Bug 1178977
| Summary: | SELinux is preventing /usr/bin/freshclam from 'read' accesses on the file . | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Frank Büttner <bugzilla> |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 20 | CC: | dominick.grift, dwalsh, lvrabec, mgrepl, plautrba |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:9d8998744ae51064c5e191e4a2c01aaa74641b05c0efcf127030d656baf1a939 | ||
| Fixed In Version: | selinux-policy-3.12.1-197.fc20 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-03-10 00:56:06 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Needs to back ported. commit 823d44b1af32066c8375bf01dadf3b56263ffc53
Author: Dan Walsh <dwalsh>
Date: Fri Jan 2 07:30:04 2015 -0500
Allow antivirus domains to read system state
selinux-policy-3.12.1-197.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-197.fc20 Package selinux-policy-3.12.1-197.fc20: * should fix your issue, * was pushed to the Fedora 20 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-197.fc20' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2015-1398/selinux-policy-3.12.1-197.fc20 then log in and leave karma (feedback). selinux-policy-3.12.1-197.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report. |
Description of problem: SELinux is preventing /usr/bin/freshclam from 'read' accesses on the file . ***** Plugin catchall_boolean (89.3 confidence) suggests ****************** If sie folgendes tun möchten: antivirenprogrammen erlauben, normale Daten auszulesen Then sie müssen SELinux darüber benachrichtigen, indem Sie die boolesche Variable »antivirus_can_scan_system« aktivieren. Für weitere Einzelheiten, können Sie die »antivirus_selinux« man-Seiten konsultieren. Do setsebool -P antivirus_can_scan_system 1 ***** Plugin catchall (11.6 confidence) suggests ************************** If sie denken, dass es freshclam standardmässig erlaubt sein sollte, read Zugriff auf file zu erhalten. Then sie sollten dies als Fehler melden. Um diesen Zugriff zu erlauben, können Sie ein lokales Richtlinien-Modul erstellen. Do zugriff jetzt erlauben, indem Sie die nachfolgenden Befehle ausführen: # grep freshclam /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:antivirus_t:s0-s0:c0.c1023 Target Context system_u:object_r:proc_t:s0 Target Objects [ file ] Source freshclam Source Path /usr/bin/freshclam Port <Unknown> Host (removed) Source RPM Packages clamav-update-0.98.5-1.fc20.x86_64 Target RPM Packages Policy RPM selinux-policy-3.12.1-196.fc20.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 3.17.7-200.fc20.x86_64 #1 SMP Wed Dec 17 03:35:33 UTC 2014 x86_64 x86_64 Alert Count 3 First Seen 2014-12-10 18:38:33 CET Last Seen 2015-01-05 20:38:33 CET Local ID da94b953-b5ba-4e12-97f4-a7766af98ad2 Raw Audit Messages type=AVC msg=audit(1420486713.867:1092): avc: denied { read } for pid=2364 comm="freshclam" name="filesystems" dev="proc" ino=4026532047 scontext=system_u:system_r:antivirus_t:s0-s0:c0.c1023 tcontext=system_u:object_r:proc_t:s0 tclass=file permissive=0 type=SYSCALL msg=audit(1420486713.867:1092): arch=x86_64 syscall=open success=no exit=EACCES a0=356edbe8b8 a1=0 a2=1b6 a3=0 items=0 ppid=2363 pid=2364 auid=0 uid=992 gid=988 euid=992 suid=992 fsuid=992 egid=988 sgid=988 fsgid=988 tty=(none) ses=123 comm=freshclam exe=/usr/bin/freshclam subj=system_u:system_r:antivirus_t:s0-s0:c0.c1023 key=(null) Hash: freshclam,antivirus_t,proc_t,file,read Additional info: reporter: libreport-2.2.3 hashmarkername: setroubleshoot kernel: 3.17.7-200.fc20.x86_64 type: libreport Potential duplicate: bug 1172774