for nserver to make this work.  We do not ship this correct?

Comment 5 Miroslav Grepl 2011-11-02 15:49:39 UTC
Yes, we don't ship this.

Comment 6 Daniel Walsh 2011-11-02 18:37:45 UTC
Well it seems to be  badly designed package.  It should not be using /dev for this socket, it should be in /var/run.

I think the only solution is to build custom policy to allow this access.

Miroslav Vadkerti I suggest you request policy be started on this in Fedora.


Note You need to log in before you can comment on or make changes to this bug.