Bug 866728 - SELinux is preventing /usr/sbin/rpcbind from 'read' accesses on the file /etc/passwd.
Summary: SELinux is preventing /usr/sbin/rpcbind from 'read' accesses on the file /etc...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 18
Hardware: i686
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:6c87c33282be320755b032b8800...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-10-16 02:09 UTC by Mikhail
Modified: 2014-09-13 18:57 UTC (History)
24 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2012-11-11 11:09:08 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
File: type (9 bytes, text/plain)
2012-10-16 02:09 UTC, Mikhail
no flags Details
File: hashmarkername (14 bytes, text/plain)
2012-10-16 02:09 UTC, Mikhail
no flags Details

Description Mikhail 2012-10-16 02:09:01 UTC
Additional info:
libreport version: 2.0.16
kernel:         3.6.1-1.fc18.i686.PAE

description:
:SELinux is preventing /usr/sbin/rpcbind from 'read' accesses on the file /etc/passwd.
:
:*****  Plugin catchall (100. confidence) suggests  ***************************
:
:If you believe that rpcbind should be allowed read access on the passwd file by default.
:Then you should report this as a bug.
:You can generate a local policy module to allow this access.
:Do
:allow this access for now by executing:
:# grep rpcbind /var/log/audit/audit.log | audit2allow -M mypol
:# semodule -i mypol.pp
:
:Additional Information:
:Source Context                system_u:system_r:rpcbind_t:s0
:Target Context                system_u:object_r:passwd_file_t:s0
:Target Objects                /etc/passwd [ file ]
:Source                        rpcbind
:Source Path                   /usr/sbin/rpcbind
:Port                          <Unknown>
:Host                          (removed)
:Source RPM Packages           rpcbind-0.2.0-18.fc18.i686
:Target RPM Packages           setup-2.8.57-1.fc18.noarch
:Policy RPM                    selinux-policy-3.11.1-36.fc18.noarch
:Selinux Enabled               True
:Policy Type                   targeted
:Enforcing Mode                Enforcing
:Host Name                     (removed)
:Platform                      Linux (removed) 3.6.1-1.fc18.i686.PAE #1 SMP Mon
:                              Oct 8 17:41:46 UTC 2012 i686 i686
:Alert Count                   1
:First Seen                    2012-10-16 08:08:21 YEKT
:Last Seen                     2012-10-16 08:08:21 YEKT
:Local ID                      14528c6b-80b2-4b1e-9154-911da4559ee1
:
:Raw Audit Messages
:type=AVC msg=audit(1350353301.646:1722): avc:  denied  { read } for  pid=3075 comm="rpcbind" name="passwd" dev="sda1" ino=264635 scontext=system_u:system_r:rpcbind_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file
:
:
:type=SYSCALL msg=audit(1350353301.646:1722): arch=i386 syscall=open success=no exit=EACCES a0=b7773ee5 a1=80000 a2=1b6 a3=b8f1a038 items=0 ppid=1 pid=3075 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=rpcbind exe=/usr/sbin/rpcbind subj=system_u:system_r:rpcbind_t:s0 key=(null)
:
:Hash: rpcbind,rpcbind_t,passwd_file_t,file,read
:
:audit2allow
:
:#============= rpcbind_t ==============
:allow rpcbind_t passwd_file_t:file read;
:
:audit2allow -R
:
:#============= rpcbind_t ==============
:allow rpcbind_t passwd_file_t:file read;
:

Comment 1 Mikhail 2012-10-16 02:09:04 UTC
Created attachment 627895 [details]
File: type

Comment 2 Mikhail 2012-10-16 02:09:07 UTC
Created attachment 627896 [details]
File: hashmarkername

Comment 3 Kamil Páral 2012-10-16 09:26:40 UTC
This happened during yum update.

