Bug 752487 - Finger cannot connect to ldap server
Finger cannot connect to ldap server
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: selinux-policy (Show other bugs)
5.7
All Linux
unspecified Severity low
: rc
: ---
Assigned To: Miroslav Grepl
Milos Malik
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2011-11-09 11:41 EST by Brian Wheeler
Modified: 2012-10-16 07:49 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-02-21 00:48:26 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Brian Wheeler 2011-11-09 11:41:04 EST
Description of problem:

When trying to finger it fails when trying to use nss_ldap to get information


Nov  9 11:34:16 oak finger: nss_ldap: failed to bind to LDAP server ldap://ldap1.dlib.indiana.edu: Can't contact LDAP server
Nov  9 11:34:16 oak setroubleshoot: SELinux is preventing finger (fingerd_t) "connect" to <Unknown> (fingerd_t). For complete SELinux messages. run sealert -l dadedac8-72b5-4d6a-837b-e4cc1f548ad6

Summary:

SELinux is preventing finger (fingerd_t) "connect" to <Unknown> (fingerd_t).

Detailed Description:

SELinux denied access requested by finger. It is not expected that this access
is required by finger and this access may signal an intrusion attempt. It is
also possible that the specific version or configuration of the application is
causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Additional Information:

Source Context                user_u:system_r:fingerd_t:SystemLow-SystemHigh
Target Context                user_u:system_r:fingerd_t:SystemLow-SystemHigh
Target Objects                None [ tcp_socket ]
Source                        finger
Source Path                   /usr/bin/finger
Port                          <Unknown>
Host                          oak.dlib.indiana.edu
Source RPM Packages           finger-0.17-33
Target RPM Packages           
Policy RPM                    selinux-policy-2.4.6-316.el5
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     oak.dlib.indiana.edu
Platform                      Linux oak.dlib.indiana.edu 2.6.18-194.8.1.el5 #1
                              SMP Wed Jun 23 10:52:51 EDT 2010 x86_64 x86_64
Alert Count                   40
First Seen                    Wed Nov  9 11:32:13 2011
Last Seen                     Wed Nov  9 11:34:16 2011
Local ID                      dadedac8-72b5-4d6a-837b-e4cc1f548ad6
Line Numbers                  

Raw Audit Messages            

host=oak.dlib.indiana.edu type=AVC msg=audit(1320856456.958:7238051): avc:  denied  { connect } for  pid=24449 comm="finger" scontext=user_u:system_r:fingerd_t:s0-s0:c0.c1023 tcontext=user_u:system_r:fingerd_t:s0-s0:c0.c1023 tclass=tcp_socket

host=oak.dlib.indiana.edu type=SYSCALL msg=audit(1320856456.958:7238051): arch=c000003e syscall=42 success=no exit=-13 a0=4 a1=2b718fbca6e0 a2=10 a3=0 items=0 ppid=23227 pid=24449 auid=11907 uid=99 gid=99 euid=99 suid=99 fsuid=99 egid=99 sgid=99 fsgid=99 tty=(none) ses=1109924 comm="finger" exe="/usr/bin/finger" subj=user_u:system_r:fingerd_t:s0-s0:c0.c1023 key=(null)



Version-Release number of selected component (if applicable):

finger-server-0.17-33
finger-0.17-33
selinux-policy-devel-2.4.6-316.el5
selinux-policy-targeted-2.4.6-316.el5
selinux-policy-2.4.6-316.el5


How reproducible:

fails on every invocation.


Steps to Reproduce:
1.  install finger server
2.  use nss_ldap as back end data server
3.  finger either @locahost or username 
  
Actual results:

hangs client until finger server finally gives up trying to connect to ldap server.


Expected results:

finger info


Additional info:
Comment 1 Milos Malik 2011-11-30 05:50:42 EST
I see the same AVC as you do:

----
time->Wed Nov 30 05:44:20 2011
type=SYSCALL msg=audit(1322649860.667:99927): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bf921698 a2=f780f8 a3=9cb6db8 items=0 ppid=2033 pid=2088 auid=0 uid=99 gid=99 euid=99 suid=99 fsuid=99 egid=99 sgid=99 fsgid=99 tty=(none) ses=9149 comm="finger" exe="/usr/bin/finger" subj=root:system_r:fingerd_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1322649860.667:99927): avc:  denied  { connect } for  pid=2088 comm="finger" scontext=root:system_r:fingerd_t:s0-s0:c0.c1023 tcontext=root:system_r:fingerd_t:s0-s0:c0.c1023 tclass=tcp_socket
----

You can get rid of it using "setsebool ypbind on" command. However, finger command would not work as expected and another AVC will probably arise:

----
time->Wed Nov 30 05:35:07 2011
type=SYSCALL msg=audit(1322649307.681:99893): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bf7ff078 a2=af00f8 a3=99aa088 items=0 ppid=658 pid=709 auid=0 uid=99 gid=99 euid=99 suid=99 fsuid=99 egid=99 sgid=99 fsgid=99 tty=(none) ses=9149 comm="finger" exe="/usr/bin/finger" subj=root:system_r:fingerd_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1322649307.681:99893): avc:  denied  { name_connect } for  pid=709 comm="finger" dest=389 scontext=root:system_r:fingerd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:ldap_port_t:s0 tclass=tcp_socket
----
Comment 2 Milos Malik 2011-11-30 06:02:17 EST
Following policy module solved the timing-out problem for me, but I would like to know if it works for you too:

---- cut here ----
module mypol 1.0;

require {
        type fingerd_t;
        type ldap_port_t;
        class tcp_socket { name_connect connect };
}

#============= fingerd_t ==============
allow fingerd_t ldap_port_t:tcp_socket name_connect;
allow fingerd_t self:tcp_socket connect;
---- cut here ----

save the above-mentioned text to mypol.te
# make -f /usr/share/selinux/devel/Makefile
# semodule -i mypol.pp

Does the finger command work as expected now?
Comment 3 Miroslav Grepl 2011-11-30 07:02:10 EST
We have the authlogin_nsswitch_use_ldap boolean for this in RHEL6.

Milos,
you are saying if you test it with the latest build and with the enabled allow_ypbind boolean, this won't work?
Comment 4 Milos Malik 2011-11-30 07:47:42 EST
I'm sorry my tests were executed on machine where selinux-policy-2.4.6-317.el5 was installed. After upgrade to selinux-policy-2.4.6-320.el5 finger seems to work (no timeout, no AVCs).
Comment 5 Milos Malik 2011-11-30 07:53:36 EST
Latest policy is available here:

http://people.redhat.com/dwalsh/SELinux/RHEL5/noarch/

Please let us know if this policy solved your problem.
Comment 6 Miroslav Grepl 2011-11-30 07:55:13 EST
yes, because of

auth_use_nsswitch()

was added.
Comment 7 Brian Wheeler 2011-11-30 09:45:34 EST
(In reply to comment #5)
> Latest policy is available here:
> 
> http://people.redhat.com/dwalsh/SELinux/RHEL5/noarch/
> 
> Please let us know if this policy solved your problem.

2.4.6-320 fixes it.  Thanks!
Comment 10 errata-xmlrpc 2012-02-21 00:48:26 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0158.html

Note You need to log in before you can comment on or make changes to this bug.