Bug 229017
| Summary: | snmp-enabled squid throws avc denied | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 4 | Reporter: | Peter Bieringer <pb> |
| Component: | selinux-policy-targeted | Assignee: | Daniel Walsh <dwalsh> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 4.0 | CC: | dwalsh |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | RHBA-2007-0741 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2007-11-15 16:07:00 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
At least related to that issue are following avc denied messages:
Apr 10 12:43:39 server kernel: audit(1176201819.386:25): avc: denied { read }
for pid=19295 comm="snmpd" name="mib.txt" dev=sda2 ino=291075
scontext=root:system_r:snmpd_t tcontext=system_u:object_r:squid_conf_t tclass=file
Apr 10 12:43:39 server kernel: audit(1176201819.386:26): avc: denied { getattr
} for pid=19295 comm="snmpd" name="mib.txt" dev=sda2 ino=291075
scontext=root:system_r:snmpd_t tcontext=system_u:object_r:squid_conf_t tclass=file
They are caused by restart of snmpd, after specifying squid's SNMP mib file in
/etc/snmp/conf (looks like the snmpd also reads the snmp client config file...):
# grep squid /etc/snmp/snmp.conf
mibfile /etc/squid/mib.txt
Fixed in selinux-policy-targeted-1.17.30-2.146 This request was evaluated by Red Hat Product Management for inclusion in a Red Hat Enterprise Linux maintenance release. Product Management has requested further review of this request by Red Hat Engineering, for potential inclusion in a Red Hat Enterprise Linux Update release for currently deployed products. This request is not yet committed for inclusion in an Update release. Can't reproduce with selinux-policy-targeted-1.17.30-2.145.noarch
following lines has been uncommented in squid.conf
snmp_port 3401
acl snmppublic snmp_community public
snmp_access allow snmppublic localhost
# netstat -an | grep :3401
udp 0 0 0.0.0.0:3401 0.0.0.0:*
Only following unrelevant lines to tested bug has appeared after each restart:
type=AVC msg=audit(1187032781.014:465): avc: denied { search } for pid=12548
comm="squid" name="tps" dev=0:13 ino=5264296 scontext=root:system_r:squid_t
tcontext=system_u:object_r:nfs_t tclass=dir
type=SYSCALL msg=audit(1187032781.014:465): arch=14 syscall=11 success=no
exit=-13 a0=ffffd6d0 a1=ffffc690 a2=ffffea90 a3=2 items=1 pid=12548 auid=429496729
5 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm="squid"
exe="/usr/sbin/squid"
type=CWD msg=audit(1187032781.014:465): cwd="/opt/Errata/2007:0741/tps"
type=PATH msg=audit(1187032781.014:465): name="squid_start" flags=101
inode=5264296 dev=00:13 mode=042755 ouid=0 ogid=1076 rdev=00:00
Sorry for delay, was out-of-office:
here the related configuration parts:
snmp_port 3401
acl snmppublic snmp_community mrtg
snmp_access allow snmppublic localhost
snmp_access deny all
snmp_incoming_address 127.0.0.1
# rpm -q selinux-policy-targeted
selinux-policy-targeted-1.17.30-2.145
Following log lines were seen in the latest past related to squid:
Aug 9 09:25:17 server kernel: audit(1186644317.132:14): avc: denied {
name_bind } for pid=4136 comm="squid" src=3401 scontext=user_u:system_r:squid_t
tcontext=system_u:object_r:port_t tclass=udp_socket
Aug 9 09:26:33 server kernel: audit(1186644393.888:15): avc: denied {
name_bind } for pid=31580 comm="squid" src=3401 scontext=root:system_r:squid_t
tcontext=system_u:object_r:port_t tclass=udp_socket
Aug 10 09:23:58 server kernel: audit(1186730638.068:16): avc: denied { search
} for pid=23926 comm="snmpd" name="squid" dev=sda2 ino=291070
scontext=system_u:system_r:snmpd_t tcontext=system_u:object_r:squid_conf_t
tclass=dir
If you download the candidate policy for the u5 update, does squid work for you. http://people.redhat.com/dwalsh/SELinux/RHEL4 It's gone after updating to selinux-policy-targeted-1.17.30-2.148 and restarting squid. An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2007-0741.html |
Description of problem: After enabling the SNMP server in squid for monitoring I found several avc denied messages. Version-Release number of selected component (if applicable): squid-2.5.STABLE6-3.4E.12 selinux-policy-targeted-1.17.30-2.140 selinux runs in permissive mode How reproducible: Afer each restart Steps to Reproduce: 1. enable SNMP server in squid 2. restart squid Actual results: Feb 13 09:50:25 server kernel: audit(1171356625.011:8): avc: denied { name_bind } for pid=2798 comm="squid" src=3401 scontext=user_u:system_r:squid_t tcontext=system_u:object_r:port_t tclass=udp_socket Feb 13 13:52:09 server kernel: audit(1171371129.246:9): avc: denied { name_bind } for pid=2798 comm="squid" src=3401 scontext=user_u:system_r:squid_t tcontext=system_u:object_r:port_t tclass=udp_socket Feb 13 14:18:51 server kernel: audit(1171372731.965:10): avc: denied { name_bind } for pid=12051 comm="squid" src=3401 scontext=root:system_r:squid_t tcontext=system_u:object_r:port_t tclass=udp_socket Expected results: No such messages Additional info: Looks like there is something missing in the squid related selinux policy.