Project

General

Profile

Actions
Copy link

Bug #34807

closed

Access to /etc/resolv.conf is denied when using systemd-resolved

Added by Ewoud Kohl van Wijngaarden about 3 years ago. Updated over 2 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Ewoud Kohl van Wijngaarden
Category:
General Foreman
Target version:
Foreman - 3.5.0
Difficulty:
Triaged:
Yes
Bugzilla link:
Pull request:
https://github.com/theforeman/foreman-selinux/pull/142
Fixed in Releases:
Foreman - 3.5.0
Found in Releases:
Foreman - 3.2.0
Red Hat JIRA:

Description

When using systemd-resolved (on EL7):

$ ls -lZ /etc/resolv.conf
lrwxrwxrwx. root root system_u:object_r:net_conf_t:s0  /etc/resolv.conf -> /run/systemd/resolve/resolv.conf

And on EL8:

$ ls -lZ /etc/resolv.conf 
lrwxrwxrwx. 1 root root system_u:object_r:net_conf_t:s0 37 Feb 14  2021 /etc/resolv.conf -> /run/systemd/resolve/stub-resolv.conf

In audit.log:

type=AVC msg=audit(1650708282.685:1292): avc:  denied  { read } for  pid=1776 comm="diagnostic_con*" name="resolv.conf" dev="dm-0" ino=1308498 scontext=system_u:system_r:foreman_rails_t:s0 tcontext=system_u:object_r:net_conf_t:s0 tclass=lnk_file permissive=0

audit2allow comes up with:

allow foreman_rails_t net_conf_t:lnk_file read;

The result is that Foreman can't do any name resolution, which is needed to reach out to external services, such as Foreman Proxies.

Actions
Copy link
 #1

Updated by Ewoud Kohl van Wijngaarden about 3 years ago

  • Description updated (diff)
Actions
Copy link
 #2

Updated by The Foreman Bot about 3 years ago

  • Status changed from New to Ready For Testing
  • Assignee set to Ewoud Kohl van Wijngaarden
  • Pull request https://github.com/theforeman/foreman-selinux/pull/142 added
Actions
Copy link
 #3

Updated by Amit Upadhye almost 3 years ago

  • Target version changed from 3.2.1 to 3.2.2
Actions
Copy link
 #4

Updated by The Foreman Bot almost 3 years ago

  • Fixed in Releases 3.5.0 added
Actions
Copy link
 #5

Updated by Ewoud Kohl van Wijngaarden almost 3 years ago

  • Status changed from Ready For Testing to Closed
Actions
Copy link
 #6

Updated by Ewoud Kohl van Wijngaarden over 2 years ago

  • Target version changed from 3.2.2 to 3.5.0
Actions
Copy link
 #7

Updated by Ewoud Kohl van Wijngaarden over 2 years ago

  • Triaged changed from No to Yes
Actions
Copy link

Also available in: Atom PDF