Bug 158198
| Summary: | ldap selinux errors | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Thomas J. Baker <tjb> |
| Component: | selinux-policy-targeted | Assignee: | Daniel Walsh <dwalsh> |
| Status: | CLOSED DUPLICATE | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | rawhide | ||
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2005-05-19 15:09:49 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
From Bugzilla Helper: User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.7.8) Gecko/20050512 Fedora/1.0.4-2 Firefox/1.0.4 Description of problem: I can't start ldap with selinux enabled: fc4t3 + may 18th rawhide. I copied my /var/lib/ldap from FC3, made sure permissions were OK, and tried to start it. wintermute> su Password: [tjb@wintermute tjb]# restorecon -R /var/lib/ldap [tjb@wintermute tjb]# /etc/init.d/ldap start Checking configuration files for : [ OK ] Starting slapd: [FAILED] [tjb@wintermute tjb]# The audit log says this: type=AVC msg=audit(1116510663.072:2254113): avc: denied { dac_override } for capability=1 scontext=root:system_r:slapd_t tcontext=root:system_r:slapd_t tclass=capability type=AVC msg=audit(1116510663.072:2254113): avc: denied { dac_read_search } for capability=2 scontext=root:system_r:slapd_t tcontext=root:system_r:slapd_t tclass=capability type=SYSCALL msg=audit(1116510663.072:2254113): syscall=4 arch=c000003e success=no exit=-13 a0=555555849bd0 a1=7fffffeb6750 a2=7fffffeb6750 a3=2aaaaaae8000 items=1 pid=9609 loginuid=-1 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm=slaptest exe=/usr/sbin/slapd type=PATH msg=audit(1116510663.072:2254113): item=0 name="/var/lib/ldap/DB_CONFIG" inode=2262467 dev=fd:00 mode=040700 ouid=55 ogid=55 rdev=00:00 type=AVC msg=audit(1116510663.072:2254114): avc: denied { dac_override } for capability=1 scontext=root:system_r:slapd_t tcontext=root:system_r:slapd_t tclass=capability type=AVC msg=audit(1116510663.072:2254114): avc: denied { dac_read_search } for capability=2 scontext=root:system_r:slapd_t tcontext=root:system_r:slapd_t tclass=capability type=SYSCALL msg=audit(1116510663.072:2254114): syscall=2 arch=c000003e success=no exit=-13 a0=555555849bd0 a1=0 a2=1b6 a3=0 items=1 pid=9609 loginuid=-1 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm=slaptest exe=/usr/sbin/slapd type=PATH msg=audit(1116510663.072:2254114): item=0 name="/var/lib/ldap/DB_CONFIG" inode=2262467 dev=fd:00 mode=040700 ouid=55 ogid=55 rdev=00:00 type=AVC msg=audit(1116510663.072:2254116): avc: denied { dac_override } for capability=1 scontext=root:system_r:slapd_t tcontext=root:system_r:slapd_t tclass=capability type=AVC msg=audit(1116510663.072:2254116): avc: denied { dac_read_search } for capability=2 scontext=root:system_r:slapd_t tcontext=root:system_r:slapd_t tclass=capability type=SYSCALL msg=audit(1116510663.072:2254116): syscall=4 arch=c000003e success=no exit=-13 a0=55555584a900 a1=7fffffeb67c0 a2=7fffffeb67c0 a3=55555584a90e items=1 pid=9609 loginuid=-1 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm=slaptest exe=/usr/sbin/slapd type=PATH msg=audit(1116510663.072:2254116): item=0 name="/var/lib/ldap/__db.002" inode=2262467 dev=fd:00 mode=040700 ouid=55 ogid=55 rdev=00:00 type=AVC msg=audit(1116510663.133:2255606): avc: denied { search } for name=pki dev=dm-0 ino=196669 scontext=root:system_r:slapd_t tcontext=system_u:object_r:cert_t tclass=dir type=SYSCALL msg=audit(1116510663.133:2255606): syscall=2 arch=c000003e success=no exit=-13 a0=5555558449b0 a1=0 a2=1b6 a3=0 items=1 pid=9612 loginuid=-1 uid=55 gid=55 euid=55 suid=55 fsuid=55 egid=55 sgid=55 fsgid=55 comm=slapd exe=/usr/sbin/slapd type=PATH msg=audit(1116510663.133:2255606): item=0 name="/etc/pki/tls/certs/ca-bundle.crt" inode=196669 dev=fd:00 mode=040755 ouid=0 ogid=0 rdev=00:00 Version-Release number of selected component (if applicable): selinux-policy-targeted-1.23.16-1 How reproducible: Always Steps to Reproduce: 1. install openldap-servers, try to start it with selinux enabled 2. 3. Actual Results: selinux errors Expected Results: started normally Additional info: