<HTML><BODY style="word-wrap: break-word; -khtml-nbsp-mode: space; -khtml-line-break: after-white-space; ">Hello people,<DIV><BR class="khtml-block-placeholder"></DIV><DIV>I hope someone can help me with this problem.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>I have FEDORA CORE 3 with:</DIV><DIV><TABLE border="0" cellpadding="0" cellspacing="0" width="249" style=""><COL width="249" style="mso-width-source:userset;mso-width-alt:9106"><TBODY><TR height="13"><TD height="13" width="249"><SPAN class="Apple-style-span" style="border-collapse: collapse;"><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN>- selinux-policy-targeted-1.17.30-3.19</SPAN></TD></TR></TBODY></TABLE><SPAN class="Apple-style-span" style="border-collapse: collapse;"><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN>- <SPAN class="Apple-style-span" style="border-collapse: separate;">httpd-2.2.2</SPAN></SPAN></DIV><DIV><SPAN class="Apple-style-span" style="border-collapse: collapse;"><SPAN class="Apple-style-span" style="border-collapse: separate;"><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN>- changepassword-0.9.tar.gz</SPAN></SPAN></DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV><SPAN class="Apple-style-span" style="border-collapse: collapse;"><SPAN class="Apple-style-span" style="border-collapse: separate;">When I access "var/www/cgi-bin/changepassword.cgi" program and try to change squid passwords, SELINUX security send to the console some errrors as that:</SPAN></SPAN></DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN>Jul 10 13:48:19 proxy kernel: audit(1152560899.793:2): avc: denied { read } for pid=4004 comm="changepassword." name="shadow" dev=hda2 ino=1166230 scontext=root:system_r:httpd_sys_script_t tcontext=system_u:object_r:shadow_t tclass=file</DIV><DIV>Jul 10 13:48:19 proxy kernel: audit(1152560899.793:3): avc: denied { getattr } for pid=4004 comm="changepassword." name="shadow" dev=hda2 ino=1166230 scontext=root:system_r:httpd_sys_script_t tcontext=system_u:object_r:shadow_t tclass=file</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>I did ran the selinux command: </DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN>[root@proxy ~]# audit2allow -i /var/log/messages</DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN>allow httpd_sys_script_t shadow_t:file { getattr read };</DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN>allow httpd_t httpd_sys_script_t:process { noatsecure rlimitinh siginh };</DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN>allow httpd_t nscd_var_run_t:dir search;</DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN>allow snmpd_t selinux_config_t:file { getattr read };</DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN>allow snmpd_t self:process execmem;</DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN>allow squid_t boot_t:dir getattr;</DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN>allow squid_t home_root_t:dir getattr;</DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN>allow squid_t nscd_var_run_t:dir search;</DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN>allow syslogd_t root_t:file read;</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>I add thats security lines to domains/program/apache.te</DIV><DIV>I add that security lines to policy/policy.conf ,</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>but anything is working.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>I was reading some post of other mailing list, and some ones say that I must to change apache.te, , others say that I must to create into misc/local.te and add that lines, but anything can fix my problem. I run again audit2allow -i /var/log/messages and I get same messages.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>I run " make load" command and "reboot", but i can't get "changepassword application" do change my squid users password across website.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>Can some help me about that???</DIV><DIV><BR></DIV><DIV><BR><DIV> <SPAN class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: auto; -khtml-text-decorations-in-effect: none; text-indent: 0px; -apple-text-size-adjust: auto; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px; "><DIV>Luis Miguel Espinoza</DIV><DIV><A href="mailto:lmespinoza@frutex.net">lmespinoza@frutex.net</A></DIV><DIV>IT Frutex S.A</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV><BR class="khtml-block-placeholder"></DIV><BR class="Apple-interchange-newline"></SPAN> </DIV><BR></DIV></BODY></HTML>