Bug 838822 - nss-pam-ldapd cannot connect to ldap port
nss-pam-ldapd cannot connect to ldap port
Status: CLOSED NOTABUG
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted (Show other bugs)
17
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Miroslav Grepl
Ben Levenson
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-07-10 04:41 EDT by Martin Kosek
Modified: 2012-07-12 02:11 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-07-10 09:24:32 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Martin Kosek 2012-07-10 04:41:51 EDT
Description of problem:
nss-pam-ldapd should be allowed to connect to LDAP port. Otherwise, users and groups from remote LDAP directory cannot be retrieved:

/var/log/messages:
Jul 10 04:28:03 localhost nslcd[31207]: [8b4567] failed to bind to LDAP server ldap://vm-086.idm.lab.   bos.redhat.com: Can't contact LDAP server: Transport endpoint is not connected

And now the AVC:

/var/log/audit/audit.log:
type=AVC msg=audit(1341909026.610:1763): avc:  denied  { name_connect } for  pid=31539 comm="nslcd"     dest=389 scontext=system_u:system_r:nslcd_t:s0 tcontext=system_u:object_r:ldap_port_t:s0                tclass=tcp_socket
type=SYSCALL msg=audit(1341909026.610:1763): arch=c000003e syscall=42 success=no exit=-13 a0=b          a1=7f20c400a260 a2=10 a3=7f20d71c25e0 items=0 ppid=1 pid=31539 auid=4294967295 uid=0 gid=0 euid=0       suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="nslcd" exe="/usr/sbin/nslcd"       subj=system_u:system_r:nslcd_t:s0 key=(null)


Version-Release number of selected component (if applicable):
selinux-policy-3.10.0-134.fc17.noarch
selinux-policy-targeted-3.10.0-134.fc17.noarch
nss-pam-ldapd-0.7.16-2.fc17.x86_64


How reproducible:

Steps to Reproduce:
1. Configure nslcd to read user&group data from remote LDAP
2. Try to read the user from remote LDAP (e.g. via "getent user $USER")
3.
  
Actual results:
User is not read as nslcd cannot connect to remote LDAP.

Expected results:
nslcd can connect to remote LDAP, user is read.
Comment 1 Miroslav Grepl 2012-07-10 09:24:32 EDT
You can allow it using

setsebool -P authlogin_nsswitch_use_ldap 1
Comment 2 Jakub Hrozek 2012-07-11 02:56:41 EDT
Martin, I think we should turn this into a docs bug.
Comment 3 Martin Kosek 2012-07-12 02:11:31 EDT
(In reply to comment #2)
> Martin, I think we should turn this into a docs bug.

Feel free to convert this into a doc bug for nss-pam-ldapd component. As for FreeIPA, I at least created a ticket to detect this invalid setting during IPA client installation and produce a warning:

https://fedorahosted.org/freeipa/ticket/2916

Note You need to log in before you can comment on or make changes to this bug.