Bug 240870

Summary:	SELinux doesn't like chrooted named
Product:	Red Hat Enterprise Linux 5	Reporter:	David Northrop <djn>
Component:	bind	Assignee:	Adam Tkac <atkac>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	medium
Version:	5.0	CC:	ovasik
Target Milestone:	---
Target Release:	---
Hardware:	i386
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2007-05-22 15:48:32 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description David Northrop 2007-05-22 15:22:31 UTC

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.3) Gecko/20070417 Fedora/2.0.0.3-4.fc7 Firefox/2.0.0.3

Description of problem:
SELinux is preventing /usr/sbin/named (named_t) "unlink" access to named.pid (named_zone_t).
Detailed Description
  SELinux denied access requested by /usr/sbin/named. It is not expected that this access is required by /usr/sbin/named and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Please file a bug report against this package.

bind-9.3.3-8.el5
bind-utils-9.3.3-8.el5
bind-chroot-9.3.3-8.el5
bind-libs-9.3.3-8.el5


Version-Release number of selected component (if applicable):
bind-9.3.3-8.el5

How reproducible:
Always


Steps to Reproduce:
1.install bind-chroot
2.run it
3.

Actual Results:
You get the SELinux request to file a bug report.


Expected Results:
SELinux should be very happy

Additional info:
I don't (yet) run SELinux enforcing so it's not an immediate problem for me.

Comment 1 David Northrop 2007-05-22 15:46:02 UTC

restorecon -R /var/named/chroot/var/run/
seems to have fixed it.

Let's assume it's not a redhat problem.
I'd close it NOTABUG if I could.

HAND

Comment 2 Adam Tkac 2007-05-22 15:48:32 UTC

Yeah, I'm writting comment that you could try restorecon on named.pid :) I'm
closing this one.

Regards, Adam