Bug 1086048

Summary: firewalld - denied write
Product: [Fedora] Fedora Reporter: poma <pomidorabelisima>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED DUPLICATE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 20CC: dominick.grift, dwalsh, lvrabec, mgrepl
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-04-10 08:30:33 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description poma 2014-04-10 02:23:44 UTC 
# ausearch -m avc -c firewalld --just-one
----
time->Wed Apr  9 13:19:27 2014
type=SYSCALL msg=audit(1397042367.563:546): arch=c000003e syscall=2 success=no exit=-13 a0=1a7f560 a1=241 a2=1b6 a3=0 items=0 ppid=1 pid=1307 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="firewalld" exe="/usr/bin/python2.7" subj=system_u:system_r:firewalld_t:s0 key=(null)
type=AVC msg=audit(1397042367.563:546): avc:  denied  { write } for  pid=1307 comm="firewalld" name="ip_forward" dev="proc" ino=9273 scontext=system_u:system_r:firewalld_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file
Comment 1 poma 2014-04-10 02:26:00 UTC 
# cat firewalld-ip_forward-mypol.te 

module firewalld-ip_forward-mypol 1.0;

require {
	type firewalld_t;
	type proc_t;
	class file write;
}

#============= firewalld_t ==============
allow firewalld_t proc_t:file write;
Comment 2 Miroslav Grepl 2014-04-10 08:30:33 UTC 

*** This bug has been marked as a duplicate of bug 1084829 ***