On Mon, Nov 21, 2011 at 05:50:40PM +0530, Nitesh Mehare wrote:
> Was anybody able to look at the trace...
>
> Thanks ....
>
Sorry Nitesh, I forgot to reply.
The trace clearly shows that pam_sss sends data to and receives data
from the private sssd PAM socket:
-----
stat("/var/lib/sss/pipes/private/pam", {st_mode=S_IFSOCK|0600,
st_size=0, ...}) = 0
socket(PF_FILE, SOCK_STREAM, 0) = 5
fcntl(5, F_GETFL) = 0x2 (flags O_RDWR)
fcntl(5, F_SETFL, O_RDWR|O_NONBLOCK) = 0
fcntl(5, F_GETFD) = 0
fcntl(5, F_SETFD, FD_CLOEXEC) = 0
connect(5, {sa_family=AF_FILE,
path="/var/lib/sss/pipes/private/pam"...}, 110) = 0
poll([{fd=5, events=POLLOUT}], 1, 300000) = 1 ([{fd=5,
revents=POLLOUT}])
write(5, "\24\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0", 16) = 16
poll([{fd=5, events=POLLOUT}], 1, 300000) = 1 ([{fd=5,
revents=POLLOUT}])
write(5, "\3\0\0\0", 4) = 4
poll([{fd=5, events=POLLIN}], 1, 300000) = 1 ([{fd=5, revents=POLLIN}])
read(5, "\24\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0", 16) = 16
poll([{fd=5, events=POLLIN}], 1, 300000) = 1 ([{fd=5, revents=POLLIN}])
read(5, "\3\0\0\0", 4) = 4
getsockopt(5, SOL_SOCKET, SO_PEERCRED, "LY\0\0\0\0\0\0\0\0\0\0", [12]) =
0
poll([{fd=5, events=POLLOUT}], 1, 300000) = 1 ([{fd=5,
revents=POLLOUT}])
write(5, "]\0\0\0\364\0\0\0\0\0\0\0\0\0\0\0", 16) = 16
poll([{fd=5, events=POLLOUT}], 1, 300000) = 1 ([{fd=5,
revents=POLLOUT}])
write(5, "IPAM\1\0\0\0\t\0\0\0nitback1\0\2\0\0\0\5\0\0\0su-"..., 77) =
77
poll([{fd=5, events=POLLIN}], 1, 300000) = 1 ([{fd=5, revents=POLLIN}])
read(5, "%\0\0\0\364\0\0\0\0\0\0\0\0\0\0\0", 16) = 16
poll([{fd=5, events=POLLIN}], 1, 300000) = 1 ([{fd=5, revents=POLLIN}])
read(5, "\0\0\0\0\1\0\0\0\2\0\0\0\5\0\0\0LDAP\0", 21) = 21
----
I'm not sure why pam_sss wouldn't show in the secure logs...
Does SSSD print anything /var/log/sssd/sssd_pam.log when you put
'debug_level = 9' into the [pam] section of the SSSD config?
> Tha above trace I have take with selinux is disabled.The setting of
> selinux is as follows
>
> bash-3.2# cat /etc/selinux/config
> # This file controls the state of SELinux on the system.
> # SELINUX= can take one of these three values:
> #A A A A A A enforcing - SELinux security policy is enforced.
> #A A A A A A permissive - SELinux prints warnings instead of
> enforcing.
> #A A A A A A disabled - SELinux is fully disabled.
> SELINUX=disabled
> # SELINUXTYPE= type of policy in use. Possible values are:
> #A A A A A A targeted - Only targeted network daemons are protected.
> #A A A A A A strict - Full SELinux protection.
> SELINUXTYPE=targeted
> bash-3.2#
>
> I'm not sure how to check for AVC denials when selinux is set to
> enforcing.Could you tell me how to do that.
>
> Thanks...
>
When SELinux is disabled, it can't generate any AVC denial messages nor
it can block access to the pipes (which was my concern).