Bug 1164182
| Summary: | SELinux prevents openvpn from accessing management socket | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Andreas Fleig <andreasfleig> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 21 | CC: | dominick.grift, dwalsh, dzrudy, junk, lvrabec, mgrepl, ngc2997, pbonzini, plautrba, sbose, suren, twaugh |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2014-11-19 13:51:01 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Andreas Fleig
2014-11-14 09:33:01 UTC
*** Bug 1164186 has been marked as a duplicate of this bug. *** commit 1e7882e582e0d769e87263dd0f1dcb0feaa663b3
Author: Lukas Vrabec <lvrabec>
Date: Fri Nov 14 12:54:40 2014 +0100
Allow openvpn to stream connect to networkmanager. BZ(1164182)
I now get
type=AVC msg=audit(1415984220.840:449): avc: denied { write } for pid=2327 comm="openvpn" name="NetworkManager" dev="tmpfs" ino=21852 scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:object_r:NetworkManager_var_run_t:s0 tclass=dir permissive=0
with selinux-policy-3.13.1-96.fc21.
Description of problem: 1. Create an openvpn connection with a pre-shared key from user's home directory (might be or not be important) 2. Activate the connection Version-Release number of selected component: selinux-policy-3.13.1-92.fc21.noarch Additional info: reporter: libreport-2.3.0 hashmarkername: setroubleshoot kernel: 3.17.2-300.fc21.x86_64 type: libreport Description of problem: Tried to connect to openvpn network. Version-Release number of selected component: selinux-policy-3.13.1-92.fc21.noarch Additional info: reporter: libreport-2.3.0 hashmarkername: setroubleshoot kernel: 3.17.2-300.fc21.x86_64 type: libreport Description of problem: Starting an existing VPN Version-Release number of selected component: selinux-policy-3.13.1-92.fc21.noarch Additional info: reporter: libreport-2.3.0 hashmarkername: setroubleshoot kernel: 3.17.2-300.fc21.x86_64 type: libreport Description of problem: See also bug 1165572. Version-Release number of selected component: selinux-policy-3.13.1-92.fc21.noarch Additional info: reporter: libreport-2.3.0 hashmarkername: setroubleshoot kernel: 3.17.3-300.fc21.x86_64 type: libreport I get the following with selinux-policy-3.13.1-96.fc21.noarch in permissive mode:
# ausearch -ts recent -m AVC
----
time->Wed Nov 19 10:22:44 2014
type=AVC msg=audit(1416388964.261:1041): avc: denied { write } for pid=26587 comm="openvpn" name="NetworkManager" dev="tmpfs" ino=22979 scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:object_r:NetworkManager_var_run_t:s0 tclass=dir permissive=1
----
time->Wed Nov 19 10:22:44 2014
type=AVC msg=audit(1416388964.261:1042): avc: denied { remove_name } for pid=26587 comm="openvpn" name="nm-openvpn-8bbe9b2a-0a1b-4a38-8773-bde72eef87ea" dev="tmpfs" ino=52653 scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:object_r:NetworkManager_var_run_t:s0 tclass=dir permissive=1
----
time->Wed Nov 19 10:22:44 2014
type=AVC msg=audit(1416388964.261:1043): avc: denied { unlink } for pid=26587 comm="openvpn" name="nm-openvpn-8bbe9b2a-0a1b-4a38-8773-bde72eef87ea" dev="tmpfs" ino=52653 scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:object_r:NetworkManager_var_run_t:s0 tclass=sock_file permissive=1
----
time->Wed Nov 19 10:22:44 2014
type=AVC msg=audit(1416388964.261:1044): avc: denied { add_name } for pid=26587 comm="openvpn" name="nm-openvpn-8bbe9b2a-0a1b-4a38-8773-bde72eef87ea" scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:object_r:NetworkManager_var_run_t:s0 tclass=dir permissive=1
----
time->Wed Nov 19 10:22:44 2014
type=AVC msg=audit(1416388964.261:1045): avc: denied { create } for pid=26587 comm="openvpn" name="nm-openvpn-8bbe9b2a-0a1b-4a38-8773-bde72eef87ea" scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:object_r:NetworkManager_var_run_t:s0 tclass=sock_file permissive=1
or in short
# ausearch -ts recent -m AVC | audit2allow
#============= openvpn_t ==============
allow openvpn_t NetworkManager_var_run_t:dir { write remove_name add_name };
allow openvpn_t NetworkManager_var_run_t:sock_file { create unlink };
HTH
bye,
Sumit
*** This bug has been marked as a duplicate of bug 1165110 *** |