Hide Forgot
Description of problem: Seeing the following in enforcing: Dec 21 18:08:10 vmrawhide puppet-agent[5796]: Starting Puppet client version 2.6.12 Dec 21 18:08:11 vmrawhide kernel: [48384.744153] type=1400 audit(1324490891.246:67): avc: denied { execute } for pid=5807 comm="sh" name="dmidecode" dev=vda2 ino=801405 scontext=system_u:system_r:puppet_t:s0 tcontext=system_u:object_r:dmidecode_exec_t:s0 tclass=file Dec 21 18:08:11 vmrawhide kernel: [48384.744308] type=1400 audit(1324490891.246:68): avc: denied { execute_no_trans } for pid=5807 comm="sh" path="/usr/sbin/dmidecode" dev=vda2 ino=801405 scontext=system_u:system_r:puppet_t:s0 tcontext=system_u:object_r:dmidecode_exec_t:s0 tclass=file Dec 21 18:08:11 vmrawhide kernel: [48384.758756] type=1400 audit(1324490891.260:69): avc: denied { read } for pid=5807 comm="dmidecode" name="mem" dev=devtmpfs ino=4440 scontext=system_u:system_r:puppet_t:s0 tcontext=system_u:object_r:memory_device_t:s0 tclass=chr_file Dec 21 18:08:11 vmrawhide kernel: [48384.758837] type=1400 audit(1324490891.260:70): avc: denied { open } for pid=5807 comm="dmidecode" name="mem" dev=devtmpfs ino=4440 scontext=system_u:system_r:puppet_t:s0 tcontext=system_u:object_r:memory_device_t:s0 tclass=chr_file Dec 21 18:08:11 vmrawhide kernel: [48384.758913] type=1400 audit(1324490891.260:71): avc: denied { sys_rawio } for pid=5807 comm="dmidecode" capability=17 scontext=system_u:system_r:puppet_t:s0 tcontext=system_u:system_r:puppet_t:s0 tclass=capability Dec 21 18:08:11 vmrawhide kernel: [48385.218735] type=1400 audit(1324490891.720:72): avc: denied { read } for pid=5819 comm="arp" name="arp" dev=proc ino=4026531980 scontext=system_u:system_r:puppet_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file Dec 21 18:08:11 vmrawhide kernel: [48385.218815] type=1400 audit(1324490891.720:73): avc: denied { open } for pid=5819 comm="arp" name="arp" dev=proc ino=4026531980 scontext=system_u:system_r:puppet_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file Dec 21 18:08:11 vmrawhide kernel: [48385.218941] type=1400 audit(1324490891.720:74): avc: denied { getattr } for pid=5819 comm="arp" path="/proc/5819/net/arp" dev=proc ino=4026531980 scontext=system_u:system_r:puppet_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file Dec 21 18:08:17 vmrawhide kernel: [48390.712168] type=1400 audit(1324490897.214:75): avc: denied { getattr } for pid=5796 comm="puppetd" path="/root/.bashrc" dev=vda2 ino=1067197 scontext=system_u:system_r:puppet_t:s0 tcontext=system_u:object_r:admin_home_t:s0 tclass=file Dec 21 18:08:17 vmrawhide kernel: [48391.367521] type=1400 audit(1324490897.869:76): avc: denied { execute_no_trans } for pid=5934 comm="sh" path="/usr/bin/crontab" dev=vda2 ino=786795 scontext=system_u:system_r:puppet_t:s0 tcontext=system_u:object_r:crontab_exec_t:s0 tclass=file Dec 21 18:08:17 vmrawhide kernel: [48391.402304] type=1400 audit(1324490897.904:77): avc: denied { getattr } for pid=5934 comm="crontab" path="/var/spool/cron" dev=vda2 ino=656294 scontext=system_u:system_r:puppet_t:s0 tcontext=system_u:object_r:user_cron_spool_t:s0 tclass=dir Dec 21 18:08:18 vmrawhide kernel: [48391.596558] type=1400 audit(1324490898.098:78): avc: denied { execute } for pid=5935 comm="crontab" name="unix_chkpwd" dev=vda2 ino=282268 scontext=system_u:system_r:puppet_t:s0 tcontext=system_u:object_r:chkpwd_exec_t:s0 tclass=file Dec 21 18:08:18 