Bug 1113504

Summary: SELinux is preventing /usr/lib64/erlang/lib/couch-1.5.0/priv/couchjs from using the 'execmem' accesses on a process.
Product: [Fedora] Fedora Reporter: Remy Nicolaï <nicolair>
Component: selinux-policyAssignee: Lukas Vrabec <lvrabec>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 20CC: dominick.grift, dwalsh, erlang, lemenkov, lvrabec, mgrepl, plautrba, wtogami
Target Milestone: ---Keywords: Reopened
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
Whiteboard: abrt_hash:d16ac102e44569c1566c8430aa8a51459676a3edfa5ed27aa2acd1a7046da2db
Fixed In Version: selinux-policy-3.12.1-196.fc20 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-12-07 04:31:48 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Remy Nicolaï 2014-06-26 10:00:55 UTC 
Description of problem:
my be related with bug 1013372

on a fedora 20

install and launch couchdb OK
replicate a db I have on a couchdb webserver
issue when trying to get a view on that local replicated db
SELinux is preventing /usr/lib64/erlang/lib/couch-1.5.0/priv/couchjs from using the 'execmem' accesses on a process.

*****  Plugin catchall (100. confidence) suggests   **************************

If vous pensez que couchjs devrait être autorisé à accéder execmem sur les processus étiquetés rabbitmq_beam_t par défaut.
Then vous devriez rapporter ceci en tant qu'anomalie.
Vous pouvez générer un module de stratégie local pour autoriser cet accès.
Do
autoriser cet accès pour le moment en exécutant :
# grep couchjs /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:rabbitmq_beam_t:s0
Target Context                system_u:system_r:rabbitmq_beam_t:s0
Target Objects                 [ process ]
Source                        couchjs
Source Path                   /usr/lib64/erlang/lib/couch-1.5.0/priv/couchjs
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           couchdb-1.5.0-1.fc20.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.12.1-166.fc20.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     (removed)
Platform                      Linux (removed) 3.14.8-200.fc20.x86_64 #1 SMP Mon
                              Jun 16 21:57:53 UTC 2014 x86_64 x86_64
Alert Count                   1500
First Seen                    2014-06-26 11:11:00 CEST
Last Seen                     2014-06-26 11:32:02 CEST
Local ID                      360669d5-7346-4da3-9911-7a38130c1620

Raw Audit Messages
type=AVC msg=audit(1403775122.967:15300): avc:  denied  { execmem } for  pid=9540 comm="couchjs" scontext=system_u:system_r:rabbitmq_beam_t:s0 tcontext=system_u:system_r:rabbitmq_beam_t:s0 tclass=process


type=SYSCALL msg=audit(1403775122.967:15300): arch=x86_64 syscall=mmap success=yes exit=140365948039168 a0=0 a1=10000 a2=7 a3=22 items=0 ppid=9508 pid=9540 auid=4294967295 uid=991 gid=989 euid=991 suid=991 fsuid=991 egid=989 sgid=989 fsgid=989 tty=(none) ses=4294967295 comm=couchjs exe=/usr/lib64/erlang/lib/couch-1.5.0/priv/couchjs subj=system_u:system_r:rabbitmq_beam_t:s0 key=(null)

Hash: couchjs,rabbitmq_beam_t,rabbitmq_beam_t,process,execmem

Additional info:
reporter:       libreport-2.2.2
hashmarkername: setroubleshoot
kernel:         3.14.8-200.fc20.x86_64
type:           libreport
Comment 1 Lukas Vrabec 2014-09-11 15:06:35 UTC 
I fix and changed lot of issues related to couchdb,rabbitmq,ejabberd, now I close this, then it's appears again feel free to contact me.
Comment 3 Lukas Vrabec 2014-09-12 08:11:43 UTC 
Could anyone know, why is execmem needed?
Comment 4 Lukas Vrabec 2014-12-01 12:03:40 UTC 
commit 019ea58f76d9a70ee4c9ceab34319bfab978b02a
Author: Lukas Vrabec <lvrabec>
Date:   Mon Dec 1 12:49:51 2014 +0100

    Dontaudit couchdb to list /var

commit 933e40ab94b18fdaca471cfb712f6a2228caf77b
Merge: 7048265 7b8271e
Author: Lukas Vrabec <wrabcak.github.com>
Date:   Mon Dec 1 12:27:08 2014 +0100

    Merge pull request #6 from wtogami/couchdb_policy_fix
    
    Couchdb policy fixes
Comment 5 Fedora Update System 2014-12-03 12:50:13 UTC 
selinux-policy-3.12.1-196.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-196.fc20
Comment 6 Fedora Update System 2014-12-04 06:21:30 UTC 
Package selinux-policy-3.12.1-196.fc20:
* should fix your issue,
* was pushed to the Fedora 20 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-196.fc20'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-16229/selinux-policy-3.12.1-196.fc20
then log in and leave karma (feedback).
Comment 7 Fedora Update System 2014-12-07 04:31:48 UTC 
selinux-policy-3.12.1-196.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.