Bug 2322867
| Summary: | selinux policy violations when asterisk tries to read /proc/sys/net | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Dave Koberstein <davek> |
| Component: | selinux-policy | Assignee: | Jared Smith <jsmith.fedora> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 41 | CC: | bennie.joubert, dwalsh, epel-packagers-sig, jsmith.fedora, lvrabec, mmalik, omosnacek, pkoncity, vmojzis, zpytela |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-41.39-1.fc41 | Doc Type: | --- |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2025-05-14 01:19:31 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Seems to still be in f42. Should this bug be applied to selinux-policy-targeted? I think that's the rpm where it needs to be resolved. I added selinux to the keywords field. I corresponded with Jared and he thought this made more sense assigned to selinux-policy (targeted in my case). So moving the component. FEDORA-2025-a84432e770 (selinux-policy-41.39-1.fc41) has been submitted as an update to Fedora 41. https://bodhi.fedoraproject.org/updates/FEDORA-2025-a84432e770 FEDORA-2025-a84432e770 has been pushed to the Fedora 41 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-a84432e770` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-a84432e770 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2025-a84432e770 (selinux-policy-41.39-1.fc41) has been pushed to the Fedora 41 stable repository. If problem still persists, please make note of it in this bug report. |
This seems to have been around for a while. It was reported in Redhat here: 1810727, which was closed for being reported too late in a release cycle. pjsip wants to read /proc/sys/net to figure out some networking information to configure itself. This seems to be triggering selinux policy violations. As covered in the bug above this local policy will resolve it: module my-asterisk 1.0; require { type asterisk_t; type sysctl_net_t; class dir search; class file { getattr open read }; } #============= asterisk_t ============== allow asterisk_t sysctl_net_t:dir search; allow asterisk_t sysctl_net_t:file { getattr open read }; Reproducible: Always Steps to Reproduce: 1. configure asterisk to use pjsip with a "type = transport" section 2. start asterisk 3. check for selinux policy violations for reading from /proc/sys/net/ipv6 and ipv4 Actual Results: I think asterisk is actually running ok. I found these issues by reviewing my journalctl setroubleshoot output. Expected Results: No selinux policy voilations