vmrawhide kernel: [48391.596886] type=1400 audit(1324490898.098:79): avc: denied { execute_no_trans } for pid=5935 comm="crontab" path="/sbin/unix_chkpwd" dev=vda2 ino=282268 scontext=system_u:system_r:puppet_t:s0 tcontext=system_u:object_r:chkpwd_exec_t:s0 tclass=file Dec 21 18:08:18 vmrawhide kernel: [48391.617953] type=1400 audit(1324490898.119:80): avc: denied { read } for pid=5935 comm="unix_chkpwd" name="shadow" dev=vda2 ino=926307 scontext=system_u:system_r:puppet_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file Dec 21 18:08:18 vmrawhide kernel: [48391.618065] type=1400 audit(1324490898.119:81): avc: denied { open } for pid=5935 comm="unix_chkpwd" name="shadow" dev=vda2 ino=926307 scontext=system_u:system_r:puppet_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file Dec 21 18:08:18 vmrawhide kernel: [48391.618604] type=1400 audit(1324490898.120:82): avc: denied { getattr } for pid=5935 comm="unix_chkpwd" path="/etc/shadow" dev=vda2 ino=926307 scontext=system_u:system_r:puppet_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file Dec 21 18:08:18 vmrawhide kernel: [48391.630812] type=1400 audit(1324490898.132:83): avc: denied { create } for pid=5934 comm="crontab" scontext=system_u:system_r:puppet_t:s0 tcontext=system_u:system_r:puppet_t:s0 tclass=netlink_audit_socket Dec 21 18:08:18 vmrawhide kernel: [48391.631917] type=1400 audit(1324490898.133:84): avc: denied { nlmsg_relay } for pid=5934 comm="crontab" scontext=system_u:system_r:puppet_t:s0 tcontext=system_u:system_r:puppet_t:s0 tclass=netlink_audit_socket Dec 21 18:08:32 vmrawhide kernel: [48406.437719] type=1400 audit(1324490912.939:89): avc: denied { execute } for pid=6005 comm="sh" name="systemctl" dev=vda2 ino=1059765 scontext=system_u:system_r:puppet_t:s0 tcontext=system_u:object_r:systemd_systemctl_exec_t:s0 tclass=file Dec 21 18:08:32 vmrawhide kernel: [48406.437881] type=1400 audit(1324490912.939:90): avc: denied { execute_no_trans } for pid=6005 comm="sh" path="/bin/systemctl" dev=vda2 ino=1059765 scontext=system_u:system_r:puppet_t:s0 tcontext=system_u:object_r:systemd_systemctl_exec_t:s0 tclass=file Dec 21 18:08:33 vmrawhide kernel: [48406.628758] type=1400 audit(1324490913.130:91): avc: denied { read } for pid=5796 comm="puppetd" name=".bashrc" dev=vda2 ino=1067197 scontext=system_u:system_r:puppet_t:s0 tcontext=system_u:object_r:admin_home_t:s0 tclass=file Dec 21 18:08:33 vmrawhide kernel: [48406.628883] type=1400 audit(1324490913.130:92): avc: denied { open } for pid=5796 comm="puppetd" name=".bashrc" dev=vda2 ino=1067197 scontext=system_u:system_r:puppet_t:s0 tcontext=system_u:object_r:admin_home_t:s0 tclass=file Dec 21 18:08:34 vmrawhide kernel: [48407.649034] type=1400 audit(1324490914.150:93): avc: denied { connectto } for pid=6055 comm="systemctl" path="/run/systemd/private" scontext=system_u:system_r:puppet_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket Dec 21 18:08:34 vmrawhide kernel: [48407.814552] type=1400 audit(1324490914.316:94): avc: denied { getattr } for pid=6063 comm="systemctl" path="/run/systemd" dev=tmpfs ino=8899 scontext=system_u:system_r:puppet_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=dir Dec 21 18:08:34 vmrawhide kernel: [48407.814710] type=1400 audit(1324490914.316:95): avc: denied { getattr } for pid=6063 comm="systemctl" path="/etc/systemd/system" dev=vda2 ino=924200 scontext=system_u:system_r:puppet_t:s0 