[Freeipa-users] SELinux Denial when installing IPA 2.1.3 on F15

[Rob Crittenden]

Charlie Derwent wrote:
> Sounds sort of related to the bug you mentioned in your release notes
> but this was a clean install not an upgrade.

It looks like we need to update the minimum version of selinux-policy 
required. I believe this was fixed in 3.9.16-29 and it looks like you 
are running -24.

thanks

rob

>
> Regards
> Charlie
>
> ------------------------------------------------------------------------------------------------------------------------------------------
>
> FYI
>
> SELinux is preventing /usr/sbin/ns-slapd from read access on the
> lnk_file /var/lock.
>
> *****  Plugin restorecon (94.8 confidence) suggests
> *************************
>
> If you want to fix the label.
> /var/lock default label should be var_lock_t.
> Then you can run restorecon.
> Do
> # /sbin/restorecon -v /var/lock
>
> *****  Plugin catchall_labels (5.21 confidence) suggests
> ********************
>
> If you want to allow ns-slapd to have read access on the lock lnk_file
> Then you need to change the label on /var/lock
> Do
> # semanage fcontext -a -t FILE_TYPE '/var/lock'
> where FILE_TYPE is one of the following: abrt_t, lib_t, root_t,
> device_t, ld_so_t, proc_t, textrel_shlib_t, rpm_script_tmp_t, dirsrv_t,
> var_lock_t, cert_t, usr_t, device_t, devlog_t, var_run_t, locale_t,
> etc_t, proc_t, dirsrv_config_t, var_run_t, var_run_t.
> Then execute:
> restorecon -v '/var/lock'
>
>
> *****  Plugin catchall (1.44 confidence) suggests
> ***************************
>
> If you believe that ns-slapd should be allowed read access on the lock
> lnk_file by default.
> Then you should report this as a bug.
> You can generate a local policy module to allow this access.
> Do
> allow this access for now by executing:
> # grep ns-slapd /var/log/audit/audit.log | audit2allow -M mypol
> # semodule -i mypol.pp
>
> Additional Information:
> Source Context                unconfined_u:system_r:dirsrv_t:s0
> Target Context                system_u:object_r:var_t:s0
> Target Objects                /var/lock [ lnk_file ]
> Source                        ns-slapd
> Source Path                   /usr/sbin/ns-slapd
> Port <Unknown>
> Host f15.test.net <http://f15.test.net>
> Source RPM Packages           389-ds-base-1.2.10-0.4.a4.fc15
> Target RPM Packages           filesystem-2.4.41-1.fc15
> Policy RPM                    selinux-policy-3.9.16-24.fc15
> Selinux Enabled               True
> Policy Type                   targeted
> Enforcing Mode                Enforcing
> Host Name f15.test.net <http://f15.test.net>
> Platform                      Linux f15.test.net <http://f15.test.net>
> 2.6.38.6-27.fc15.x86_64 #1 SMP
>                                Sun May 15 17:23:28 UTC 2011 x86_64 x86_64
> Alert Count                   3
> First Seen                    Fri 21 Oct 2011 01:28:21 AM BST
> Last Seen                     Fri 21 Oct 2011 07:29:38 AM BST
> Local ID
>
> Raw Audit Messages
> type=AVC msg=audit(1319178578.723:176): avc:  denied  { read } for
> pid=26931 comm="ns-slapd" name="lock" dev=dm-1 ino=1281
> scontext=unconfined_u:system_r:dirsrv_t:s0
> tcontext=system_u:object_r:var_t:s0 tclass=lnk_file
>
>
> type=SYSCALL msg=audit(1319178578.723:176): arch=x86_64 syscall=open
> success=no exit=EACCES a0=7fff9b184460 a1=c2 a2=1a4 a3=0 items=0 ppid=1
> pid=26931 auid=500 uid=492 gid=490 euid=492 suid=492 fsuid=492 egid=490
> sgid=490 fsgid=490 tty=(none) ses=4 comm=ns-slapd exe=/usr/sbin/ns-slapd
> subj=unconfined_u:system_r:dirsrv_t:s0 key=(null)
>
> Hash: ns-slapd,dirsrv_t,var_t,lnk_file,read
>
> audit2allow
>
> #============= dirsrv_t ==============
> allow dirsrv_t var_t:lnk_file read;
>
> audit2allow -R
>
> #============= dirsrv_t ==============
> allow dirsrv_t var_t:lnk_file read;
>
>
>
>
> _______________________________________________
> Freeipa-users mailing list
> Freeipa-users at redhat.com
> https://www.redhat.com/mailman/listinfo/freeipa-users