[PUP-3765] service providers not utilizing selinux Created: 2014/12/15 Updated: 2018/05/21
|Affects Version/s:||PUP 3.7.3|
|Labels:||linux, selinux, service, type_and_provider|
|Remaining Estimate:||Not Specified|
|Time Spent:||Not Specified|
|Original Estimate:||Not Specified|
Any SELinux system
Puppet on SELinux enabled systems currently has an issue where the init provider does not start programs into their correct SELinux context.
While this problem was first discovered with Gentoo's openrc provider, this applies for sure to redhat and probably debian as well. Though I don't have a test case for debian at the moment.
The problem is setup like this.
When you start a service under selinux, the program inherits the contexts of the current SELinux user/role/context unless there's a transition to move it to a more appropriate domain.
Thre is a selinux userspace utility called run_init to "help" this along so that init scripts can be called via userspace into their proper context.
The problem illustrated:
This is how sshd likes to run on EL6:
Now restart the service and see what context it runs under. This, by the way, is how puppet will restart a service. Either with "service" or directly calling the init script - either way the result is the same.
It should not be too surprising that the root user's selinux user is unconfined_u under EL6:
Now when sshd is restarted with run_init:
I'm reasonably close to a solution, but it requires tweaking for non-selinux cases and has a few engineering "concerns".
1) Drop a run_init command into the provider:
2) Modify the service calls accordingly.
Eg, statuscmd in the openrc.rb provider goes from this:
This works happily in the openrc example, though it does not work so well in the non-selinux case due to an additional space being prepended to the run_init command being nonexistent.
I'm not clear how to solve that, but that's a solid starting point into fixing this.
This does have an additional issue where any case where run_init is used, a modification to pam needs to be made so the automatic transition is possible. I'm not clear on the general resolution of that.