Bug 1953325
| Summary: | SELinux is preventing fail2ban-server from 'watch' accesses on the dossier /var/log/audit. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Heldwin <heldwin> |
| Component: | fail2ban | Assignee: | Richard Shaw <hobbes1069> |
| Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 34 | CC: | anon.amish, axel.thimm, hobbes1069, orion, vonsch, zpytela |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:1b8923ec6bc2fed7a4539642f26d2230e2843ebf5ef14528806156e5a4b9fb62; | ||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-05-26 15:48:22 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
*** This bug has been marked as a duplicate of bug 1943696 *** |
Description of problem: upgraded from f33 to f34 SELinux is preventing fail2ban-server from 'watch' accesses on the dossier /var/log/audit. ***** Plugin catchall (100. confidence) suggests ************************** Si vous pensez que fail2ban-server devrait être autorisé à accéder watch sur audit directory par défaut. Then vous devriez rapporter ceci en tant qu'anomalie. Vous pouvez générer un module de stratégie local pour autoriser cet accès. Do autoriser cet accès pour le moment en exécutant : # ausearch -c "fail2ban-server" --raw | audit2allow -M my-fail2banserver # semodule -X 300 -i my-fail2banserver.pp Additional Information: Source Context system_u:system_r:fail2ban_t:s0 Target Context system_u:object_r:auditd_log_t:s0 Target Objects /var/log/audit [ dir ] Source fail2ban-server Source Path fail2ban-server Port <Inconnu> Host (removed) Source RPM Packages Target RPM Packages audit-3.0.1-2.fc34.x86_64 SELinux Policy RPM selinux-policy-targeted-34.3-1.fc34.noarch Local Policy RPM fail2ban-selinux-0.11.2-3.fc34.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 5.11.16-300.fc34.x86_64 #1 SMP Wed Apr 21 13:18:33 UTC 2021 x86_64 x86_64 Alert Count 2 First Seen 2021-04-25 13:36:19 CEST Last Seen 2021-04-25 13:50:25 CEST Local ID a7f4a141-316c-4751-bd7d-22737c172b57 Raw Audit Messages type=AVC msg=audit(1619351425.203:230): avc: denied { watch } for pid=1621 comm="fail2ban-server" path="/var/log/audit" dev="dm-3" ino=67647806 scontext=system_u:system_r:fail2ban_t:s0 tcontext=system_u:object_r:auditd_log_t:s0 tclass=dir permissive=0 Hash: fail2ban-server,fail2ban_t,auditd_log_t,dir,watch Version-Release number of selected component: selinux-policy-targeted-34.3-1.fc34.noarch Additional info: component: fail2ban reporter: libreport-2.14.0 hashmarkername: setroubleshoot kernel: 5.11.16-300.fc34.x86_64 type: libreport