Bug 1164182
Summary: | SELinux prevents openvpn from accessing management socket | ||
---|---|---|---|
Product: | [Fedora] Fedora | Reporter: | Andreas Fleig <andreasfleig> |
Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
Severity: | high | Docs Contact: | |
Priority: | unspecified | ||
Version: | 21 | CC: | dominick.grift, dwalsh, dzrudy, junk, lvrabec, mgrepl, ngc2997, pbonzini, plautrba, sbose, suren, twaugh |
Target Milestone: | --- | ||
Target Release: | --- | ||
Hardware: | Unspecified | ||
OS: | Unspecified | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2014-11-19 13:51:01 UTC | Type: | Bug |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: |
Description
Andreas Fleig
2014-11-14 09:33:01 UTC
*** Bug 1164186 has been marked as a duplicate of this bug. *** commit 1e7882e582e0d769e87263dd0f1dcb0feaa663b3 Author: Lukas Vrabec <lvrabec> Date: Fri Nov 14 12:54:40 2014 +0100 Allow openvpn to stream connect to networkmanager. BZ(1164182) I now get type=AVC msg=audit(1415984220.840:449): avc: denied { write } for pid=2327 comm="openvpn" name="NetworkManager" dev="tmpfs" ino=21852 scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:object_r:NetworkManager_var_run_t:s0 tclass=dir permissive=0 with selinux-policy-3.13.1-96.fc21. Description of problem: 1. Create an openvpn connection with a pre-shared key from user's home directory (might be or not be important) 2. Activate the connection Version-Release number of selected component: selinux-policy-3.13.1-92.fc21.noarch Additional info: reporter: libreport-2.3.0 hashmarkername: setroubleshoot kernel: 3.17.2-300.fc21.x86_64 type: libreport Description of problem: Tried to connect to openvpn network. Version-Release number of selected component: selinux-policy-3.13.1-92.fc21.noarch Additional info: reporter: libreport-2.3.0 hashmarkername: setroubleshoot kernel: 3.17.2-300.fc21.x86_64 type: libreport Description of problem: Starting an existing VPN Version-Release number of selected component: selinux-policy-3.13.1-92.fc21.noarch Additional info: reporter: libreport-2.3.0 hashmarkername: setroubleshoot kernel: 3.17.2-300.fc21.x86_64 type: libreport Description of problem: See also bug 1165572. Version-Release number of selected component: selinux-policy-3.13.1-92.fc21.noarch Additional info: reporter: libreport-2.3.0 hashmarkername: setroubleshoot kernel: 3.17.3-300.fc21.x86_64 type: libreport I get the following with selinux-policy-3.13.1-96.fc21.noarch in permissive mode: # ausearch -ts recent -m AVC ---- time->Wed Nov 19 10:22:44 2014 type=AVC msg=audit(1416388964.261:1041): avc: denied { write } for pid=26587 comm="openvpn" name="NetworkManager" dev="tmpfs" ino=22979 scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:object_r:NetworkManager_var_run_t:s0 tclass=dir permissive=1 ---- time->Wed Nov 19 10:22:44 2014 type=AVC msg=audit(1416388964.261:1042): avc: denied { remove_name } for pid=26587 comm="openvpn" name="nm-openvpn-8bbe9b2a-0a1b-4a38-8773-bde72eef87ea" dev="tmpfs" ino=52653 scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:object_r:NetworkManager_var_run_t:s0 tclass=dir permissive=1 ---- time->Wed Nov 19 10:22:44 2014 type=AVC msg=audit(1416388964.261:1043): avc: denied { unlink } for pid=26587 comm="openvpn" name="nm-openvpn-8bbe9b2a-0a1b-4a38-8773-bde72eef87ea" dev="tmpfs" ino=52653 scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:object_r:NetworkManager_var_run_t:s0 tclass=sock_file permissive=1 ---- time->Wed Nov 19 10:22:44 2014 type=AVC msg=audit(1416388964.261:1044): avc: denied { add_name } for pid=26587 comm="openvpn" name="nm-openvpn-8bbe9b2a-0a1b-4a38-8773-bde72eef87ea" scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:object_r:NetworkManager_var_run_t:s0 tclass=dir permissive=1 ---- time->Wed Nov 19 10:22:44 2014 type=AVC msg=audit(1416388964.261:1045): avc: denied { create } for pid=26587 comm="openvpn" name="nm-openvpn-8bbe9b2a-0a1b-4a38-8773-bde72eef87ea" scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:object_r:NetworkManager_var_run_t:s0 tclass=sock_file permissive=1 or in short # ausearch -ts recent -m AVC | audit2allow #============= openvpn_t ============== allow openvpn_t NetworkManager_var_run_t:dir { write remove_name add_name }; allow openvpn_t NetworkManager_var_run_t:sock_file { create unlink }; HTH bye, Sumit *** This bug has been marked as a duplicate of bug 1165110 *** |