Bug 868959 - AVCs for cluster-cim w/ Pegasus server
AVCs for cluster-cim w/ Pegasus server
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy (Show other bugs)
6.3
All Linux
medium Severity medium
: rc
: ---
Assigned To: Miroslav Grepl
Milos Malik
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-10-22 10:52 EDT by Jan Pokorný
Modified: 2013-02-21 03:31 EST (History)
2 users (show)

See Also:
Fixed In Version: selinux-policy-3.7.19-176.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
selinux-policy-3.7.19-154.el6.noarch
Last Closed: 2013-02-21 03:31:37 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Proposed patch for selinux-policy. (1.14 KB, patch)
2012-10-22 10:52 EDT, Jan Pokorný
no flags Details | Diff

  None (edit)
Description Jan Pokorný 2012-10-22 10:52:28 EDT
Created attachment 631583 [details]
Proposed patch for selinux-policy.

After fixing [bug 865588] (planned for 6.4), which allowed cluster-cim
package (CIM provider of cluster status) to be used at all,
AVCs connected with access to these unix sockets were identified:

A. /var/run/clumond.sock (provided by modclusterd)

type=AVC msg=audit(1350478773.891:62): avc:  denied  { write }
  for  pid=1583 comm="cimprovagt" name="clumond.sock" dev=vda2 ino=144768
  scontext=system_u:system_r:pegasus_t:s0
  tcontext=unconfined_u:object_r:ricci_modcluster_var_run_t:s0
  tclass=sock_file
type=AVC msg=audit(1350478800.780:66): avc:  denied  { connectto }
  for  pid=1583 comm="cimprovagt" path="/var/run/clumond.sock"
  scontext=system_u:system_r:pegasus_t:s0
  tcontext=unconfined_u:system_r:ricci_modclusterd_t:s0
  tclass=unix_stream_socket


B. /var/run/cman_client (provided by corosync)

type=AVC msg=audit(1350914395.838:5295): avc:  denied  { write }
  for  pid=9679 comm="cimprovagt" name="cman_client" dev=vda2 ino=153616
  scontext=unconfined_u:system_r:pegasus_t:s0
  tcontext=unconfined_u:object_r:corosync_var_run_t:s0
  tclass=sock_file
type=AVC msg=audit(1350914395.838:5295): avc:  denied  { connectto }
  for  pid=9679 comm="cimprovagt" path="/var/run/cman_client"
  scontext=unconfined_u:system_r:pegasus_t:s0
  tcontext=unconfined_u:system_r:corosync_t:s0
  tclass=unix_stream_socket


For a simple reproducer, please see mentioned [bug 865588] (I am yet
to add steps to use http instead of https, which did not work for me).

Attached is the patch to cover both, successfully tested in my 6.3
environment.

Also please note that part of the planned solution for [bug 849242]
is to, by the way, remove direct use of B. /var/run/cman_client.
This is what the patch states in the comment.  I'll notify when this
happens (6.5+).
Comment 2 Jan Pokorný 2012-10-22 11:10:20 EDT
[bug 865588 comment 6] <-- proper reproducer
Comment 3 Miroslav Grepl 2012-10-23 08:46:58 EDT
I added fixes to Fedora. Will backport.
Comment 6 errata-xmlrpc 2013-02-21 03:31:37 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-0314.html

Note You need to log in before you can comment on or make changes to this bug.