| Summary: | SELinux prevents logwatch from reading /etc/mdadm.conf file | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Milos Malik <mmalik> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Milos Malik <mmalik> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 7.0 | ||
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-3.12.1-109.el7 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2014-06-13 10:55:09 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
We are getting it also on Fedora. commit 47a899da4cc0019c6e292013217e63fd4ba4fadd
Author: Miroslav Grepl <mgrepl>
Date: Fri Dec 6 11:42:20 2013 +0100
Allow logwatch read madm.conf to support RAID setup
This request was resolved in Red Hat Enterprise Linux 7.0. Contact your manager or support representative in case you have further questions about the request. |
Description of problem: The /etc/mdadm.conf file got a new label and this is a consequence. Version-Release number of selected component (if applicable): logwatch-7.4.0-27.20130522svn140.el7.noarch selinux-policy-3.12.1-105.el7.noarch selinux-policy-devel-3.12.1-105.el7.noarch selinux-policy-doc-3.12.1-105.el7.noarch selinux-policy-minimum-3.12.1-105.el7.noarch selinux-policy-mls-3.12.1-105.el7.noarch selinux-policy-targeted-3.12.1-105.el7.noarch How reproducible: persuade crond to run /etc/cron.daily/0logwatch Actual results (enforcing mode): ---- type=PATH msg=audit(11/29/2013 12:06:04.430:693) : item=0 name=/etc/mdadm.conf inode=10110576 dev=fd:03 mode=file,644 ouid=root ogid=root rdev=00:00 obj=unconfined_u:object_r:mdadm_conf_t:s0 objtype=NORMAL type=CWD msg=audit(11/29/2013 12:06:04.430:693) : cwd=/ type=SYSCALL msg=audit(11/29/2013 12:06:04.430:693) : arch=x86_64 syscall=open success=no exit=-13(Permission denied) a0=0x112bd30 a1=O_RDONLY a2=0x1b6 a3=0x0 items=1 ppid=12819 pid=12821 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=23 comm=perl exe=/usr/bin/perl subj=system_u:system_r:logwatch_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(11/29/2013 12:06:04.430:693) : avc: denied { read } for pid=12821 comm=perl name=mdadm.conf dev="vda3" ino=10110576 scontext=system_u:system_r:logwatch_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:mdadm_conf_t:s0 tclass=file ---- Expected results: * no AVCs