Bug 867765 - SELinux prevents sssd start when joining a domain
Summary: SELinux prevents sssd start when joining a domain
Keywords:
Status: CLOSED DUPLICATE of bug 867767
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 18
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-10-18 09:12 UTC by Karel Srot
Modified: 2012-10-19 07:06 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-10-19 07:06:15 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
AVC denials gathered in permissive (36.84 KB, text/plain)
2012-10-18 09:13 UTC, Karel Srot
no flags Details

Description Karel Srot 2012-10-18 09:12:07 UTC
Description of problem:

Found when following a test scenario:
https://fedoraproject.org/wiki/QA:Testcase_Active_Directory_realmd_join_sssd

# realm join --user=Leela $TESTDOMAIN

sssd was installed and I joing the domain, but sssd service was not running (because of selinux)

# service sssd status
Redirecting to /bin/systemctl status  sssd.service
sssd.service - System Security Services Daemon
	  Loaded: loaded (/usr/lib/systemd/system/sssd.service; enabled)
	  Active: inactive (dead)
	  CGroup: name=systemd:/system/sssd.service

Oct 18 04:18:16 dhcp-25-148 systemd[1]: Stopped System Security Services Daemon.

# getent passwd 'RADI08\Leela'
#

in permissive the sshd started properly:
# getent passwd 'RADI08\Leela'
RADI08\leela:*:535601116:535600513:Turanga Leela:/home/RADI08/leela:/bin/bash


Another bunch of denial I got when leaving the domain:
# realm leave --user=Leela $TESTDOMAIN


Version-Release number of selected component (if applicable):
sssd-1.9.2-1.fc18.i686
selinux-policy-3.11.1-36.fc18.noarch
realmd-0.9-1.fc18.i686


How reproducible:
always

Steps to Reproduce:
follow the test scenario 
https://fedoraproject.org/wiki/QA:Testcase_Active_Directory_realmd_join_sssd
as root
  
Actual result:
sssd didn't start, getent not providing any output

Comment 1 Karel Srot 2012-10-18 09:13:25 UTC
Created attachment 629246 [details]
AVC denials gathered in permissive

Comment 2 Stef Walter 2012-10-19 05:29:09 UTC
realmd is starting sssd. More related AVCs here: bug #867767

Comment 3 Miroslav Grepl 2012-10-19 07:06:15 UTC

*** This bug has been marked as a duplicate of bug 867767 ***


Note You need to log in before you can comment on or make changes to this bug.