Bug 203246
| Summary: | Postgres fails with selinux errors with ldap users | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Chris Jones <rollercow> | ||||
| Component: | selinux-policy | Assignee: | Daniel Walsh <dwalsh> | ||||
| Status: | CLOSED CURRENTRELEASE | QA Contact: | |||||
| Severity: | high | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | 5 | CC: | dwalsh, sitsofe, tgl | ||||
| Target Milestone: | --- | ||||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | 2.3.7-2.fc5 | Doc Type: | Bug Fix | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2007-01-12 13:54:51 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
Created attachment 134514 [details]
a policy "mostly" generated with audit2allow which makes it work
Fixed in selinux-policy-2.3.7-2.fc5 Change to modified This issue does indeed seem to be fixed |
Description of problem: When useing ldap for user auth, selinux fails. Version-Release number of selected component (if applicable): postgresql-8.1.4-1.FC5.1 selinux-policy-2.3.3-8.fc5 How reproducible: Always Steps to Reproduce: 1. Have users authenticating useing ldap 2. try to run psql as a ldap user 3. selinux errors Actual results: Aug 19 19:04:45 newsilver kernel: audit(1156010685.719:2916): avc: denied { name_connect } for pid=18993 comm="postmaster" dest=389 scontext=system_u:system_r:postgresql_t:s0 tcontext=system_u: object_r:ldap_port_t:s0 tclass=tcp_socket Aug 19 19:04:45 newsilver rollercow sucs [local] authentication: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1: Can't contact LDAP server Expected results: No errors, and working postges Additional info: Find attached a policy "mostly" generated with audit2allow which makes it work