Hello,
I am running into problem with krb5kdc and SELinux. Version information:
selinux-policy-targeted-1.25.3-12 kernel-2.6.12-1.1398_FC4 krb5-server-1.4.1-5
I was working with SELinux targeted and enforcing but I was having problems with kadmin so I decided to disable SELinux using /etc/sysconfig/selinux and reboot. This solved my kadmin problem so I decided to re-enable SELinux so that I could capture traces to raise a bug.
When I rebooted with SELinux enabled krb5kdc failed to start and I had the following in /var/log/audit/audit.log:
type=AVC msg=audit(1125672380.961:124865): avc: denied { getattr } for pid=1836 comm="krb5kdc" name="krb5kdc_rcache" dev=dm-0 ino=552323 scontext=root:system_r:krb5kdc_t tcontext=system_u:object_r:file_t tclass=file type=SYSCALL msg=audit(1125672380.961:124865): arch=40000003 syscall=195 success=no exit=-13 a0=90a3af0 a1=bff5d968 a2=3a4ff4 a3=0 items=1 pid=1836 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm="krb5kdc" exe="/usr/kerberos/sbin/krb5kdc" type=AVC_PATH msg=audit(1125672380.961:124865): path="/var/tmp/krb5kdc_rcache" type=CWD msg=audit(1125672380.961:124865): cwd="/" type=PATH msg=audit(1125672380.961:124865): item=0 name="/var/tmp/krb5kdc_rcache" flags=1 inode=552323 dev=fd:00 mode=0100600 ouid=0 ogid=0 rdev=00:00
and in the log /var/log/krb5kdc.log:
krb5kdc: Permission denied in replay cache code - while initializing KDC replay cache 'dfl:krb5kdc_rcache'
Is this a known issue, or should I Bugzilla it?
Thanks,
Keith.
On Fri, 2005-09-02 at 15:52 +0100, Keith Sharp wrote:
Hello,
I am running into problem with krb5kdc and SELinux. Version information:
selinux-policy-targeted-1.25.3-12 kernel-2.6.12-1.1398_FC4 krb5-server-1.4.1-5
I was working with SELinux targeted and enforcing but I was having problems with kadmin so I decided to disable SELinux using /etc/sysconfig/selinux and reboot. This solved my kadmin problem so I decided to re-enable SELinux so that I could capture traces to raise a bug.
When I rebooted with SELinux enabled krb5kdc failed to start and I had the following in /var/log/audit/audit.log:
type=AVC msg=audit(1125672380.961:124865): avc: denied { getattr } for pid=1836 comm="krb5kdc" name="krb5kdc_rcache" dev=dm-0 ino=552323 scontext=root:system_r:krb5kdc_t tcontext=system_u:object_r:file_t tclass=file type=SYSCALL msg=audit(1125672380.961:124865): arch=40000003 syscall=195 success=no exit=-13 a0=90a3af0 a1=bff5d968 a2=3a4ff4 a3=0 items=1 pid=1836 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm="krb5kdc" exe="/usr/kerberos/sbin/krb5kdc" type=AVC_PATH msg=audit(1125672380.961:124865): path="/var/tmp/krb5kdc_rcache" type=CWD msg=audit(1125672380.961:124865): cwd="/" type=PATH msg=audit(1125672380.961:124865): item=0 name="/var/tmp/krb5kdc_rcache" flags=1 inode=552323 dev=fd:00 mode=0100600 ouid=0 ogid=0 rdev=00:00
and in the log /var/log/krb5kdc.log:
krb5kdc: Permission denied in replay cache code - while initializing KDC replay cache 'dfl:krb5kdc_rcache'
Is this a known issue, or should I Bugzilla it?
Looks like the file /var/tmp/krb5kdc_rcache doesn't have a security context:
[root@server ~]# ls -alZ /var/tmp/ drwxrwxrwt root root system_u:object_r:tmp_t . drwxr-xr-x root root system_u:object_r:var_t .. -rw------- root root root:object_r:kadmind_tmp_t kadmin_0 -rw------- root root krb5kdc_rcache
How should I go about fixing this?
Thanks,
Keith.
On Fri, 2005-09-02 at 16:37 +0100, Keith Sharp wrote:
Looks like the file /var/tmp/krb5kdc_rcache doesn't have a security context:
[root@server ~]# ls -alZ /var/tmp/ drwxrwxrwt root root system_u:object_r:tmp_t . drwxr-xr-x root root system_u:object_r:var_t .. -rw------- root root root:object_r:kadmind_tmp_t kadmin_0 -rw------- root root krb5kdc_rcache
How should I go about fixing this?
This is a result of previously booting with SELinux disabled; while SELinux is disabled, any files created won't be assigned security contexts. Switching to permissive mode is better than disabling SELinux entirely, and can be done temporarily with /usr/sbin/setenforce 0 without needing to touch /etc/selinux/config or reboot. That continues to label files but allows all accesses and just logs the denials for review in the audit.log.
Assuming that this file is just a temporary cache, I'd suggest removing it (or moving it aside), and then restart the process that created it in the first place with SELinux enabled (but permissive, if necessary).
Possibly fixfiles relabel needs to purge /var/tmp as well as /tmp?
On Fri, 2005-09-02 at 12:07 -0400, Stephen Smalley wrote:
On Fri, 2005-09-02 at 16:37 +0100, Keith Sharp wrote:
Looks like the file /var/tmp/krb5kdc_rcache doesn't have a security context:
[root@server ~]# ls -alZ /var/tmp/ drwxrwxrwt root root system_u:object_r:tmp_t . drwxr-xr-x root root system_u:object_r:var_t .. -rw------- root root root:object_r:kadmind_tmp_t kadmin_0 -rw------- root root krb5kdc_rcache
How should I go about fixing this?
This is a result of previously booting with SELinux disabled; while SELinux is disabled, any files created won't be assigned security contexts. Switching to permissive mode is better than disabling SELinux entirely, and can be done temporarily with /usr/sbin/setenforce 0 without needing to touch /etc/selinux/config or reboot. That continues to label files but allows all accesses and just logs the denials for review in the audit.log.
Assuming that this file is just a temporary cache, I'd suggest removing it (or moving it aside), and then restart the process that created it in the first place with SELinux enabled (but permissive, if necessary).
Removing the file and re-running "service krb5kdc start" seems to have solved the problem.
Thanks,
Keith.
selinux@lists.fedoraproject.org