From: Corey Penford <coreypenford@live.com>
To: "selinux@vger.kernel.org" <selinux@vger.kernel.org>
Subject: krb5 policy bug
Date: Mon, 25 May 2020 19:11:32 +0000 [thread overview]
Message-ID: <DM6PR04MB39612BE67CD37ECE829EEEE2A5B30@DM6PR04MB3961.namprd04.prod.outlook.com> (raw)
This is happening on Fedora MATE, release 31. This workstation is domain joined via realm/sssd. Latest updates are all installed and workstation was rebooted.
This only started happening recently enough, but it’s hard to tell if it was a regression in a selinux policy update, or if the behaviour is related to working from home.. I am running XRDP on the Linux workstation at the office, and using a Windows laptop using the Windows RDP client to connect to it from home.
This seems to happen every time the screen locks via timeout on the Linux workstation over my RDP connection. I can’t reproduce it by locking manually, it seems to only happen when the screen locks via the 15 minute inactivity timer, and then goes black from no mouse movement.
Any further info I can provide let me know
------------------------------------------------
SELinux is preventing krb5_child from read access on the key labeled unconfined_service_t.
***** Plugin catchall (100. confidence) suggests **************************
If you believe that krb5_child should be allowed read access on key labeled unconfined_service_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'krb5_child' --raw | audit2allow -M my-krb5child
# semodule -X 300 -i my-krb5child.pp
Additional Information:
Source Context system_u:system_r:sssd_t:s0
Target Context system_u:system_r:unconfined_service_t:s0
Target Objects Unknown [ key ]
Source krb5_child
Source Path krb5_child
Port <Unknown>
Host PW948
Source RPM Packages
Target RPM Packages
SELinux Policy RPM selinux-policy-targeted-3.14.4-50.fc31.noarch
Local Policy RPM selinux-policy-targeted-3.14.4-50.fc31.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name PW948
Platform Linux PW948 5.6.13-200.fc31.x86_64 #1 SMP Thu May
14 23:26:14 UTC 2020 x86_64 x86_64
Alert Count 4
First Seen 2020-05-25 14:57:27 EDT
Last Seen 2020-05-25 14:57:27 EDT
Local ID d1ee27bb-6ce3-401d-ba7f-45935ad0c3d2
Raw Audit Messages
type=AVC msg=audit(1590433047.446:422): avc: denied { read } for pid=12279 comm="krb5_child" scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=key permissive=0
Hash: krb5_child,sssd_t,unconfined_service_t,key,read
next reply other threads:[~2020-05-25 19:11 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-25 19:11 Corey Penford [this message]
2020-05-29 13:46 ` krb5 policy bug Stephen Smalley
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DM6PR04MB39612BE67CD37ECE829EEEE2A5B30@DM6PR04MB3961.namprd04.prod.outlook.com \
--to=coreypenford@live.com \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).