Attachment 547899 Details for Bug 768472 – File: description

File: description

description (text/plain), 2.39 KB, created by ushi on 2011-12-16 18:27:32 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: ushi

Created: 2011-12-16 18:27:32 UTC

Size: 2.39 KB

patch

obsolete

>SELinux is preventing /usr/sbin/httpd from 'search' accesses on the directory /var/lib/chrony.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that httpd should be allowed search access on the chrony directory by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep /usr/sbin/httpd /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>Additional Information:
>Source Context                system_u:system_r:httpd_t:s0
>Target Context                system_u:object_r:chronyd_var_lib_t:s0
>Target Objects                /var/lib/chrony [ dir ]
>Source                        /usr/sbin/httpd
>Source Path                   /usr/sbin/httpd
>Port                          <Unbekannt>
>Host                          (removed)
>Source RPM Packages           httpd-2.2.21-1.fc16
>Target RPM Packages           chrony-1.26-3.20110831gitb088b7.fc16
>Policy RPM                    selinux-policy-3.10.0-64.fc16
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Enforcing
>Host Name                     (removed)
>Platform                      Linux sheeba 3.1.5-2.fc16.x86_64 #1 SMP Mon Dec 12
>                              21:25:51 UTC 2011 x86_64 x86_64
>Alert Count                   8
>First Seen                    Mo 12 Dez 2011 12:46:49 CET
>Last Seen                     Fr 16 Dez 2011 15:32:39 CET
>Local ID                      e9eef44a-d374-4571-8a6d-0c14e8ce715a
>
>Raw Audit Messages
>type=AVC msg=audit(1324045959.711:56): avc:  denied  { search } for  pid=1205 comm="/usr/sbin/httpd" name="chrony" dev=dm-1 ino=28776 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:chronyd_var_lib_t:s0 tclass=dir
>
>
>type=SYSCALL msg=audit(1324045959.711:56): arch=x86_64 syscall=stat success=no exit=EACCES a0=7faa0aa38780 a1=7fff19a683f0 a2=7fff19a683f0 a3=0 items=0 ppid=1060 pid=1205 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm=/usr/sbin/httpd exe=/usr/sbin/httpd subj=system_u:system_r:httpd_t:s0 key=(null)
>
>Hash: /usr/sbin/httpd,httpd_t,chronyd_var_lib_t,dir,search
>
>audit2allow
>
>#============= httpd_t ==============
>allow httpd_t chronyd_var_lib_t:dir search;
>
>audit2allow -R
>
>#============= httpd_t ==============
>allow httpd_t chronyd_var_lib_t:dir search;
>

Actions: View

Attachments on bug 768472: 547899