rsync can't write to /var/run/rsyncd.lock

[Daniel J Walsh]

Murray McAllister wrote:
> Ian Pilcher wrote:
>> selinux-policy-targeted-3.0.8-117.fc8
>>
>> host=home.icp.selfip.net type=AVC msg=audit(1223194499.218:1065): avc:
>> denied { read write } for pid=9837 comm="rsync" name="rsyncd.lock"
>> dev=dm-1 ino=337788 scontext=system_u:system_r:rsync_t:s0-s0:c0.c1023
>> tcontext=system_u:object_r:var_run_t:s0 tclass=file
>>
>> host=home.icp.selfip.net type=SYSCALL msg=audit(1223194499.218:1065):
>> arch=c000003e syscall=2 success=no exit=-13 a0=adfc60 a1=42 a2=180 a3=8
>> items=0 ppid=9836 pid=9837 auid=4294967295 uid=0 gid=0 euid=0 suid=0
>> fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="rsync"
>> exe="/usr/bin/rsync" subj=system_u:system_r:rsync_t:s0-s0:c0.c1023
>> key=(null)
>>
> Hi,
> 
> On Fedora 9, selinux-policy-3.3.1-95.fc9.noarch and
> selinux-policy-targeted-3.3.1-95.fc9.noarch:
> 
> $ grep rsyncd /etc/selinux/targeted/contexts/files/*
> 
> /etc/selinux/targeted/contexts/files/file_contexts:/var/run/rsyncd\.lock
>        --      system_u:object_r:rsync_log_t:s0
> 
> Your first error looks like rsyncd.lock is labeled with the var_run_t
> type, so maybe it needs to be rsync_log_t type.
> 
> What output do you get from "grep rsyncd
> /etc/selinux/targeted/contexts/files/*"?
> 
> Maybe try running the following as root:
> 
> /sbin/restorecon -R -v /var/run/
> 
> There might be something wrong with rsyncd if it is creating files with
> the wrong type.
> 
> -- 
> fedora-selinux-list mailing list
> fedora-selinux-list at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
Well that is actually a bug in F9 in that it should be labeled
rsync_var_run_t.  I will fix in F9, Rawhide and F8.

Changing the context to rsync_log_t or rsync_var_run_t
should solve the problem.