Bug 752487 - Finger cannot connect to ldap server
Summary: Finger cannot connect to ldap server
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: selinux-policy
Version: 5.7
Hardware: All
OS: Linux
Target Milestone: rc
: ---
Assignee: Miroslav Grepl
QA Contact: Milos Malik
Depends On:
TreeView+ depends on / blocked
Reported: 2011-11-09 16:41 UTC by Brian Wheeler
Modified: 2012-10-16 11:49 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2012-02-21 05:48:26 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2012:0158 0 normal SHIPPED_LIVE selinux-policy bug fix and enhancement update 2012-02-20 14:53:50 UTC

Description Brian Wheeler 2011-11-09 16:41:04 UTC
Description of problem:

When trying to finger it fails when trying to use nss_ldap to get information

Nov  9 11:34:16 oak finger: nss_ldap: failed to bind to LDAP server ldap://ldap1.dlib.indiana.edu: Can't contact LDAP server
Nov  9 11:34:16 oak setroubleshoot: SELinux is preventing finger (fingerd_t) "connect" to <Unknown> (fingerd_t). For complete SELinux messages. run sealert -l dadedac8-72b5-4d6a-837b-e4cc1f548ad6


SELinux is preventing finger (fingerd_t) "connect" to <Unknown> (fingerd_t).

Detailed Description:

SELinux denied access requested by finger. It is not expected that this access
is required by finger and this access may signal an intrusion attempt. It is
also possible that the specific version or configuration of the application is
causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Additional Information:

Source Context                user_u:system_r:fingerd_t:SystemLow-SystemHigh
Target Context                user_u:system_r:fingerd_t:SystemLow-SystemHigh
Target Objects                None [ tcp_socket ]
Source                        finger
Source Path                   /usr/bin/finger
Port                          <Unknown>
Host                          oak.dlib.indiana.edu
Source RPM Packages           finger-0.17-33
Target RPM Packages           
Policy RPM                    selinux-policy-2.4.6-316.el5
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     oak.dlib.indiana.edu
Platform                      Linux oak.dlib.indiana.edu 2.6.18-194.8.1.el5 #1
                              SMP Wed Jun 23 10:52:51 EDT 2010 x86_64 x86_64
Alert Count                   40
First Seen                    Wed Nov  9 11:32:13 2011
Last Seen                     Wed Nov  9 11:34:16 2011
Local ID                      dadedac8-72b5-4d6a-837b-e4cc1f548ad6
Line Numbers                  

Raw Audit Messages            

host=oak.dlib.indiana.edu type=AVC msg=audit(1320856456.958:7238051): avc:  denied  { connect } for  pid=24449 comm="finger" scontext=user_u:system_r:fingerd_t:s0-s0:c0.c1023 tcontext=user_u:system_r:fingerd_t:s0-s0:c0.c1023 tclass=tcp_socket

host=oak.dlib.indiana.edu type=SYSCALL msg=audit(1320856456.958:7238051): arch=c000003e syscall=42 success=no exit=-13 a0=4 a1=2b718fbca6e0 a2=10 a3=0 items=0 ppid=23227 pid=24449 auid=11907 uid=99 gid=99 euid=99 suid=99 fsuid=99 egid=99 sgid=99 fsgid=99 tty=(none) ses=1109924 comm="finger" exe="/usr/bin/finger" subj=user_u:system_r:fingerd_t:s0-s0:c0.c1023 key=(null)

Version-Release number of selected component (if applicable):


How reproducible:

fails on every invocation.

Steps to Reproduce:
1.  install finger server
2.  use nss_ldap as back end data server
3.  finger either @locahost or username 
Actual results:

hangs client until finger server finally gives up trying to connect to ldap server.

Expected results:

finger info

Additional info:

Comment 1 Milos Malik 2011-11-30 10:50:42 UTC
I see the same AVC as you do:

time->Wed Nov 30 05:44:20 2011
type=SYSCALL msg=audit(1322649860.667:99927): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bf921698 a2=f780f8 a3=9cb6db8 items=0 ppid=2033 pid=2088 auid=0 uid=99 gid=99 euid=99 suid=99 fsuid=99 egid=99 sgid=99 fsgid=99 tty=(none) ses=9149 comm="finger" exe="/usr/bin/finger" subj=root:system_r:fingerd_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1322649860.667:99927): avc:  denied  { connect } for  pid=2088 comm="finger" scontext=root:system_r:fingerd_t:s0-s0:c0.c1023 tcontext=root:system_r:fingerd_t:s0-s0:c0.c1023 tclass=tcp_socket

You can get rid of it using "setsebool ypbind on" command. However, finger command would not work as expected and another AVC will probably arise:

time->Wed Nov 30 05:35:07 2011
type=SYSCALL msg=audit(1322649307.681:99893): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bf7ff078 a2=af00f8 a3=99aa088 items=0 ppid=658 pid=709 auid=0 uid=99 gid=99 euid=99 suid=99 fsuid=99 egid=99 sgid=99 fsgid=99 tty=(none) ses=9149 comm="finger" exe="/usr/bin/finger" subj=root:system_r:fingerd_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1322649307.681:99893): avc:  denied  { name_connect } for  pid=709 comm="finger" dest=389 scontext=root:system_r:fingerd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:ldap_port_t:s0 tclass=tcp_socket

Comment 2 Milos Malik 2011-11-30 11:02:17 UTC
Following policy module solved the timing-out problem for me, but I would like to know if it works for you too:

---- cut here ----
module mypol 1.0;

require {
        type fingerd_t;
        type ldap_port_t;
        class tcp_socket { name_connect connect };

#============= fingerd_t ==============
allow fingerd_t ldap_port_t:tcp_socket name_connect;
allow fingerd_t self:tcp_socket connect;
---- cut here ----

save the above-mentioned text to mypol.te
# make -f /usr/share/selinux/devel/Makefile
# semodule -i mypol.pp

Does the finger command work as expected now?

Comment 3 Miroslav Grepl 2011-11-30 12:02:10 UTC
We have the authlogin_nsswitch_use_ldap boolean for this in RHEL6.

you are saying if you test it with the latest build and with the enabled allow_ypbind boolean, this won't work?

Comment 4 Milos Malik 2011-11-30 12:47:42 UTC
I'm sorry my tests were executed on machine where selinux-policy-2.4.6-317.el5 was installed. After upgrade to selinux-policy-2.4.6-320.el5 finger seems to work (no timeout, no AVCs).

Comment 5 Milos Malik 2011-11-30 12:53:36 UTC
Latest policy is available here:


Please let us know if this policy solved your problem.

Comment 6 Miroslav Grepl 2011-11-30 12:55:13 UTC
yes, because of


was added.

Comment 7 Brian Wheeler 2011-11-30 14:45:34 UTC
(In reply to comment #5)
> Latest policy is available here:
> http://people.redhat.com/dwalsh/SELinux/RHEL5/noarch/
> Please let us know if this policy solved your problem.

2.4.6-320 fixes it.  Thanks!

Comment 10 errata-xmlrpc 2012-02-21 05:48:26 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.