Description of problem: When trying to finger it fails when trying to use nss_ldap to get information Nov 9 11:34:16 oak finger: nss_ldap: failed to bind to LDAP server ldap://ldap1.dlib.indiana.edu: Can't contact LDAP server Nov 9 11:34:16 oak setroubleshoot: SELinux is preventing finger (fingerd_t) "connect" to <Unknown> (fingerd_t). For complete SELinux messages. run sealert -l dadedac8-72b5-4d6a-837b-e4cc1f548ad6 Summary: SELinux is preventing finger (fingerd_t) "connect" to <Unknown> (fingerd_t). Detailed Description: SELinux denied access requested by finger. It is not expected that this access is required by finger and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context user_u:system_r:fingerd_t:SystemLow-SystemHigh Target Context user_u:system_r:fingerd_t:SystemLow-SystemHigh Target Objects None [ tcp_socket ] Source finger Source Path /usr/bin/finger Port <Unknown> Host oak.dlib.indiana.edu Source RPM Packages finger-0.17-33 Target RPM Packages Policy RPM selinux-policy-2.4.6-316.el5 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name oak.dlib.indiana.edu Platform Linux oak.dlib.indiana.edu 2.6.18-194.8.1.el5 #1 SMP Wed Jun 23 10:52:51 EDT 2010 x86_64 x86_64 Alert Count 40 First Seen Wed Nov 9 11:32:13 2011 Last Seen Wed Nov 9 11:34:16 2011 Local ID dadedac8-72b5-4d6a-837b-e4cc1f548ad6 Line Numbers Raw Audit Messages host=oak.dlib.indiana.edu type=AVC msg=audit(1320856456.958:7238051): avc: denied { connect } for pid=24449 comm="finger" scontext=user_u:system_r:fingerd_t:s0-s0:c0.c1023 tcontext=user_u:system_r:fingerd_t:s0-s0:c0.c1023 tclass=tcp_socket host=oak.dlib.indiana.edu type=SYSCALL msg=audit(1320856456.958:7238051): arch=c000003e syscall=42 success=no exit=-13 a0=4 a1=2b718fbca6e0 a2=10 a3=0 items=0 ppid=23227 pid=24449 auid=11907 uid=99 gid=99 euid=99 suid=99 fsuid=99 egid=99 sgid=99 fsgid=99 tty=(none) ses=1109924 comm="finger" exe="/usr/bin/finger" subj=user_u:system_r:fingerd_t:s0-s0:c0.c1023 key=(null) Version-Release number of selected component (if applicable): finger-server-0.17-33 finger-0.17-33 selinux-policy-devel-2.4.6-316.el5 selinux-policy-targeted-2.4.6-316.el5 selinux-policy-2.4.6-316.el5 How reproducible: fails on every invocation. Steps to Reproduce: 1. install finger server 2. use nss_ldap as back end data server 3. finger either @locahost or username Actual results: hangs client until finger server finally gives up trying to connect to ldap server. Expected results: finger info Additional info:
I see the same AVC as you do: ---- time->Wed Nov 30 05:44:20 2011 type=SYSCALL msg=audit(1322649860.667:99927): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bf921698 a2=f780f8 a3=9cb6db8 items=0 ppid=2033 pid=2088 auid=0 uid=99 gid=99 euid=99 suid=99 fsuid=99 egid=99 sgid=99 fsgid=99 tty=(none) ses=9149 comm="finger" exe="/usr/bin/finger" subj=root:system_r:fingerd_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1322649860.667:99927): avc: denied { connect } for pid=2088 comm="finger" scontext=root:system_r:fingerd_t:s0-s0:c0.c1023 tcontext=root:system_r:fingerd_t:s0-s0:c0.c1023 tclass=tcp_socket ---- You can get rid of it using "setsebool ypbind on" command. However, finger command would not work as expected and another AVC will probably arise: ---- time->Wed Nov 30 05:35:07 2011 type=SYSCALL msg=audit(1322649307.681:99893): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bf7ff078 a2=af00f8 a3=99aa088 items=0 ppid=658 pid=709 auid=0 uid=99 gid=99 euid=99 suid=99 fsuid=99 egid=99 sgid=99 fsgid=99 tty=(none) ses=9149 comm="finger" exe="/usr/bin/finger" subj=root:system_r:fingerd_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1322649307.681:99893): avc: denied { name_connect } for pid=709 comm="finger" dest=389 scontext=root:system_r:fingerd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:ldap_port_t:s0 tclass=tcp_socket ----
Following policy module solved the timing-out problem for me, but I would like to know if it works for you too: ---- cut here ---- module mypol 1.0; require { type fingerd_t; type ldap_port_t; class tcp_socket { name_connect connect }; } #============= fingerd_t ============== allow fingerd_t ldap_port_t:tcp_socket name_connect; allow fingerd_t self:tcp_socket connect; ---- cut here ---- save the above-mentioned text to mypol.te # make -f /usr/share/selinux/devel/Makefile # semodule -i mypol.pp Does the finger command work as expected now?
We have the authlogin_nsswitch_use_ldap boolean for this in RHEL6. Milos, you are saying if you test it with the latest build and with the enabled allow_ypbind boolean, this won't work?
I'm sorry my tests were executed on machine where selinux-policy-2.4.6-317.el5 was installed. After upgrade to selinux-policy-2.4.6-320.el5 finger seems to work (no timeout, no AVCs).
Latest policy is available here: http://people.redhat.com/dwalsh/SELinux/RHEL5/noarch/ Please let us know if this policy solved your problem.
yes, because of auth_use_nsswitch() was added.
(In reply to comment #5) > Latest policy is available here: > > http://people.redhat.com/dwalsh/SELinux/RHEL5/noarch/ > > Please let us know if this policy solved your problem. 2.4.6-320 fixes it. Thanks!
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2012-0158.html