Bug 962513 - f18 avc denials during freeipa server and replica installs
f18 avc denials during freeipa server and replica installs
Status: CLOSED EOL
Product: Fedora
Classification: Fedora
Component: pki-ca (Show other bugs)
20
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Orphan Owner
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2013-05-13 13:54 EDT by Scott Poore
Modified: 2015-06-29 07:57 EDT (History)
9 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-06-29 07:57:23 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Scott Poore 2013-05-13 13:54:59 EDT
Description of problem:

When running ipa-server-install or ipa-replica-install on Fedora 18, I am seeing the following AVC denials:

----
time->Mon May 13 11:08:50 2013
type=SYSCALL msg=audit(1368457730.620:428): arch=c000003e syscall=257 success=no exit=-13 a0=ffffffffffffff9c a1=7fe7380074e0 a2=90800 a3=0 items=0 ppid=1 pid=10579 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="java" exe="/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.19.x86_64/jre/bin/java" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
type=AVC msg=audit(1368457730.620:428): avc:  denied  { read } for  pid=10579 comm="java" name="hsperfdata_root" dev="tmpfs" ino=34859 scontext=system_u:system_r:pki_tomcat_t:s0 tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir
----
time->Mon May 13 11:08:50 2013
type=SYSCALL msg=audit(1368457730.620:429): arch=c000003e syscall=2 success=no exit=-13 a0=7fe738007500 a1=242 a2=180 a3=0 items=0 ppid=1 pid=10579 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="java" exe="/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.19.x86_64/jre/bin/java" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
type=AVC msg=audit(1368457730.620:429): avc:  denied  { write } for  pid=10579 comm="java" name="hsperfdata_root" dev="tmpfs" ino=34859 scontext=system_u:system_r:pki_tomcat_t:s0 tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir

Version-Release number of selected component (if applicable):
freeipa-server-selinux = 3.2.99-0.20130510T1905Zgitb30b3bc.fc18
selinux-policy-3.11.1-94.fc18.noarch

How reproducible:
always (in automated tests)

Steps to Reproduce:
1.  Install F18
2.  yum -y install freeipa-server
3.  ipa-server-install
  
Actual results:
install seems to work but see AVC denials listed above.

Expected results:
no avc denials expected.

Additional info:

This is apparently also seen on F19 according to this:

https://bugzilla.redhat.com/show_bug.cgi?id=953464#c2
Comment 1 Scott Poore 2013-05-13 16:35:56 EDT
A little more digging is showing that the AVCs are being triggered by:

systemctl restart pki-tomcatd\@pki-tomcat.service


However, I still don't know what ran to set the context to rpm_script_tmp_t.  Still looking there.
Comment 2 Scott Poore 2013-05-13 21:36:05 EDT
Ok, looks like maybe this is from java itself:

[root@storm ~]# rm -rf /tmp/hsperfdata_root/

[root@storm ~]# yum -y install java-1.7.0-openjdk
Resolving Dependencies
--> Running transaction check
---> Package java-1.7.0-openjdk.x86_64 1:1.7.0.19-2.3.9.3.fc18 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

===================================================================================================================================================================================================================
 Package                                                Arch                                       Version                                                       Repository                                   Size
===================================================================================================================================================================================================================
Installing:
 java-1.7.0-openjdk                                     x86_64                                     1:1.7.0.19-2.3.9.3.fc18                                       updates                                      25 M

Transaction Summary
===================================================================================================================================================================================================================
Install  1 Package

Total download size: 25 M
Installed size: 90 M
Downloading Packages:
java-1.7.0-openjdk-1.7.0.19-2.3.9.3.fc18.x86_64.rpm                                                                                                                                         |  25 MB  00:00:01     
Running Transaction Check
Running Transaction Test
Transaction Test Succeeded
Running Transaction
  Installing : 1:java-1.7.0-openjdk-1.7.0.19-2.3.9.3.fc18.x86_64                                                                                                                                               1/1 
  Verifying  : 1:java-1.7.0-openjdk-1.7.0.19-2.3.9.3.fc18.x86_64                                                                                                                                               1/1 

Installed:
  java-1.7.0-openjdk.x86_64 1:1.7.0.19-2.3.9.3.fc18                                                                                                                                                                

Complete!

[root@storm ~]# ls -ltra /tmp/hsperfdata_root/
total 32
drwxr-xr-x. 2 root root    60 May 13 21:09 .
-rw-------. 1 root root 32768 May 13 21:09 15111
drwxrwxrwt. 8 root root   240 May 13 21:09 ..

