https://bugzilla.redhat.com/show_bug.cgi?id=2227057
Buvanesh Kumar <bsivasub(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |COMPLETED
Status|NEW |CLOSED
Last Closed| |2023-07-31 10:30:46
--- Comment #4 from Buvanesh Kumar <bsivasub(a)redhat.com> ---
The issue is due to the fact that I copied krb5.conf file from one laptop to an
another, and missed to fix the SELinux labelling afterwards.
In short note, I had to run `$ sudo restorecon -Rv /etc/` to fix the labelling.
Longer version:
The service status for sssd-kcm.socket (note: it is sssd-kcm.socket, not
sssd-kcm or sssd-kcm.service) showed as failed, as soon as I start executing
kinit:
அ ~ sudo systemctl status sssd-kcm.socket
● sssd-kcm.socket - SSSD Kerberos Cache Manager responder socket
Loaded: loaded (/usr/lib/systemd/system/sssd-kcm.socket; enabled; preset:
enabled)
Active: active (listening) since Mon 2023-07-31 12:01:27 CEST; 3s ago
Triggers: ● sssd-kcm.service
Docs: man:sssd-kcm(8)
Listen: /run/.heim_org.h5l.kcm-socket (Stream)
CGroup: /system.slice/sssd-kcm.socket
அ ~ kinit
kinit: Connection reset by peer while getting default ccache
அ ~ sudo systemctl status sssd-kcm.socket
× sssd-kcm.socket - SSSD Kerberos Cache Manager responder socket
Loaded: loaded (/usr/lib/systemd/system/sssd-kcm.socket; enabled; preset:
enabled)
Active: failed (Result: service-start-limit-hit) since Mon 2023-07-31
12:02:31 CEST; 1s ago
Duration: 1min 3.645s
Triggers: ● sssd-kcm.service
Docs: man:sssd-kcm(8)
Listen: /run/.heim_org.h5l.kcm-socket (Stream)
Jul 31 12:01:27 fedora systemd[1]: Listening on sssd-kcm.socket - SSSD Kerberos
Cache Manager responder socket.
Jul 31 12:02:31 fedora systemd[1]: sssd-kcm.socket: Failed with result
'service-start-limit-hit'.
I was missing files related to sssd-* packages, I have reinstalled sssd-kcm to
fix it.
அ ~ rpm --verify sssd-common sssd-kcm
missing /etc/sssd
missing /etc/sssd/conf.d
missing /etc/sssd/pki
.......T. /usr/lib/systemd/system/sssd.service
.M....... /var/log/sssd
அ ~ sudo dnf reinstall sssd-kcm
அ ~ rpm --verify sssd-kcm
< no output, that means we are good >
I tried kinit again, and I still saw the same issue.
I have inspected the SELinux warnings and found inappropriate labelling.
அ ~ sudo ausearch -m avc -ts recent
----
time->Mon Jul 31 11:58:56 2023
type=AVC msg=audit(1690797536.716:793): avc: denied { read } for pid=20207
comm="sssd_kcm" name="krb5.conf" dev="nvme0n1p8" ino=278998
scontext=system_u:system_r:sssd_t:s0
tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=0
----
time->Mon Jul 31 11:58:56 2023
type=AVC msg=audit(1690797536.824:796): avc: denied { read } for pid=20210
comm="sssd_kcm" name="krb5.conf" dev="nvme0n1p8" ino=278998
scontext=system_u:system_r:sssd_t:s0
tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=0
----
time->Mon Jul 31 11:58:56 2023
type=AVC msg=audit(1690797536.933:799): avc: denied { read } for pid=20212
comm="sssd_kcm" name="krb5.conf" dev="nvme0n1p8" ino=278998
scontext=system_u:system_r:sssd_t:s0
tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=0
----
time->Mon Jul 31 11:58:57 2023
type=AVC msg=audit(1690797537.028:802): avc: denied { read } for pid=20215
comm="sssd_kcm" name="krb5.conf" dev="nvme0n1p8" ino=278998
scontext=system_u:system_r:sssd_t:s0
tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=0
----
time->Mon Jul 31 11:58:57 2023
type=AVC msg=audit(1690797537.142:805): avc: denied { read } for pid=20217
comm="sssd_kcm" name="krb5.conf" dev="nvme0n1p8" ino=278998
scontext=system_u:system_r:sssd_t:s0
tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=0
அ ~ ls -lZ /etc/krb5.conf
-rw-r--r--. 1 bsivasub bsivasub unconfined_u:object_r:user_home_t:s0 1163 Jul
26 03:33 /etc/krb5.conf
Fixed the SELinux labelling using
$ sudo restorecon -Rv /etc/
I have also fixed the file permissions for /etc/krb5.conf file by using
$ rpm --restore krb5-libs
Finally, I was able to do kinit without an issue.
Thanks a lot to Lukas for the help and guidance :).
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2227057
Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=rep...