[Freeipa-users] SELinux Denial when installing IPA 2.1.3 on F15

[Charlie Derwent]

Sounds sort of related to the bug you mentioned in your release notes but
this was a clean install not an upgrade.

Regards
Charlie

------------------------------------------------------------------------------------------------------------------------------------------

FYI

SELinux is preventing /usr/sbin/ns-slapd from read access on the lnk_file
/var/lock.

*****  Plugin restorecon (94.8 confidence) suggests
*************************

If you want to fix the label.
/var/lock default label should be var_lock_t.
Then you can run restorecon.
Do
# /sbin/restorecon -v /var/lock

*****  Plugin catchall_labels (5.21 confidence) suggests
********************

If you want to allow ns-slapd to have read access on the lock lnk_file
Then you need to change the label on /var/lock
Do
# semanage fcontext -a -t FILE_TYPE '/var/lock'
where FILE_TYPE is one of the following: abrt_t, lib_t, root_t, device_t,
ld_so_t, proc_t, textrel_shlib_t, rpm_script_tmp_t, dirsrv_t, var_lock_t,
cert_t, usr_t, device_t, devlog_t, var_run_t, locale_t, etc_t, proc_t,
dirsrv_config_t, var_run_t, var_run_t.
Then execute:
restorecon -v '/var/lock'


*****  Plugin catchall (1.44 confidence) suggests
***************************

If you believe that ns-slapd should be allowed read access on the lock
lnk_file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep ns-slapd /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                unconfined_u:system_r:dirsrv_t:s0
Target Context                system_u:object_r:var_t:s0
Target Objects                /var/lock [ lnk_file ]
Source                        ns-slapd
Source Path                   /usr/sbin/ns-slapd
Port                          <Unknown>
Host                          f15.test.net
Source RPM Packages           389-ds-base-1.2.10-0.4.a4.fc15
Target RPM Packages           filesystem-2.4.41-1.fc15
Policy RPM                    selinux-policy-3.9.16-24.fc15
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     f15.test.net
Platform                      Linux f15.test.net 2.6.38.6-27.fc15.x86_64 #1
SMP
                              Sun May 15 17:23:28 UTC 2011 x86_64 x86_64
Alert Count                   3
First Seen                    Fri 21 Oct 2011 01:28:21 AM BST
Last Seen                     Fri 21 Oct 2011 07:29:38 AM BST
Local ID

Raw Audit Messages
type=AVC msg=audit(1319178578.723:176): avc:  denied  { read } for
pid=26931 comm="ns-slapd" name="lock" dev=dm-1 ino=1281
scontext=unconfined_u:system_r:dirsrv_t:s0
tcontext=system_u:object_r:var_t:s0 tclass=lnk_file


type=SYSCALL msg=audit(1319178578.723:176): arch=x86_64 syscall=open
success=no exit=EACCES a0=7fff9b184460 a1=c2 a2=1a4 a3=0 items=0 ppid=1
pid=26931 auid=500 uid=492 gid=490 euid=492 suid=492 fsuid=492 egid=490
sgid=490 fsgid=490 tty=(none) ses=4 comm=ns-slapd exe=/usr/sbin/ns-slapd
subj=unconfined_u:system_r:dirsrv_t:s0 key=(null)

Hash: ns-slapd,dirsrv_t,var_t,lnk_file,read

audit2allow

#============= dirsrv_t ==============
allow dirsrv_t var_t:lnk_file read;

audit2allow -R

#============= dirsrv_t ==============
allow dirsrv_t var_t:lnk_file read;
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/freeipa-users/attachments/20111021/dfba20e4/attachment.htm>