Package: (null)
Architecture: x86_64
OS Release: Fedora release 18 (Spherical Cow)

Comment 4 Miroslav Grepl 2012-10-16 12:12:08 UTC
Fixed in selinux-policy-3.11.1-40.fc18.noarch

Comment 5 Petr Schindler 2012-10-17 11:01:21 UTC
It appeared during the instalation of updates.

rpcbind was in transaction:

Updated     rpcbind-0.2.0-17.fc18.x86_64                                  @anaconda
Update              0.2.0-18.fc18.x86_64                                  @updates-testing


Package: (null)
Architecture: x86_64
OS Release: Fedora release 18 (Spherical Cow)

Comment 6 Stef Walter 2012-10-20 05:13:26 UTC
Just booted.

Package: (null)
Architecture: x86_64
OS Release: Fedora release 18 (Spherical Cow)

Comment 7 Eric Blake 2012-10-22 23:01:12 UTC
noticed right after a 'yum update' to latest F18 updates-testing

Package: (null)
OS Release: Fedora release 18 (Spherical Cow)

Comment 8 Miroslav Grepl 2012-10-23 12:07:39 UTC
You can use the latest build from koji for now

http://koji.fedoraproject.org/koji/buildinfo?buildID=361286\

I am going to submit a new update later today.

Comment 9 Petr Schindler 2012-10-23 12:55:02 UTC
This new build seems to solve this bug. It works fine for me.

Comment 10 Jason Brooks 2012-10-23 18:46:55 UTC
On F18 with all updates applied, I'm getting this denial when I try to mount an nfs share. To mount the share, I have to put selinux in permissive mode and start nfs-lock.service before trying to mount again.

Package: (null)
Architecture: x86_64
OS Release: Fedora release 18 (Spherical Cow)

Comment 11 Jason Brooks 2012-10-23 19:00:30 UTC
The pkg linked above addressed this issue for me, thanks.

Comment 12 Fedora Update System 2012-10-23 20:35:11 UTC
selinux-policy-3.11.1-43.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/selinux-policy-3.11.1-43.fc18

Comment 13 Nikhil John 2012-10-24 05:41:53 UTC
nfs-server failed when f18 boots after updating to kernel 3.6.2-2. Following is the status of nfs server when started it manually.

--------------------------------------------------------------------------------
nfs-server.service - NFS Server
	  Loaded: loaded (/usr/lib/systemd/system/nfs-server.service; enabled)
	  Active: failed (Result: exit-code) since Wed, 24 Oct 2012 11:00:45 +0530; 4min 58s ago
	Main PID: 5964 (code=exited, status=1/FAILURE)
	  CGroup: name=systemd:/system/nfs-server.service

Oct 24 11:00:44 localhost.nuke systemd[1]: Starting NFS Server...
Oct 24 11:00:45 localhost.nuke rpc.nfsd[5964]: rpc.nfsd: writing fd to kernel failed: errno 111 (Connection refused)
Oct 24 11:00:45 localhost.nuke rpc.nfsd[5964]: rpc.nfsd: unable to set any sockets for nfsd
Oct 24 11:00:45 localhost.nuke systemd[1]: Failed to start NFS Server.
[nuke@localhost ~]$ s systemctl enable nfs-server.service
[nuke@localhost ~]$ s systemctl start nfs-server.service
Job for nfs-server.service failed. See 'systemctl status nfs-server.service' and 'journalctl' for details.
--------------------------------------------------------------------------------

Comment 14 Miroslav Grepl 2012-10-24 07:41:21 UTC
Does it work in permissive mode?

Are you getting AVC msgs?

Comment 15 Fedora Update System 2012-10-26 15:38:08 UTC
selinux-policy-3.11.1-46.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/selinux-policy-3.11.1-46.fc18

Comment 16 Fedora Update System 2012-10-26 19:27:41 UTC
Package selinux-policy-3.11.1-46.fc18:
* should fix your issue,
* was pushed to the Fedora 18 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.11.1-46.fc18'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-16862/selinux-policy-3.11.1-46.fc18
then log in and leave karma (feedback).


Note You need to log in before you can comment on or make changes to this bug.