Bug 760206 - SELinux is preventing /usr/bin/rdate from 'name_connect' accesses on the tcp_socket port 37.
Summary: SELinux is preventing /usr/bin/rdate from 'name_connect' accesses on the tcp_...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 16
Hardware: i686
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:129033261d3b6364b9ed2ec1d15...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-12-05 16:14 UTC by Andy Brodie
Modified: 2012-03-24 00:36 UTC (History)
6 users (show)

Fixed In Version: selinux-policy-3.10.0-80.fc16
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-03-24 00:36:43 UTC
Type: ---


Attachments (Terms of Use)

Description Andy Brodie 2011-12-05 16:14:08 UTC
libreport version: 2.0.6
executable:     /usr/bin/python
hashmarkername: setroubleshoot
kernel:         3.1.0-7.fc16.i686
reason:         SELinux is preventing /usr/bin/rdate from 'name_connect' accesses on the tcp_socket port 37.
time:           Mon Dec  5 06:13:38 2011

description:
:SELinux is preventing /usr/bin/rdate from 'name_connect' accesses on the tcp_socket port 37.
:
:*****  Plugin catchall_boolean (89.3 confidence) suggests  *******************
:
:If you want to allow system to run with NIS
:Then you must tell SELinux about this by enabling the 'allow_ypbind' boolean.
:Do
:setsebool -P allow_ypbind 1
:
:*****  Plugin catchall (11.6 confidence) suggests  ***************************
:
:If you believe that rdate should be allowed name_connect access on the port 37 tcp_socket by default.
:Then you should report this as a bug.
:You can generate a local policy module to allow this access.
:Do
:allow this access for now by executing:
:# grep rdate /var/log/audit/audit.log | audit2allow -M mypol
:# semodule -i mypol.pp
:
:Additional Information:
:Source Context                system_u:system_r:gnomeclock_t:s0-s0:c0.c1023
:Target Context                system_u:object_r:inetd_child_port_t:s0
:Target Objects                port 37 [ tcp_socket ]
:Source                        rdate
:Source Path                   /usr/bin/rdate
:Port                          37
:Host                          (removed)
:Source RPM Packages           rdate-1.4-17.fc15
:Target RPM Packages           
:Policy RPM                    selinux-policy-3.10.0-61.fc16
:Selinux Enabled               True
:Policy Type                   targeted
:Enforcing Mode                Enforcing
:Host Name                     (removed)
:Platform                      Linux (removed) 3.1.0-7.fc16.i686 #1
:                              SMP Tue Nov 1 21:00:16 UTC 2011 i686 i686
:Alert Count                   2
:First Seen                    Mon 05 Dec 2011 05:28:51 AM EST
:Last Seen                     Mon 05 Dec 2011 06:12:11 AM EST
:Local ID                      3f9a6ab6-d1e7-4031-8caf-99b50d9d0d97
:
:Raw Audit Messages
:type=AVC msg=audit(1323083531.56:50): avc:  denied  { name_connect } for  pid=1435 comm="rdate" dest=37 scontext=system_u:system_r:gnomeclock_t:s0-s0:c0.c1023 tcontext=system_u:object_r:inetd_child_port_t:s0 tclass=tcp_socket
:
:
:type=SYSCALL msg=audit(1323083531.56:50): arch=i386 syscall=socketcall success=no exit=EACCES a0=3 a1=bf8e1d10 a2=820c130 a3=bf8e21cc items=0 ppid=1425 pid=1435 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=rdate exe=/usr/bin/rdate subj=system_u:system_r:gnomeclock_t:s0-s0:c0.c1023 key=(null)
:
:Hash: rdate,gnomeclock_t,inetd_child_port_t,tcp_socket,name_connect
:
:audit2allow
:
:#============= gnomeclock_t ==============
:#!!!! This avc can be allowed using the boolean 'allow_ypbind'
:
:allow gnomeclock_t inetd_child_port_t:tcp_socket name_connect;
:
:audit2allow -R
:
:#============= gnomeclock_t ==============
:#!!!! This avc can be allowed using the boolean 'allow_ypbind'
:
:allow gnomeclock_t inetd_child_port_t:tcp_socket name_connect;
:

Comment 1 Miroslav Grepl 2011-12-05 20:08:58 UTC
Did you setup gnomeclock to use rdate or did it happen by default?

Comment 2 Andy Brodie 2012-03-09 16:35:18 UTC
I did not setup gnomeclock.  No configuration of gnomeclock by myself was done at any time (in fact, I never even knew it was there).

To confirm, this was a Fedora KDE LiveCD, that was made to live boot from USB via liveusb-creater (on Windows) - so not sure if anything within that creation process could have pulled in other dependencies.

Comment 3 Daniel Walsh 2012-03-09 18:16:56 UTC
Miroslav I think we should separate the rdate port out from inetd_child_port_t like I did with echo, and then we can give gnomeclock access to this port.

Comment 4 Miroslav Grepl 2012-03-12 08:58:44 UTC
commit 8f6cdf2ec9dfb4cc20cad211258d4d869c1e49a5
Author: Miroslav Grepl <mgrepl>
Date:   Mon Mar 12 10:58:28 2012 +0000

    Add own type for rdate port

Comment 5 Fedora Update System 2012-03-13 12:25:30 UTC
selinux-policy-3.10.0-80.fc16 has been submitted as an update for Fedora 16.
https://admin.fedoraproject.org/updates/FEDORA-2012-2733/selinux-policy-3.10.0-80.fc16

Comment 6 Fedora Update System 2012-03-21 02:24:34 UTC
Package selinux-policy-3.10.0-80.fc16:
* should fix your issue,
* was pushed to the Fedora 16 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-80.fc16'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-2733/selinux-policy-3.10.0-80.fc16
then log in and leave karma (feedback).

Comment 7 Fedora Update System 2012-03-24 00:36:43 UTC
selinux-policy-3.10.0-80.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.