[Bug 1393649] New: ejabberd' s unit file should not launch ejabberdctl with /usr/bin/bash

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1393649

            Bug ID: 1393649
           Summary: ejabberd's unit file should not launch ejabberdctl
                    with /usr/bin/bash
           Product: Fedora
           Version: rawhide
         Component: ejabberd
          Severity: medium
          Assignee: lemenkov(a)gmail.com
          Reporter: randy(a)electronsweatshop.com
        QA Contact: extras-qa(a)fedoraproject.org
                CC: erlang(a)lists.fedoraproject.org, jeremy(a)jcline.org,
                    lemenkov(a)gmail.com, martin(a)laptop.org,
                    randy(a)electronsweatshop.com
        Depends On: 1393643
   External Bug ID: Github processone/ejabberd/issues/1375



Description of problem:
Currently, ejabberdctl is launched by systemd with /usr/bin/bash instead of
being launched directly. This causes the process to run in the initrc_t context
which is very permissive. Instead, systemd should launch ejabberdctl directly.

However, there are two blockers to getting this change done and working, as we
get these AVC denials with this change in place:

type=AVC msg=audit(1478751171.862:648): avc:  denied  { write } for  pid=2989
comm="async_2" name="ejabberd.pem" dev="dm-1" ino=44546
scontext=system_u:system_r:rabbitmq_t:s0
tcontext=unconfined_u:object_r:etc_t:s0 tclass=file permissive=0
type=AVC msg=audit(1478751171.863:649): avc:  denied  { write } for  pid=2989
comm="async_2" name="ejabberd.pem" dev="dm-1" ino=44546
scontext=system_u:system_r:rabbitmq_t:s0
tcontext=unconfined_u:object_r:etc_t:s0 tclass=file permissive=0
type=AVC msg=audit(1478751171.865:650): avc:  denied  { name_bind } for 
pid=2986 comm="beam" src=5349 scontext=system_u:system_r:rabbitmq_t:s0
tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket permissive=0

I've filed a bug upstream to request that they stop trying to open the certfile
in write mode[0], and I've filed a bug against selinux-policy to request that
ejabberd be allowed to use tcp port 5349[1]. Once both of those bugs are fixed,
we can proceed with dropping /usr/bin/bash presuming that we don't then hit
further AVC denials (which could happen).


Version-Release number of selected component (if applicable):
ejabberd-16.08-2.fc25.x86_64


Additional info:
[0] https://github.com/processone/ejabberd/issues/1375
[1] https://bugzilla.redhat.com/show_bug.cgi?id=1393643


Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1393643
[Bug 1393643] ejabberd is not allowed to open tcp port 5349
-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1393649] ejabberd's unit file should not launch ejabberdctl with /usr /bin/bash

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1393649



--- Comment #1 from Randy Barlow <randy(a)electronsweatshop.com&gt; ---
When we do this, we will probably also need to add a restorecon -R
/var/lib/ejabberd to the %post section, or something similar. We may need
something for /etc/ejabberd as well.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1393649] ejabberd's unit file should not launch ejabberdctl with /usr /bin/bash

https://bugzilla.redhat.com/show_bug.cgi?id=1393649
Bug 1393649 depends on bug 1393643, which changed state.

Bug 1393643 Summary: ejabberd is not allowed to open tcp port 5349
https://bugzilla.redhat.com/show_bug.cgi?id=1393643

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |EOL



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1393649] ejabberd's unit file should not launch ejabberdctl with /usr /bin/bash

https://bugzilla.redhat.com/show_bug.cgi?id=1393649



--- Comment #3 from Fedora Update System <updates(a)fedoraproject.org&gt; ---
erlang-xmpp-1.1.19-1.fc27 erlang-esip-1.0.21-1.fc27 erlang-stun-1.0.20-1.fc27
erlang-jose-1.8.4-1.fc27 erlang-base64url-1.0-1.fc27 erlang-fs-4.1-2.fc27
erlang-fast_xml-1.1.28-1.fc27 erlang-fast_yaml-1.0.12-1.fc27
erlang-fast_tls-1.0.20-1.fc27 erlang-ezlib-1.0.3-1.fc27
erlang-cache_tab-1.0.12-1.fc27 ejabberd-18.01-1.fc27 has been submitted as an
update to Fedora 27.
https://bodhi.fedoraproject.org/updates/FEDORA-2018-8d1658ffde

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1393649] ejabberd's unit file should not launch ejabberdctl with /usr /bin/bash

https://bugzilla.redhat.com/show_bug.cgi?id=1393649

Fedora Update System <updates(a)fedoraproject.org&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |MODIFIED



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1393649] ejabberd's unit file should not launch ejabberdctl with /usr /bin/bash

https://bugzilla.redhat.com/show_bug.cgi?id=1393649

Fedora Update System <updates(a)fedoraproject.org&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|MODIFIED                    |ON_QA



