This site requires JavaScript to be enabled to function correctly, please enable it.
Summary:
Keepalived 1.3.5 refuses to start due to selinux
Product:
[Fedora] Fedora
Reporter:
Robin <robin.bjorklin>
Component:
selinux-policy Assignee:
Lukas Vrabec <lvrabec>
Status:
CLOSED
ERRATA
QA Contact:
Fedora Extras Quality Assurance <extras-qa>
Severity:
medium
Docs Contact:
Priority:
unspecified
Version:
25 CC:
athmanem, bperkins, dominick.grift, dwalsh, lvrabec, matthias, mgrepl, plautrba, pmoore, rohara, ssekidde
Target Milestone:
---
Target Release:
---
Hardware:
x86_64
OS:
Linux
Whiteboard:
Fixed In Version:
selinux-policy-3.13.1-225.18.fc25
Doc Type:
If docs needed, set a value
Doc Text:
Story Points:
---
Clone Of:
Environment:
Last Closed:
2017-06-14 07:22:39 UTC
Type:
Bug
Regression:
---
Mount Type:
---
Documentation:
---
CRM:
Verified Versions:
Category:
---
oVirt Team:
---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:
---
Target Upstream Version:
Embargoed:
Description of problem: After an upgrade of keepalived from 1.3.2 to 1.3.5 it refuses to start when selinux is in enforcing mode. Version-Release number of selected component (if applicable): 1.3.5 How reproducible: Always Steps to Reproduce: 1. Upgrade 2. Try to start 3. Actual results: Start fails Expected results: Start successful Additional info: # ausearch -m avc,user_avc,selinux_err,user_selinux_err -i -ts recent ---- type=AVC msg=audit(06/02/2017 11:59:32.180:333348) : avc: denied { read write } for pid=7012 comm=keepalived name=core_pattern dev="proc" ino=44362028 scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:object_r:usermodehelper_t:s0 tclass=file permissive=0 ---- type=AVC msg=audit(06/02/2017 11:59:32.188:333350) : avc: denied { read } for pid=7016 comm=keepalived name=modprobe dev="proc" ino=43213025 scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:object_r:usermodehelper_t:s0 tclass=file permissive=0 ---- type=AVC msg=audit(06/02/2017 11:59:39.878:333359) : avc: denied { read write } for pid=7348 comm=keepalived name=core_pattern dev="proc" ino=44362028 scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:object_r:usermodehelper_t:s0 tclass=file permissive=0 ---- type=AVC msg=audit(06/02/2017 11:59:39.885:333360) : avc: denied { read } for pid=7351 comm=keepalived name=modprobe dev="proc" ino=43213025 scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:object_r:usermodehelper_t:s0 tclass=file permissive=0 ---- type=AVC msg=audit(06/02/2017 12:03:27.919:333394) : avc: denied { read write } for pid=7902 comm=keepalived name=core_pattern dev="proc" ino=44362028 scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:object_r:usermodehelper_t:s0 tclass=file permissive=0 ---- type=AVC msg=audit(06/02/2017 12:03:27.927:333396) : avc: denied { read } for pid=7905 comm=keepalived name=modprobe dev="proc" ino=43213025 scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:object_r:usermodehelper_t:s0 tclass=file permissive=0 ---- type=USER_AVC msg=audit(06/02/2017 12:03:38.834:333400) : pid=738 uid=dbus auid=unset ses=unset subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: received setenforce notice (enforcing=0) exe=/usr/bin/dbus-daemon (deleted) sauid=dbus hostname=? addr=? terminal=?' ---- type=USER_AVC msg=audit(06/02/2017 12:03:42.841:333401) : pid=1 uid=root auid=unset ses=unset subj=system_u:system_r:init_t:s0 msg='avc: received setenforce notice (enforcing=0) exe=/usr/lib/systemd/systemd sauid=root hostname=? addr=? terminal=?' ---- type=AVC msg=audit(06/02/2017 12:03:42.853:333402) : avc: denied { read write } for pid=7966 comm=keepalived name=core_pattern dev="proc" ino=44362028 scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:object_r:usermodehelper_t:s0 tclass=file permissive=1 ---- type=AVC msg=audit(06/02/2017 12:03:42.853:333403) : avc: denied { open } for pid=7966 comm=keepalived path=/proc/sys/kernel/core_pattern dev="proc" ino=44362028 scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:object_r:usermodehelper_t:s0 tclass=file permissive=1 ---- type=AVC msg=audit(06/02/2017 12:03:42.863:333405) : avc: denied { read } for pid=7969 comm=keepalived name=modprobe dev="proc" ino=43213025 scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:object_r:usermodehelper_t:s0 tclass=file permissive=1 ---- type=AVC msg=audit(06/02/2017 12:03:42.863:333406) : avc: denied { open } for pid=7969 comm=keepalived path=/proc/sys/kernel/modprobe dev="proc" ino=43213025 scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:object_r:usermodehelper_t:s0 tclass=file permissive=1 ---- type=AVC msg=audit(06/02/2017 12:03:42.864:333407) : avc: denied { create } for pid=7969 comm=keepalived scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:system_r:keepalived_t:s0 tclass=netlink_netfilter_socket permissive=1 ---- type=AVC msg=audit(06/02/2017 12:03:42.864:333408) : avc: denied { bind } for pid=7969 comm=keepalived scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:system_r:keepalived_t:s0 tclass=netlink_netfilter_socket permissive=1 ---- type=AVC msg=audit(06/02/2017 12:03:42.864:333409) : avc: denied { getattr } for pid=7969 comm=keepalived scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:system_r:keepalived_t:s0 tclass=netlink_netfilter_socket permissive=1 ---- type=AVC msg=audit(06/02/2017 12:04:16.482:333412) : avc: denied { write } for pid=7967 comm=keepalived name=core_pattern dev="proc" ino=44362028 scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:object_r:usermodehelper_t:s0 tclass=file permissive=1