Issue 7391 - Harden systemd service unit#7392
Conversation
progier389
added
the
work in progress
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
|
Congratulations! One of the builds has completed. 🍾 You can install the built RPMs by following these steps:
Please note that the RPMs should be used only in a testing environment. |
| type=AVC msg=audit(1775741107.400:9691): avc: denied { nnp_transition } for pid=980206 comm="(ns-slapd)" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:dirsrv_t:s0 tclass=process2 permissive=0 | ||
| type=AVC msg=audit(1775833368.436:10776): avc: denied { nnp_transition } for pid=1113882 comm="(ap-agent)" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:dirsrv_snmp_t:s0 tclass=process2 permissive=0 | ||
| type=AVC msg=audit(1775833368.442:10778): avc: denied { read } for pid=1113882 comm="ldap-agent" name="ldap-agent.conf" dev="dm-0" ino=12772110 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:dirsrv_config_t:s0 tclass=file permissive=0 | ||
| type=AVC msg=audit(1775834425.008:10833): avc: denied { dac_override } for pid=1114135 comm="ldap-agent" capability=1 scontext=system_u:system_r:dirsrv_snmp_t:s0 tcontext=system_u:system_r:dirsrv_snmp_t:s0 tclass=capability permissive=0 |
There was a problem hiding this comment.
dac_override is concerning, I think we should change the default user for ldap-agent to dirsrv, instead of running it as root.
There was a problem hiding this comment.
I agree that there should not be any dac_ovrride
But if I remember rightly ldap-agent uid must be root to be able to connect to snmpd.
IMHO the permission of some config files (memory map ? ldap-agent.conf ? dse.ldif ? ) are wrong and should allow read to dirsrv group
| if [ -f /usr/sbin/sestatus ] ; then | ||
| pushd /var/run/dirsrv >/dev/null | ||
| /usr/bin/audit2allow -M ns-slapd-test >/dev/null <<! | ||
| type=AVC msg=audit(1775741107.400:9691): avc: denied { nnp_transition } for pid=980206 comm="(ns-slapd)" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:dirsrv_t:s0 tclass=process2 permissive=0 |
There was a problem hiding this comment.
Looks like we need to file a bug against selinux-policy in Fedora and RHEL if want to make this work.
There was a problem hiding this comment.
Looks like we need to file a bug against selinux-policy in Fedora and RHEL if want to make this work.
Definitively !
Current work-around is only for test purpose.
We need to change the SELinux before being able to merge this PR
But something looks strange with snmp:
snmpwalk -v3 -u user_name -M /usr/share/snmp/mibs:/usr/share/dirsrv/mibs/ -l AuthPriv -m +RHDS-MIB -A authentication_password -a SHA -X private_password -x AES localhost .1.3.6.1.4.1.2312.6.1.1
RHDS-MIB::dsAnonymousBinds.389 = Counter64: 0
RHDS-MIB::dsUnAuthBinds.389 = Counter64: 0
RHDS-MIB::dsSimpleAuthBinds.389 = Counter64: 0
RHDS-MIB::dsStrongAuthBinds.389 = Counter64: 0
RHDS-MIB::dsBindSecurityErrors.389 = Counter64: 0
...
but:
ldapsearch -H ldap://localhost:389 -D "cn=directory manager" -w secret12 -b cn=snmp,cn=monitor
# extended LDIF
#
# LDAPv3
# base <cn=snmp,cn=monitor> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# snmp, monitor
dn: cn=snmp,cn=monitor
objectClass: top
objectClass: extensibleObject
cn: snmp
anonymousbinds: 0
unauthbinds: 0
simpleauthbinds: 4
strongauthbinds: 0
bindsecurityerrors: 1
...
od -x /var/run/dirsrv/slapd-i2.stats seems ok
but I do not see any error in dirsrv-agent log nor in dirsrv logs and no AVC is reported ...
There was a problem hiding this comment.
2026-04-13 13:18:42 Opening stats file (/run/dirsrv/slapd-localhost.stat) for server: 389
2026-04-13 13:18:42 Unable to open stats file (/run/dirsrv/slapd-localhost.stat) for server: 389
But the file name is /run/dirsrv/slapd-localhost.stats. Looks like a regression from 00a3e07.
Should be:
- snprintf(serv_p->stats_file, vlen + strlen(instancename) + 7,
+ snprintf(serv_p->stats_file, vlen + strlen(instancename) + 8,
There was a problem hiding this comment.
FYI: In the mean time I realised that the problem was occuring in main branch too and
created
#7406
|
Created https://redhat.atlassian.net/browse/RHEL-167849 to update RHEL SELinux policy |
|
Apparently the following command avoid the dac_override |
2 participants
Set NoNewPrivileges and MemoryDenyWriteExecute settings in systemd unit
Issue: #7391
Reviewed by: ?
Summary by Sourcery
Enhancements: