Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.

Bug 1637931

Summary: bind-chroot: /var/named/chroot*/dev/urandom do not have correct label
Product: [Fedora] Fedora Reporter: Petr Menšík <pemensik>
Component: selinux-policyAssignee: Lukas Vrabec <lvrabec>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: unspecified    
Version: 29CC: dab0816, dwalsh, esm, lvrabec, mgrepl, pemensik, plautrba
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: selinux-policy-3.14.2-40.fc29 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-10-18 11:06:58 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1631515    
Attachments:
Description Flags
Proposed fix none

Description Petr Menšík 2018-10-10 11:05:56 UTC 
Description of problem:
After update of bind-9.11.4-9.P2.fc29, /dev/urandom was added to bind-chroot directory. Bind however fails to use it, because it has not correct label. Check bug #1631515 for error messages.

Version-Release number of selected component (if applicable):
selinux-policy-3.14.1-44.fc28

How reproducible:
always

Steps to Reproduce:
1. dnf install bind-9.11.4-10.P2.fc29 bind-chroot-9.11.4-10.P2.fc29
2. ls -lZ /var/named/chroot*/dev/urandom
3. cat /dev/random > /dev/null # drop any gathered entropy
4. systemctl start named-chroot

Actual results:
Service fails to start

type=AVC msg=audit(1538083144.528:217): avc:  denied  { open } for  pid=1762 comm="named" path="/dev/urandom" dev="dm-3" ino=1183207 scontext=system_u:system_r:named_t:s0 tcontext=system_u:object_r:named_conf_t:s0 tclass=chr_file permissive=1


Expected results:
Service can access /dev/urandom in chroot.


Additional info:
Comment 1 Petr Menšík 2018-10-10 11:11:21 UTC 
I failed to spot the requirement for it before I added /dev/urandom in chroot and the requirement for it. Until fixed by selinux-policy, it makes bind-chroot unusable on F28, F29 and rawhide.
Comment 2 Petr Menšík 2018-10-10 11:15:20 UTC 
Created attachment 1492526 [details]
Proposed fix
Comment 3 Lukas Vrabec 2018-10-15 11:22:35 UTC 
Thanks for report and fix. :) 

Author: Lukas Vrabec <lvrabec>
Date:   Mon Oct 15 13:21:00 2018 +0200

    Label correctly /var/named/chroot*/dev/unrandom in bind chroot.
    
    Thanks Petr Mensik <pmensik> for proposed patch.
    BZ(1637931)
Comment 4 Lukas Vrabec 2018-10-15 14:40:03 UTC 
*** Bug 1639340 has been marked as a duplicate of this bug. ***
Comment 5 Fedora Update System 2018-10-15 20:23:21 UTC 
selinux-policy-3.14.2-39.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2018-ce273879ac
Comment 6 Fedora Update System 2018-10-16 15:52:09 UTC 
selinux-policy-3.14.2-40.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-ce273879ac
Comment 7 Fedora Update System 2018-10-18 11:06:58 UTC 
selinux-policy-3.14.2-40.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.