50 lines
3.3 KiB
Diff
50 lines
3.3 KiB
Diff
From e1fe6ba8a75ff66e506e7d80b4d8ccb8f899ec39 Mon Sep 17 00:00:00 2001
|
|
From: Zdenek Pytela <zpytela@redhat.com>
|
|
Date: Wed, 24 May 2023 16:39:11 +0200
|
|
Subject: [PATCH] Allow rpcd_lsad setcap and use generic ptys
|
|
|
|
Allow /usr/libexec/samba/rpcd_lsad running in the winbind_rpcd_t domain
|
|
the setcap permission to use capset(2) and use generic ptys when a request
|
|
to change a password is made. Note winbind_rpcd_t is not in the daemon
|
|
attribute which is a subject of the daemons_use_tty boolean.
|
|
|
|
The commit addresses the following AVC denials:
|
|
|
|
type=PROCTITLE msg=audit(05/23/2023 15:45:49.588:911) : proctitle=/usr/libexec/samba/rpcd_lsad --configfile=/etc/samba/smb.conf --worker-group=2 --worker-index=0 --debuglevel=0
|
|
type=PATH msg=audit(05/23/2023 15:45:49.588:911) : item=0 name=/dev/pts/2 nametype=UNKNOWN cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
|
|
type=SYSCALL msg=audit(05/23/2023 15:45:49.588:911) : arch=x86_64 syscall=stat success=no exit=EACCES(Permission denied) a0=0x7ffce321e8c0 a1=0x7ffce321e830 a2=0x7ffce321e830 a3=0x0 items=1 ppid=129672 pid=129682 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=rpcd_lsad exe=/usr/libexec/samba/rpcd_lsad subj=system_u:system_r:winbind_rpcd_t:s0 key=(null)
|
|
type=AVC msg=audit(05/23/2023 15:45:49.588:911) : avc: denied { search } for pid=129682 comm=rpcd_lsad name=/ dev="devpts" ino=1 scontext=system_u:system_r:winbind_rpcd_t:s0 tcontext=system_u:object_r:devpts_t:s0 tclass=dir permissive=0
|
|
|
|
type=PROCTITLE msg=audit(05/24/2023 03:08:08.440:1130) : proctitle=/usr/libexec/samba/rpcd_lsad --configfile=/etc/samba/smb.conf --worker-group=2 --worker-index=0 --debuglevel=0
|
|
type=SYSCALL msg=audit(05/24/2023 03:08:08.440:1130) : arch=x86_64 syscall=capset success=no exit=EACCES(Permission denied) a0=0x561752d238b4 a1=0x561752d238bc a2=0x561752d238bc a3=0x7ffd6edcd904 items=0 ppid=164904 pid=164906 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=rpcd_lsad exe=/usr/libexec/samba/rpcd_lsad subj=system_u:system_r:winbind_rpcd_t:s0 key=(null)
|
|
type=AVC msg=audit(05/24/2023 03:08:08.440:1130) : avc: denied { setcap } for pid=164906 comm=rpcd_lsad scontext=system_u:system_r:winbind_rpcd_t:s0 tcontext=system_u:system_r:winbind_rpcd_t:s0 tclass=process permissive=0
|
|
|
|
Resolves: rhbz#2107106
|
|
---
|
|
policy/modules/contrib/samba.te | 5 +++++
|
|
1 file changed, 5 insertions(+)
|
|
|
|
diff --git a/policy/modules/contrib/samba.te b/policy/modules/contrib/samba.te
|
|
index 9847d3da29..1a90ca864f 100644
|
|
--- a/policy/modules/contrib/samba.te
|
|
+++ b/policy/modules/contrib/samba.te
|
|
@@ -1173,6 +1173,7 @@ optional_policy(`
|
|
allow winbind_rpcd_t self:capability { setgid setuid };
|
|
allow winbind_rpcd_t self:key { read write };
|
|
allow winbind_rpcd_t self:netlink_route_socket create_netlink_socket_perms;
|
|
+allow winbind_rpcd_t self:process setcap;
|
|
allow winbind_rpcd_t self:unix_dgram_socket { create_socket_perms sendto };
|
|
allow winbind_rpcd_t self:unix_stream_socket connectto;
|
|
allow winbind_rpcd_t self:udp_socket create_socket_perms;
|
|
@@ -1268,6 +1269,10 @@ optional_policy(`
|
|
systemd_userdbd_stream_connect(winbind_rpcd_t)
|
|
')
|
|
|
|
+optional_policy(`
|
|
+ term_use_generic_ptys(winbind_rpcd_t)
|
|
+')
|
|
+
|
|
optional_policy(`
|
|
unconfined_dgram_send(winbind_rpcd_t)
|
|
')
|