> On 21 May 2018, at 21:39, Fabiano Fidêncio <fiden...@redhat.com> wrote: > > People, > > I've been trying to debug a SELinux issue related to the domain > resolution order. > > Basically, if there's no domain_reoslution_order set: > [root@client1 vagrant]# ssh -l admin localhost > Password: > Last login: Mon May 21 19:00:06 2018 from ::1 > [admin@client1 ~]$ id -Z > staff_u:staff_r:staff_t:s0-s0:c0.c1023 > > But, if domain_resolution_order is set: > [root@client1 vagrant]# ssh -l admin localhost > Password: > Last login: Mon May 21 19:30:45 2018 from ::1 > [admin@ipa.example@client1 ~]$ id -Z > unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
Since sssd calls into libsemanage, then I would start with looking at the output of “semanage login -l”. Is the context after selinux_child runs to completion set for admin or admin@ipa.example? Maybe libsemanage canonicalizes the name or UID with getpnam/uid and therefore uses the qualified name but because the provider has no sense of the domain_resolution_order, it calls sss_set_seuser() with the shortname? Looking at whether we call sss_set_seuser() with the correct parameters might give some hint as well. > > First thing that came to my mind was to take a look at > selinux_child.logs, but it didn't give me any clue as the logs are > exactly the same for both cases: > > No domain_resolution_order set: > (Mon May 21 19:30:44 2018) [[sssd[selinux_child[23351]]]] [main] > (0x0400): selinux_child started. > (Mon May 21 19:30:44 2018) [[sssd[selinux_child[23351]]]] [main] > (0x2000): Running with effective IDs: [0][0]. > (Mon May 21 19:30:44 2018) [[sssd[selinux_child[23351]]]] [main] > (0x2000): Running with real IDs [0][0]. > (Mon May 21 19:30:44 2018) [[sssd[selinux_child[23351]]]] [main] > (0x0400): context initialized > (Mon May 21 19:30:44 2018) [[sssd[selinux_child[23351]]]] > [unpack_buffer] (0x2000): seuser length: 7 > (Mon May 21 19:30:44 2018) [[sssd[selinux_child[23351]]]] > [unpack_buffer] (0x2000): seuser: staff_u > (Mon May 21 19:30:44 2018) [[sssd[selinux_child[23351]]]] > [unpack_buffer] (0x2000): mls_range length: 14 > (Mon May 21 19:30:44 2018) [[sssd[selinux_child[23351]]]] > [unpack_buffer] (0x2000): mls_range: s0-s0:c0.c1023 > (Mon May 21 19:30:44 2018) [[sssd[selinux_child[23351]]]] > [unpack_buffer] (0x2000): username length: 5 > (Mon May 21 19:30:44 2018) [[sssd[selinux_child[23351]]]] > [unpack_buffer] (0x2000): username: admin > (Mon May 21 19:30:44 2018) [[sssd[selinux_child[23351]]]] [main] > (0x0400): performing selinux operations > (Mon May 21 19:30:44 2018) [[sssd[selinux_child[23351]]]] > [seuser_needs_update] (0x2000): getseuserbyname: ret: 0 seuser: > staff_u mls: s0-s0:c0.c1023 > (Mon May 21 19:30:44 2018) [[sssd[selinux_child[23351]]]] > [pack_buffer] (0x0400): result [0] > (Mon May 21 19:30:44 2018) [[sssd[selinux_child[23351]]]] > [prepare_response] (0x4000): r->size: 4 > (Mon May 21 19:30:44 2018) [[sssd[selinux_child[23351]]]] [main] > (0x0400): selinux_child completed successfully > > domain_resolution_order set: > (Mon May 21 19:31:36 2018) [[sssd[selinux_child[23398]]]] [main] > (0x0400): selinux_child started. > (Mon May 21 19:31:36 2018) [[sssd[selinux_child[23398]]]] [main] > (0x2000): Running with effective IDs: [0][0]. > (Mon May 21 19:31:36 2018) [[sssd[selinux_child[23398]]]] [main] > (0x2000): Running with real IDs [0][0]. > (Mon May 21 19:31:36 2018) [[sssd[selinux_child[23398]]]] [main] > (0x0400): context initialized > (Mon May 21 19:31:36 2018) [[sssd[selinux_child[23398]]]] > [unpack_buffer] (0x2000): seuser length: 7 > (Mon May 21 19:31:36 2018) [[sssd[selinux_child[23398]]]] > [unpack_buffer] (0x2000): seuser: staff_u > (Mon May 21 19:31:36 2018) [[sssd[selinux_child[23398]]]] > [unpack_buffer] (0x2000): mls_range length: 14 > (Mon May 21 19:31:36 2018) [[sssd[selinux_child[23398]]]] > [unpack_buffer] (0x2000): mls_range: s0-s0:c0.c1023 > (Mon May 21 19:31:36 2018) [[sssd[selinux_child[23398]]]] > [unpack_buffer] (0x2000): username length: 5 > (Mon May 21 19:31:36 2018) [[sssd[selinux_child[23398]]]] > [unpack_buffer] (0x2000): username: admin > (Mon May 21 19:31:36 2018) [[sssd[selinux_child[23398]]]] [main] > (0x0400): performing selinux operations > (Mon May 21 19:31:36 2018) [[sssd[selinux_child[23398]]]] > [seuser_needs_update] (0x2000): getseuserbyname: ret: 0 seuser: > staff_u mls: s0-s0:c0.c1023 > (Mon May 21 19:31:36 2018) [[sssd[selinux_child[23398]]]] > [pack_buffer] (0x0400): result [0] > (Mon May 21 19:31:36 2018) [[sssd[selinux_child[23398]]]] > [prepare_response] (0x4000): r->size: 4 > (Mon May 21 19:31:36 2018) [[sssd[selinux_child[23398]]]] [main] > (0x0400): selinux_child completed successfully > > Taking a look at the IPA provider, logs also do like the very same: > https://paste.fedoraproject.org/paste/FKhvxyj3clzXuE5C7tMGhw (pastebin > is huge!) > > Some tip on which logs I could take a look and/or part of the code I > could instrument in order to, at least, get some directions? > > Thanks in advance, > -- > Fabiano Fidêncio > _______________________________________________ > sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org > To unsubscribe send an email to sssd-devel-le...@lists.fedorahosted.org > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedoraproject.org/archives/list/sssd-devel@lists.fedorahosted.org/message/2G5K5WWNZZHHOXTIWF62ETMA4QA6ZJGW/ _______________________________________________ sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org To unsubscribe send an email to sssd-devel-le...@lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/sssd-devel@lists.fedorahosted.org/message/6QGWQTMVLNJ7APF5WXMVYZG35EM4EPTY/
