Bug 835269 - additional permissions for certmonger_t
additional permissions for certmonger_t
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy (Show other bugs)
6.3
All Linux
medium Severity medium
: rc
: ---
Assigned To: Miroslav Grepl
Michal Trunecka
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-06-25 16:10 EDT by Nalin Dahyabhai
Modified: 2014-09-30 19:33 EDT (History)
4 users (show)

See Also:
Fixed In Version: selinux-policy-3.7.19-160.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-02-21 03:24:37 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Nalin Dahyabhai 2012-06-25 16:10:53 EDT
Description of problem:
Starting with development versions of certmonger leading up to 0.58, certmonger is going to gain the ability to talk directly to Dogtag servers.  The policy currently denies its attempts to do so.

Version-Release number of selected component (if applicable):
selinux-policy-3.7.19-155.el6_3.noarch

How reproducible:
Always

Steps to Reproduce:
1. Install ipa-server and its dependencies.
2. Use ipa-server-install to set up the server.
3. Run "getcert start-tracking -d /etc/httpd/alias -n Signing-Cert -c dogtag-ipa-renew-agent -p /etc/httpd/alias/pwdfile.txt" to tell certmonger about the certificate.
4. Run "getcert list -c dogtag-ipa-renew-agent" to check on the certificate's lifetime.
5. Run "getcert resubmit -d /etc/httpd/alias -n Signing-Cert" to tell certmonger to attempt to renew the certificate.
6. Run "getcert list -c dogtag-ipa-renew-agent" again to check if you managed to get yourself a new certificate.
  
Actual results:
The enrollment client fails to contact the server, and the client goes back to monitoring the certificate that it already had.  It generates these AVC messages while I temporarily flip to permissive mode and try it again:

type=SYSCALL msg=audit(1340643217.213:64474): arch=c000003e syscall=42 success=no exit=-115 a0=3 a1=7fff6e012d20 a2=10 a3=7fff6e012930 items=0 ppid=6983 pid=7261 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=153 comm="dogtag-ipa-rene" exe="/usr/libexec/certmonger/dogtag-ipa-renew-agent-submit" subj=unconfined_u:system_r:certmonger_t:s0 key=(null)
type=AVC msg=audit(1340643217.213:64474): avc:  denied  { name_connect } for  pid=7261 comm="dogtag-ipa-rene" dest=9180 scontext=unconfined_u:system_r:certmonger_t:s0 tcontext=system_u:object_r:pki_ca_port_t:s0 tclass=tcp_socket

Expected results:
Success, with the second run of "getcert list" showing that the newly-issued certificate will last that much longer than the old one would have.

Additional information:
Similar changes will be needed in other releases where we include the certmonger package (Fedora, perhaps EL 5), as support for acting as a client for Dogtag will be included whenever we update the package for those releases.
Comment 1 Miroslav Grepl 2012-06-26 03:07:28 EDT
Ok, I added it to all release.
Comment 2 Nalin Dahyabhai 2012-06-26 11:01:18 EDT
Thanks!
Comment 3 RHEL Product and Program Management 2012-07-10 02:31:36 EDT
This request was not resolved in time for the current release.
Red Hat invites you to ask your support representative to
propose this request, if still desired, for consideration in
the next release of Red Hat Enterprise Linux.
Comment 4 RHEL Product and Program Management 2012-07-10 21:57:10 EDT
This request was erroneously removed from consideration in Red Hat Enterprise Linux 6.4, which is currently under development.  This request will be evaluated for inclusion in Red Hat Enterprise Linux 6.4.
Comment 8 errata-xmlrpc 2013-02-21 03:24:37 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-0314.html

Note You need to log in before you can comment on or make changes to this bug.