Bug 854615 - AVCs when running bcfg2 test with disabled unconfined and unlabelednet
AVCs when running bcfg2 test with disabled unconfined and unlabelednet
Status: CLOSED DUPLICATE of bug 807678
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy (Show other bugs)
6.4
All Linux
unspecified Severity medium
: rc
: ---
Assigned To: Miroslav Grepl
BaseOS QE Security Team
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-09-05 08:49 EDT by Michal Trunecka
Modified: 2014-09-30 19:33 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-09-06 01:02:48 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Michal Trunecka 2012-09-05 08:49:08 EDT
Description of problem:
When unconfined and unlabelednet modules are disabled, running automated test of bcfg2 FAILed and causes following AVC:

----
time->Wed Sep  5 14:37:39 2012
type=SYSCALL msg=audit(1346848659.240:29918): arch=c000003e syscall=49 success=yes exit=0 a0=6 a1=7fff5414b020 a2=10 a3=ff00 items=0 ppid=1 pid=30341 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=6 comm="bcfg2-server" exe="/usr/bin/python" subj=unconfined_u:system_r:initrc_t:s0 key=(null)
type=AVC msg=audit(1346848659.240:29918): avc:  denied  { name_bind } for  pid=30341 comm="bcfg2-server" src=6789 scontext=unconfined_u:system_r:initrc_t:s0 tcontext=system_u:object_r:cyphesis_port_t:s0 tclass=tcp_socket

In addition, in permissive mode, the test PASSes with only this AVC. The test PASSed with no AVCs with both mentioned modules enabled.


Version-Release number of selected component (if applicable):
selinux-policy-3.7.19-155.el6_3.noarch
selinux-policy-targeted-3.7.19-155.el6_3.noarch
bcfg2-1.2.1-1.el6.noarch
bcfg2-doc-1.2.1-1.el6.noarch
bcfg2-web-1.2.1-1.el6.noarch
bcfg2-server-1.2.1-1.el6.noarch


How reproducible:
always

Steps to Reproduce:
1. semodule -d unconfined; semodule -d unlabelednet
2. Run following automated test 
  /CoreOS/selinux-policy/Regression/bz805742-SELINUX-ERR-when-using-config-tools-to-install


Actual results:
Test FAILed and AVC showed up

Expected results:
Test PASSes with no AVC
Comment 2 Miroslav Grepl 2012-09-06 01:02:48 EDT
This will be fixed by new policy for this service.

*** This bug has been marked as a duplicate of bug 807678 ***
Comment 3 Miroslav Grepl 2012-09-06 01:04:23 EDT
Did it happen by default or did you setup this port?
Comment 4 Michal Trunecka 2012-09-06 02:47:21 EDT
Port 6789 is commonly used for bcfg2, it is also mentioned in official documentation, e.g. here http://docs.bcfg2.org/appendix/guides/authentication.html    But there is no default port, you have to choose some by yourself using bcfg2 interactive initialization script.
Comment 5 Miroslav Grepl 2012-09-06 08:49:55 EDT
Ok. Thx.

Note You need to log in before you can comment on or make changes to this bug.