Bug #44941
Updated by Brad Hubbard about 4 years ago
http://pulpito.ceph.com/bhubbard-2020-03-30_11:17:25-ceph-ansible-wip-badone-testing-distro-basic-smithi/4906560/
<pre>
# sealert -l 64d60ebc-d1ca-48df-952f-50122738be35
SELinux is preventing /usr/sbin/unix_chkpwd from execute access on the file unix_chkpwd.
***** Plugin catchall (100. confidence) suggests **************************
If you believe that unix_chkpwd should be allowed execute access on the unix_chkpwd file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'unix_chkpwd' --raw | audit2allow -M my-unixchkpwd
# semodule -X 300 -i my-unixchkpwd.pp
Additional Information:
Source Context system_u:system_r:ceph_t:s0
Target Context system_u:object_r:chkpwd_exec_t:s0
Target Objects unix_chkpwd [ file ]
Source unix_chkpwd
Source Path /usr/sbin/unix_chkpwd
Port <Unknown>
Host smithi203
Source RPM Packages pam-1.3.1-4.el8.x86_64
Target RPM Packages
Policy RPM selinux-policy-3.14.3-20.el8.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Permissive
Host Name smithi203
Platform Linux smithi203 4.18.0-147.el8.x86_64 #1 SMP Wed
Dec 4 21:51:45 UTC 2019 x86_64 x86_64
Alert Count 4
First Seen 2020-04-06 01:37:58 UTC
Last Seen 2020-04-06 01:37:58 UTC
Local ID 64d60ebc-d1ca-48df-952f-50122738be35
Raw Audit Messages
type=AVC msg=audit(1586137078.894:3325): avc: denied { execute } for pid=18585 comm="sudo" name="unix_chkpwd" dev="sda1" ino=5192 scontext=system_u:system_r:ceph_t:s0 tcontext=system_u:object_r:chkpwd_exec_t:s0 tclass=file permissive=
1
type=AVC msg=audit(1586137078.894:3325): avc: denied { read open } for pid=18585 comm="sudo" path="/usr/sbin/unix_chkpwd" dev="sda1" ino=5192 scontext=system_u:system_r:ceph_t:s0 tcontext=system_u:object_r:chkpwd_exec_t:s0 tclass=file
permissive=1
type=AVC msg=audit(1586137078.894:3325): avc: denied { execute_no_trans } for pid=18585 comm="sudo" path="/usr/sbin/unix_chkpwd" dev="sda1" ino=5192 scontext=system_u:system_r:ceph_t:s0 tcontext=system_u:object_r:chkpwd_exec_t:s0 tcla
ss=file permissive=1
type=AVC msg=audit(1586137078.894:3325): avc: denied { map } for pid=18585 comm="unix_chkpwd" path="/usr/sbin/unix_chkpwd" dev="sda1" ino=5192 scontext=system_u:system_r:ceph_t:s0 tcontext=system_u:object_r:chkpwd_exec_t:s0 tclass=fil
e permissive=1
type=SYSCALL msg=audit(1586137078.894:3325): arch=x86_64 syscall=execve success=yes exit=0 a0=7f1db152a74a a1=7ffffbc9a690 a2=7f1db172d028 a3=7ffffbc9a640 items=0 ppid=18582 pid=18585 auid=4294967295 uid=0 gid=167 euid=0 suid=0 fsuid=0 e
gid=167 sgid=167 fsgid=167 tty=(none) ses=4294967295 comm=unix_chkpwd exe=/usr/sbin/unix_chkpwd subj=system_u:system_r:ceph_t:s0 key=(null)
Hash: unix_chkpwd,ceph_t,chkpwd_exec_t,file,execute
# ausearch -c 'sudo' --raw | audit2allow -M my-sudo && cat my-sudo.te
******************** IMPORTANT ***********************
To make this policy package active, execute:
semodule -i my-sudo.pp
module my-sudo 1.0;
require {
type sudo_exec_t;
type initrc_var_run_t;
type ceph_t;
class file { execute execute_no_trans lock map open read };
class capability { audit_write sys_resource };
class process setrlimit;
class netlink_audit_socket { create nlmsg_relay };
}
#============= ceph_t ==============
allow ceph_t initrc_var_run_t:file { lock open read };
allow ceph_t self:capability { audit_write sys_resource };
allow ceph_t self:netlink_audit_socket { create nlmsg_relay };
allow ceph_t self:process setrlimit;
#!!!! This avc can be allowed using the boolean 'domain_can_mmap_files'
allow ceph_t sudo_exec_t:file map;
allow ceph_t sudo_exec_t:file { execute execute_no_trans open read };
</pre>