[root@storm ~]# ls -ltradZ /tmp/hsperfdata_root
drwxr-xr-x. root root unconfined_u:object_r:rpm_script_tmp_t:s0 /tmp/hsperfdata_root

[root@storm ~]# ps -ef|grep java
root     15123  7697  0 21:10 pts/0    00:00:00 grep --color=auto java

[root@storm ~]# ps -ef|grep 15111
root     15125  7697  0 21:10 pts/0    00:00:00 grep --color=auto 15111


Looking at the RPM's scripts, it looks like maybe this:

[root@storm ~]# rm -rf /tmp/hsperfdata_root/

[root@storm ~]# /usr/lib/jvm/jre-1.7.0-openjdk.x86_64/bin/java -Xshare:dump >/dev/null 2>/dev/null

[root@storm ~]# ls -ltrdZ /tmp/hsperfdata_root/
drwxr-xr-x. root root unconfined_u:object_r:user_tmp_t:s0 /tmp/hsperfdata_root/
Comment 3 Scott Poore 2013-05-13 22:03:36 EDT
And the java version:

java-1.7.0-openjdk-1.7.0.19-2.3.9.3.fc18.x86_64
Comment 4 Martin Kosek 2013-05-16 02:43:28 EDT
I tried to reproduce this issue on F18, but I was unsuccessful in that, no AVC logged during ipa-server-install. These are the versions I used:

freeipa-server-3.1.4-1.fc18.x86_64
pki-ca-10.0.2-5.fc18.noarch
java-1.7.0-openjdk-1.7.0.19-2.3.9.3.fc18.x86_64
selinux-policy-3.11.1-94.fc18.noarch

The temp directory seemed to hold the right permissions:

# ls -ltradZ /tmp/hsperfdata_root
drwxr-xr-x. root root system_u:object_r:pki_tomcat_tmp_t:s0 /tmp/hsperfdata_root
# rm -rf /tmp/hsperfdata_root/

# service pki-tomcatd@pki-tomcat restart
Redirecting to /bin/systemctl restart  pki-tomcatd@pki-tomcat.service
# ls -ltradZ /tmp/hsperfdata_root
drwxr-xr-x. root root system_u:object_r:pki_tomcat_tmp_t:s0 /tmp/hsperfdata_root

I am still not sure what causes this. Maybe upgrade of pki-ca package? This may explain the rpm_script_tmp_t context. Anyway, changing component to pki to decide what to do with this AVC/
Comment 5 Scott Poore 2013-05-16 14:51:41 EDT
Did you also try just installing the java-1.7.0-openjdk rpm with no hsperfdata_root dir?  And it didn't leave the dir behind with the rpm_script_tmp_t context?


Looked like only my freeipa-server was different there:

after ipa-server-install:

type=SYSCALL msg=audit(1368729091.147:1413): arch=c000003e syscall=2 success=no exit=-13 a0=7fbbfc007500 a1=242 a2=180 a3=0 items=0 ppid=1 pid=25182 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="java" exe="/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.19.x86_64/jre/bin/java" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
type=AVC msg=audit(1368729091.147:1413): avc:  denied  { write } for  pid=25182 comm="java" name="hsperfdata_root" dev="tmpfs" ino=122816 scontext=system_u:system_r:pki_tomcat_t:s0 tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir

[root@f18-6 ~]# ls -ldZ /tmp/hsperfdata_root/
drwxr-xr-x. root root unconfined_u:object_r:rpm_script_tmp_t:s0 /tmp/hsperfdata_root/

[root@f18-6 ~]# rpm -q freeipa-server pki-ca selinux-policy java-1.7.0-openjdk
freeipa-server-3.1.3-5.fc18.x86_64
pki-ca-10.0.2-5.fc18.noarch
selinux-policy-3.11.1-94.fc18.noarch
java-1.7.0-openjdk-1.7.0.19-2.3.9.3.fc18.x86_64


I did upgrade freeipa-server to 3.1.4 but saw the same there too.  not sure what the difference is.
Comment 6 Fedora End Of Life 2013-12-21 08:31:04 EST
This message is a reminder that Fedora 18 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 18. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '18'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 18's end of life.

Thank you for reporting this issue and we are sorry that we may not be 
able to fix it before Fedora 18 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior to Fedora 18's end of life.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.
Comment 7 Martin Kosek 2014-01-02 08:22:21 EST
This issue seems still valid for current Fedora version, changing the version field.
Comment 8 Fedora End Of Life 2015-05-29 05:03:38 EDT
This message is a reminder that Fedora 20 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 20. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as EOL if it remains open with a Fedora  'version'
of '20'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora 20 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.
Comment 9 Fedora End Of Life 2015-06-29 07:57:23 EDT
Fedora 20 changed to end-of-life (EOL) status on 2015-06-23. Fedora 20 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.

Note You need to log in before you can comment on or make changes to this bug.