Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-123225

Kerberos5 files ".{k5login,k5users,k5identity}" are not getting proper label for "pgsql" user

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • selinux-policy-38.1.68-1.el9
    • No
    • Low
    • 1
    • rhel-security-selinux
    • 14
    • 1
    • QE ack
    • False
    • False
    • Hide

      None

      Show
      None
    • No
    • SELINUX 251119: 15
    • Release Note Not Required
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      What were you trying to do that didn't work?

      As per policy <HOMEDIR>/.k5login and similar files have to get label krb5_home_t:

      # semanage fcontext -l | grep k5login
/home/[^/]+/\.k5login                              regular file       unconfined_u:object_r:krb5_home_t:s0 
/home/staff/\.k5login                              regular file       staff_u:object_r:krb5_home_t:s0 
/home/sysadm/\.k5login                             regular file       sysadm_u:object_r:krb5_home_t:s0 
/root/\.k5login                                    regular file       system_u:object_r:krb5_home_t:s0

      For pgsql user, which is special since it has home directory /var/lib/pgsql and that directory is labeled with postgresql_db_t, the files do not get the proper label, but inherit the label of the home directory:

      # matchpathcon /var/lib/pgsql/.k5login
/var/lib/pgsql/.k5login	system_u:object_r:postgresql_db_t:s0

      This breaks Kerberos usage for pgsql user.

      Please add the necessary fcontext and rules in the policy:

      # semanage fcontext -a -t krb5_home_t /var/lib/pgsql/\.k5login
# semanage fcontext -a -t krb5_home_t /var/lib/pgsql/\.k5users
# semanage fcontext -a -t krb5_home_t /var/lib/pgsql/\.k5identity

# cat pgsqlhomedir_krb5.te
[...]
filetrans_pattern(named_filetrans_domain, postgresql_db_t, krb5_home_t, file, ".k5login")
filetrans_pattern(named_filetrans_domain, postgresql_db_t, krb5_home_t, file, ".k5users")
filetrans_pattern(named_filetrans_domain, postgresql_db_t, krb5_home_t, file, ".k5identity")

      What is the impact of this issue to you?

      Breaks Kerberos when /var/lib/pgsql gets relabeled.

      Please provide the package NVR for which the bug is seen:

      All OS releases.

              rhn-support-zpytela Zdenek Pytela
              rhn-support-rmetrich Renaud Métrich
              Zdenek Pytela Zdenek Pytela
              Milos Malik Milos Malik
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

                Created:
                Updated: