Bug 1099543

Description of problem:
When you configure squid to run with more than one worker, SELinux prevents it from opening IPC channels and shared memory segments

SMP mode is a new feature from squid 3.3 onwards. It looks the SELinux policy needs to be updated to deal with this new squid featore

Version-Release number of selected component (if applicable):
3.3.x/3.4.x

How reproducible:
Allways -- Actually I tried on CentOS 6.5, using unofficial packages from squid-cache.org.

Not tested yet on Fedora, but from what I see on Fedora RPMs and SRPMs for squid, it looks the same issue will be present there.

I contacted Fedora package mantainers for squid about this and they advised to open the bug on Fedora bugzilla anyway.

Steps to Reproduce:
1. Run squid with factory default configs, to show it's working as expected with SELinux enforcing
2. Change /etc/squid/squid.conf to use SMP mode. For example:
workers 2
cache_mem 1024 MB
cache_dir rock /cache/shared 2000 min-size=1 max-size=31000 max-swap-rate=250 swap-timeout=350
cache_dir aufs /cache/worker${process_number} 2000 16 256 min-size=31001 max-size=346030080
3. Recursively set file context squid_cache_t for /cache and run squid -z to initialize the cache dirs for SMP mode
4. Start squid

Actual results:
AVC denials, not all squid child processes start, won't proxy http requests.

Here's a partial snipset of the AVCs:
-----------------
type=AVC msg=audit(1399489635.910:86640): avc:  denied  { create } for  pid=12184 comm="squid" name="coordinator.ipc" scontext=unconfined_u:system_r:squid_t:s0 tcontext=unconfined_u:object_r:squid_var_run_t:s0 tclass=sock_file
type=AVC msg=audit(1399489635.921:86641): avc:  denied  { create } for  pid=12186 comm="squid" name="kid-1.ipc" scontext=unconfined_u:system_r:squid_t:s0 tcontext=unconfined_u:object_r:squid_var_run_t:s0 tclass=sock_file
type=AVC msg=audit(1399490819.665:86659): avc:  denied  { create } for  pid=12419 comm="squid" name="kid-2.ipc" scontext=unconfined_u:system_r:squid_t:s0 tcontext=unconfined_u:object_r:squid_var_run_t:s0 tclass=sock_file
type=AVC msg=audit(1399493508.444:86954): avc:  denied  { remove_name } for  pid=15856 comm="squid" name="squid-cache_mem.shm" dev=tmpfs ino=36316934 scontext=unconfined_u:system_r:squid_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=dir
type=AVC msg=audit(1399493508.444:86955): avc:  denied  { remove_name } for  pid=15856 comm="squid" name="squid-squid-page-pool.shm" dev=tmpfs ino=36316933 scontext=unconfined_u:system_r:squid_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=dir
-----------------

Expected results:
Squid starts four child (aka kids): two worker processes (squid-1 and squid-2), a disker (squid-disk-3) and a coordinator (squid-coord-4) which share memory segments and use IP channels.

Additional info:
I used audit2allow to generate the following SELinux policy module that solves the AVCs and allow squid to run fine in SMP mode:
-----------------
module squid-smp 1.1;

# for ipc channels between kids/workers
require {
	type var_run_t;
	type squid_t;
	class sock_file { create write unlink };
}
allow squid_t var_run_t:sock_file { create write unlink };
allow squid_t var_run_t:sock_file create;

# for shm used by cache_mem and rock store
require {
	type squid_t;
	type tmpfs_t;
	class dir { remove_name add_name write };
	class file { unlink create };
}
allow squid_t tmpfs_t:dir { remove_name write add_name };
allow squid_t tmpfs_t:file { unlink create };
-----------------

I guess I could have used something more specific than "var_run_t", label files acordingly and have a more strict policy.