tcontext=system_u:object_r:systemd_unit_file_t:s0 tclass=dir Dec 21 18:08:34 vmrawhide kernel: [48407.815578] type=1400 audit(1324490914.317:96): avc: denied { read } for pid=6063 comm="systemctl" name="system" dev=tmpfs ino=8900 scontext=system_u:system_r:puppet_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=dir Dec 21 18:08:34 vmrawhide kernel: [48407.815655] type=1400 audit(1324490914.317:97): avc: denied { open } for pid=6063 comm="systemctl" name="system" dev=tmpfs ino=8900 scontext=system_u:system_r:puppet_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=dir Dec 21 18:08:34 vmrawhide kernel: [48407.815794] type=1400 audit(1324490914.317:98): avc: denied { read } for pid=6063 comm="systemctl" name="system" dev=vda2 ino=924200 scontext=system_u:system_r:puppet_t:s0 tcontext=system_u:object_r:systemd_unit_file_t:s0 tclass=dir Dec 21 18:08:36 vmrawhide puppet-agent[5796]: Finished catalog run in 18.72 seconds Version-Release number of selected component (if applicable): selinux-policy-3.10.0-69.fc17.noarch puppet_manage_all_files --> off Not sure if this needs to be on for some of these.
Orion Puppet in Rawhide is permissive mode. So these are AVC's that in a released product would work because puppet would be confined. One idea we have been having would be to build a tool that could take puppet policy and allow an admin to state what puppet is expected to manage. What services would you managing with puppet?
Not sure I completely follow, but... Some these like dmidecode and arp come from puppet using facter. crontab probably comes from using the cron {} puppet type. I distribute a custom /root/.bashrc via puppet. I currently only use the service type with yum-cron, sendmail, and sm-client at the moment. A tool to build policy sounds interesting, but complicated.
The problem we are trying to solve, is unconfined management domains like puppet, or cfengine etc, can not be confined in general, because you can pretty much do anything you want a computer. We have been talking about using the SERVICE_admin() interfaces within the policy and listing them to a user who wanted to confine. In the worse case we would want to analyze an AVC and look at the types that puppet_t wanted to manage and pick an appropriate SERVICE_admin() A better case would be to run a command that says selinux puppet -w /usr/sbin/httpd and have it write a policy like httpd_admin(puppet_t)
Miroslav, what do you think of extending sepolicy generate for this case. sepolicy generate --manage -s puppet_t -d httpd -d postgresql -d mysql Would generate a policy like. policy_module(pupped_t_manage, 1.0) gen_require(` type puppet_t; ') httpd_admin(puppet_t) mysql_admin(puppet_t) postgresql_admin(puppet_t)
Sounds really good.
This bug appears to have been reported against 'rawhide' during the Fedora 19 development cycle. Changing version to '19'. (As we did not run this process for some time, it could affect also pre-Fedora 19 development cycle bugs. We are very sorry. It will help us with cleanup during Fedora 19 End Of Life. Thank you.) More information and reason for this action is here: https://fedoraproject.org/wiki/BugZappers/HouseKeeping/Fedora19
Where does this stand? I'm the puppet maintainer and I'm willing to help make changes to the policy if you all are too busy to work on it.
We have $ sepolicy generate --customize -d puppet_t -a apache -n puppet_manage