#1012115 Sasl local login fails when selinux enforced

Package:
sasl2-bin
Source:
cyrus-sasl2
Description:
Cyrus SASL - administration programs for SASL users database
Submitter:
Andreas Pflug
Date:
2022-06-13 08:24:05 UTC
Severity:
normal
#1012115#5
Date:
2022-05-30 11:33:39 UTC
From:
To:
I have a Cyrus Murder which was installed on Buster. SASL mechanism is
set to PAM, with nsswitch configured "passwd: files systemd ldap".
The system is SELinux enabled.
After dist-upgrading to Bullseye, we had intermittent login problems,
which go away when SELinux is set to permissive. Most users login using
an LDAP account, while system users (murder, mupdate) will use a local
account.

My testing:

- restorecon -R /
- setenforce 1
- systemctl restart saslauthd
- login via LDAP succeeds
- login via local account mupdate fails

No policy violation in audit.log:
type=USER_AUTH msg=audit(1653909809.946:286388): pid=1604917 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:saslauthd_t:s0
msg='op=PAM:authentication grantors=? acct="mupdate"
exe="/usr/sbin/saslauthd" hostname=? addr=? terminal=?
res=failed'UID="root" AUID="unset"
- setenforce 0
- login via local account mupdate succeeds

audit.log:
type=USER_AUTH msg=audit(1653909900.509:286420): pid=1607198 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:saslauthd_t:s0
msg='op=PAM:authentication grantors=pam_permit acct="mupdate"
exe="/usr/sbin/saslauthd" hostname=? addr=? terminal=?
res=success'UID="root" AUID="unset"
type=USER_ACCT msg=audit(1653909900.509:286421): pid=1607198 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:saslauthd_t:s0
msg='op=PAM:accounting grantors=pam_permit acct="mupdate"
exe="/usr/sbin/saslauthd" hostname=? addr=? terminal=?
res=success'UID="root" AUID="unset"

- setenforce 1
- login via local account mupdate still succeeds
- systemctl restart saslauthd
- login via local account mupdate fails again.

This problem didn't exist with Buster, while using the 2.1.27+dfsg-1+deb10u1
#1012115#8
Date:
2022-06-11 08:36:09 UTC
From:
To:
Hi Andreas,

Can you confirm the bug on sid as well? Most probably this will
not be fixed for bullseye because it is not a vulnerability.

Thanks,
Bastian
#1012115#13
Date:
2022-06-13 06:23:05 UTC
From:
To:
Hi Bastian,

Am 11.06.22 um 10:36 schrieb Bastian Germann:

this is on production servers, so I can't just switch to Sid. Any
selective update I could try?

Regards,
Andreas
#1012115#18
Date:
2022-06-13 08:00:03 UTC
From:
To:
Am 11.06.22 um 10:36 schrieb Bastian Germann:

If SELinux isn't enforced, the system is certainly more vulnerable...
#1012115#23
Date:
2022-06-13 08:21:29 UTC
From:
To:
That may be right but it is not a specific vulnerability.