--- Comment #4 from Fedora Update System <updates(a)fedoraproject.org&gt; ---
ejabberd-18.01-1.fc27, erlang-base64url-1.0-1.fc27,
erlang-cache_tab-1.0.12-1.fc27, erlang-esip-1.0.21-1.fc27,
erlang-ezlib-1.0.3-1.fc27, erlang-fast_tls-1.0.20-1.fc27,
erlang-fast_xml-1.1.28-1.fc27, erlang-fast_yaml-1.0.12-1.fc27,
erlang-fs-4.1-2.fc27, erlang-jose-1.8.4-1.fc27, erlang-stun-1.0.20-1.fc27,
erlang-xmpp-1.1.19-1.fc27 has been pushed to the Fedora 27 testing repository.
If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here:
https://bodhi.fedoraproject.org/updates/FEDORA-2018-8d1658ffde

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1393649] ejabberd's unit file should not launch ejabberdctl with /usr /bin/bash

https://bugzilla.redhat.com/show_bug.cgi?id=1393649



--- Comment #5 from Fedora Update System <updates(a)fedoraproject.org&gt; ---
ejabberd-18.01-2.fc27 erlang-base64url-1.0-1.fc27
erlang-cache_tab-1.0.12-1.fc27 erlang-esip-1.0.21-1.fc27
erlang-ezlib-1.0.3-1.fc27 erlang-fast_tls-1.0.20-1.fc27
erlang-fast_xml-1.1.28-1.fc27 erlang-fast_yaml-1.0.12-1.fc27
erlang-fs-4.1-2.fc27 erlang-jose-1.8.4-1.fc27 erlang-stun-1.0.20-1.fc27
erlang-xmpp-1.1.19-1.fc27 has been submitted as an update to Fedora 27.
https://bodhi.fedoraproject.org/updates/FEDORA-2018-8d1658ffde

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1393649] ejabberd's unit file should not launch ejabberdctl with /usr /bin/bash

https://bugzilla.redhat.com/show_bug.cgi?id=1393649

Fedora Update System <updates(a)fedoraproject.org&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ON_QA                       |MODIFIED



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1393649] ejabberd's unit file should not launch ejabberdctl with /usr /bin/bash

https://bugzilla.redhat.com/show_bug.cgi?id=1393649

Fedora Update System <updates(a)fedoraproject.org&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|MODIFIED                    |ON_QA



--- Comment #6 from Fedora Update System <updates(a)fedoraproject.org&gt; ---
ejabberd-18.01-2.fc27, erlang-base64url-1.0-1.fc27,
erlang-cache_tab-1.0.12-1.fc27, erlang-esip-1.0.21-1.fc27,
erlang-ezlib-1.0.3-1.fc27, erlang-fast_tls-1.0.20-1.fc27,
erlang-fast_xml-1.1.28-1.fc27, erlang-fast_yaml-1.0.12-1.fc27,
erlang-fs-4.1-2.fc27, erlang-jose-1.8.4-1.fc27, erlang-stun-1.0.20-1.fc27,
erlang-xmpp-1.1.19-1.fc27 has been pushed to the Fedora 27 testing repository.
If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here:
https://bodhi.fedoraproject.org/updates/FEDORA-2018-8d1658ffde

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1393649] ejabberd's unit file should not launch ejabberdctl with /usr /bin/bash

https://bugzilla.redhat.com/show_bug.cgi?id=1393649

Fedora Update System <updates(a)fedoraproject.org&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ON_QA                       |CLOSED
   Fixed In Version|                            |ejabberd-18.01-2.fc27
         Resolution|---                         |ERRATA
        Last Closed|                            |2018-02-06 06:22:02



--- Comment #7 from Fedora Update System <updates(a)fedoraproject.org&gt; ---
ejabberd-18.01-2.fc27, erlang-base64url-1.0-1.fc27,
erlang-cache_tab-1.0.12-1.fc27, erlang-esip-1.0.21-1.fc27,
erlang-ezlib-1.0.3-1.fc27, erlang-fast_tls-1.0.20-1.fc27,
erlang-fast_xml-1.1.28-1.fc27, erlang-fast_yaml-1.0.12-1.fc27,
erlang-fs-4.1-2.fc27, erlang-jose-1.8.4-1.fc27, erlang-stun-1.0.20-1.fc27,
erlang-xmpp-1.1.19-1.fc27 has been pushed to the Fedora 27 stable repository.
If problems still persist, please make note of it in this bug report.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1393649] ejabberd's unit file should not launch ejabberdctl with /usr /bin/bash

https://bugzilla.redhat.com/show_bug.cgi?id=1393649



--- Comment #8 from Fedora Update System <updates(a)fedoraproject.org&gt; ---
ejabberd-18.01-2.fc27, erlang-base64url-1.0-1.fc27,
erlang-cache_tab-1.0.12-1.fc27, erlang-esip-1.0.21-1.fc27,
erlang-ezlib-1.0.3-1.fc27, erlang-fast_tls-1.0.20-1.fc27,
erlang-fast_xml-1.1.28-1.fc27, erlang-fast_yaml-1.0.12-1.fc27,
erlang-fs-4.1-2.fc27, erlang-jose-1.8.4-1.fc27, erlang-stun-1.0.20-1.fc27,
erlang-xmpp-1.1.19-1.fc27 has been pushed to the Fedora 27 stable repository.
If problems still persist, please make note of it in this bug report.

-- 
You are receiving this mail because:
You are on the CC list for the bug.