[SSSD] NSS not communicating with SSSD?

Jakub Hrozek jhrozek at redhat.com
Sat Dec 15 18:13:38 UTC 2012


On Fri, Dec 14, 2012 at 02:21:53PM -0800, Andrew Wygle wrote:
> I'm sorry, I posted the wrong log (that one happened when I mistyped the
> password). Here is the correct log.
> 
> 
> type=AVC msg=audit(1355523501.987:486): avc:  denied  { write } for 
> pid=22109 comm="sshd" name="nss" dev=dm-0 ino=157542
> scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023
> tcontext=unconfined_u:object_r:usr_t:s0 tclass=sock_file
> type=SYSCALL msg=audit(1355523501.987:486): arch=c000003e syscall=42
> success=no exit=-13 a0=6 a1=7fff48f503d0 a2=6e a3=7fff48f50090 items=0
> ppid=1089 pid=22109 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
> egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sshd"
> exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023
> key=(null)

I would try running restorecon -Rv /var/lib/sss to check if that makes
the socket_file related denials go away.

For the record, our QE is not seeing any avc denials on 6.4 with the 6.4
selinux-policy.

> type=CRYPTO_KEY_USER msg=audit(1355523501.994:487): user pid=22110 uid=0
> auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023
> msg='op=destroy kind=server
> fp=0c:6b:5a:ef:71:df:1e:93:b3:71:b2:07:2c:8a:b4:77 direction=? spid=22110
> suid=0  exe="/usr/sbin/sshd" hostname=? addr=127.0.0.1 terminal=?
> res=success'
> type=CRYPTO_KEY_USER msg=audit(1355523501.994:488): user pid=22110 uid=0
> auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023
> msg='op=destroy kind=server
> fp=e5:97:d7:29:ee:6c:08:9b:b3:b7:bf:9e:6c:6b:6f:58 direction=? spid=22110
> suid=0  exe="/usr/sbin/sshd" hostname=? addr=127.0.0.1 terminal=?
> res=success'
> type=CRYPTO_SESSION msg=audit(1355523501.995:489): user pid=22109 uid=0
> auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023
> msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=22110
> suid=74 rport=60904 laddr=127.0.0.1 lport=22  exe="/usr/sbin/sshd"
> hostname=? addr=127.0.0.1 terminal=? res=success'
> type=CRYPTO_SESSION msg=audit(1355523501.996:490): user pid=22109 uid=0
> auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023
> msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=22110
> suid=74 rport=60904 laddr=127.0.0.1 lport=22  exe="/usr/sbin/sshd"
> hostname=? addr=127.0.0.1 terminal=? res=success'
> type=AVC msg=audit(1355523505.099:491): avc:  denied  { write } for 
> pid=22109 comm="sshd" name="nss" dev=dm-0 ino=157542
> scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023
> tcontext=unconfined_u:object_r:usr_t:s0 tclass=sock_file
> type=SYSCALL msg=audit(1355523505.099:491): arch=c000003e syscall=42
> success=no exit=-13 a0=4 a1=7fff48f50150 a2=6e a3=9 items=0 ppid=1089
> pid=22109 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
> fsgid=0 tty=(none) ses=4294967295 comm="sshd" exe="/usr/sbin/sshd"
> subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
> type=AVC msg=audit(1355523505.514:492): avc:  denied  { getattr } for 
> pid=22109 comm="sshd" path="/usr/var/lib/sss/pipes/private/pam" dev=dm-0
> ino=157546 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023
> tcontext=unconfined_u:object_r:usr_t:s0 tclass=sock_file
> type=SYSCALL msg=audit(1355523505.514:492): arch=c000003e syscall=4
> success=no exit=-13 a0=7f758004de28 a1=7fff48f501b0 a2=7fff48f501b0 a3=0
> items=0 ppid=1089 pid=22109 auid=4294967295 uid=0 gid=0 euid=0 suid=0
> fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sshd"
> exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023
> key=(null)
> type=USER_ACCT msg=audit(1355523505.514:493): user pid=22109 uid=0
> auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023
> msg='op=PAM:accounting acct="bob" exe="/usr/sbin/sshd"
> hostname=REDACTED.domain.net addr=127.0.0.1 terminal=ssh res=failed'
> type=USER_AUTH msg=audit(1355523505.517:494): user pid=22109 uid=0
> auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023
> msg='op=password acct="bob" exe="/usr/sbin/sshd" hostname=? addr=127.0.0.1
> terminal=ssh res=failed'
> type=CRYPTO_KEY_USER msg=audit(1355523505.517:495): user pid=22109 uid=0
> auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023
> msg='op=destroy kind=session fp=? direction=both spid=22110 suid=74
> rport=60904 laddr=127.0.0.1 lport=22  exe="/usr/sbin/sshd" hostname=?
> addr=127.0.0.1 terminal=? res=success'
> type=CRYPTO_KEY_USER msg=audit(1355523505.518:496): user pid=22109 uid=0
> auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023
> msg='op=destroy kind=server
> fp=0c:6b:5a:ef:71:df:1e:93:b3:71:b2:07:2c:8a:b4:77 direction=? spid=22109
> suid=0  exe="/usr/sbin/sshd" hostname=? addr=127.0.0.1 terminal=?
> res=success'
> type=CRYPTO_KEY_USER msg=audit(1355523505.518:497): user pid=22109 uid=0
> auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023
> msg='op=destroy kind=server
> fp=e5:97:d7:29:ee:6c:08:9b:b3:b7:bf:9e:6c:6b:6f:58 direction=? spid=22109
> suid=0  exe="/usr/sbin/sshd" hostname=? addr=127.0.0.1 terminal=?
> res=success'
> type=USER_LOGIN msg=audit(1355523505.518:498): user pid=22109 uid=0
> auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023
> msg='op=login acct="bob" exe="/usr/sbin/sshd" hostname=? addr=127.0.0.1
> terminal=ssh res=failed'
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel



More information about the sssd-devel mailing list