Bug 1124539

Description of problem:
When activating the selinux-ssh jail in fail2ban, the entire fail2ban service fails to start up.


Version-Release number of selected component (if applicable):
fail2ban-0.9-2.fc20.noarch
selinux-policy-targeted-3.12.1-179.fc20.noarch


How reproducible:
Every time.


Steps to Reproduce:
1. Enable the selinux-ssh jail in a jail.local file in /etc/fail2ban
2. Start the fail2ban service


Actual results:
The service fails to start.


Expected results:
The fail2ban service should run and check login attempts in the audit logs.


Additional info:
If I disable dontaudit rules, I get AVC:s about fail2ban_client_t not being allowed to search auditd_log_t directories.  When searching bugzilla, I found bug 1119002 about this message.  That bugzilla had been resolved by dontaudit:ing these messages.

But the access is actually necessary.  Fail2ban is looking in the audit logs for traces of attacks.  So it needs to be allowed, not ignored.  Experimenting with a local "fail2banfix" module a bit, I found out it also needs some additional permissions in order to read the log files.  (Not surprising.)  I ended up adding the line

   logging_read_audit_log(fail2ban_client_t)

to my module.

That makes the fail2ban service start.  But now I get AVC:s about fail2ban_t being disallowed the same access.  See an example below.  If I understand things correctly, a fail2ban_client_t process is run during startup to look for attacks before the service is started, while fail2ban_t is the server doing the continuous monitoring for new attacks.  So I also added this line

    logging_read_audit_log(fail2ban_t)

to my module.  And now, finally, I'm able to trigger the selinux-ssh jail!

I believe something like these rules should be added to the standard policy.

type=SYSCALL msg=audit(1406652876.657:15133): arch=c000003e syscall=2 success=no exit=-13 a0=10145b0 a1=0 a2=1b6 a3=7fd9bc3255d0 items=0 ppid=1 pid=14113 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="fail2ban-server" exe="/usr/bin/python2.7" subj=system_u:system_r:fail2ban_t:s0 key=(null)
type=AVC msg=audit(1406652876.657:15133): avc:  denied  { search } for  pid=14113 comm="fail2ban-server" name="audit" dev="dm-0" ino=5112304 scontext=system_u:system_r:fail2ban_t:s0 tcontext=system_u:object_r:auditd_log_t:s0 tclass=dir