Attachment 1014422 Details for Bug 1184712 – setroubleshoot details

setroubleshoot details

setroubleshoot.txt (text/plain), 1.80 KB, created by Dave Allan on 2015-04-14 17:20:07 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Dave Allan

Created: 2015-04-14 17:20:07 UTC

Size: 1.80 KB

patch

obsolete

>SELinux is preventing systemctl from using the setrlimit access on a process.
>
>*****  Plugin catchall (100. confidence) suggests   **************************
>
>If you believe that systemctl should be allowed setrlimit access on processes labeled logrotate_t by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep systemctl /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>Additional Information:
>Source Context                system_u:system_r:logrotate_t:s0-s0:c0.c1023
>Target Context                system_u:system_r:logrotate_t:s0-s0:c0.c1023
>Target Objects                Unknown [ process ]
>Source                        systemctl
>Source Path                   systemctl
>Port                          <Unknown>
>Host                          (removed)
>Source RPM Packages           
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.13.1-105.9.fc21.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Enforcing
>Host Name                     (removed)
>Platform                      Linux galdor 3.19.3-200.fc21.x86_64 #1 SMP Thu Mar
>                              26 21:39:42 UTC 2015 x86_64 x86_64
>Alert Count                   10
>First Seen                    2015-02-09 16:08:18 EST
>Last Seen                     2015-04-14 03:50:01 EDT
>Local ID                      71a1444a-6531-48e1-8ecd-e90704b54be6
>
>Raw Audit Messages
>type=AVC msg=audit(1428997801.618:982): avc:  denied  { setrlimit } for  pid=25171 comm="systemctl" scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tclass=process permissive=0
>
>
>Hash: systemctl,logrotate_t,logrotate_t,process,setrlimit

Actions: View

Attachments on bug 1184712: 1013679 | 1014422 | 1014452 | 1014456