Bug 476585

Hi, rpc2 isn't the package you're looking for. I've corrected the component. Thanks.

Is rpcbind running when this fails?

(In reply to comment #2)
> Is rpcbind running when this fails?

Actually no. SElinux was preventing rpcbind from starting for some reason. I disabled SElinux, started rpcbind, and was then able to start nfslock.

This is the SElinux denial message:

Summary:

SELinux is preventing rpcbind (rpcbind_t) "setgid" rpcbind_t.

Detailed Description:

[SELinux is in permissive mode, the operation would have been denied but was
permitted due to permissive mode.]

SELinux denied access requested by rpcbind. It is not expected that this access
is required by rpcbind and this access may signal an intrusion attempt. It is
also possible that the specific version or configuration of the application is
causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Additional Information:

Source Context                unconfined_u:system_r:rpcbind_t:s0
Target Context                unconfined_u:system_r:rpcbind_t:s0
Target Objects                None [ capability ]
Source                        rpcbind
Source Path                   /sbin/rpcbind
Port                          <Unknown>
Host                          lptp
Source RPM Packages           rpcbind-0.1.7-1.fc9
Target RPM Packages           
Policy RPM                    selinux-policy-3.3.1-111.fc9
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Permissive
Plugin Name                   catchall
Host Name                     lptp
Platform                      Linux lptp 2.6.27.8 #1 SMP Sat
                              Dec 6 12:01:11 CST 2008 i686 i686
Alert Count                   1
First Seen                    Tue 16 Dec 2008 04:48:54 PM CST
Last Seen                     Tue 16 Dec 2008 04:51:39 PM CST
Local ID                      aa504a09-0c65-49f0-8de5-222cfcd3d35f
Line Numbers                  

Raw Audit Messages            

node=lptp type=AVC msg=audit(1229467899.253:25): avc:  denied  { setgid } for  pid=3271 comm="rpcbind" capability=6 scontext=unconfined_u:system_r:rpcbind_t:s0 tcontext=unconfined_u:system_r:rpcbind_t:s0 tclass=capability

node=lptp type=SYSCALL msg=audit(1229467899.253:25): arch=40000003 syscall=214 success=yes exit=0 a0=20 a1=b7eb69bc a2=b7deb5b0 a3=bfd47300 items=0 ppid=3270 pid=3271 auid=500 uid=0 gid=32 euid=0 suid=0 fsuid=0 egid=32 sgid=32 fsgid=32 tty=(none) ses=1 comm="rpcbind" exe="/sbin/rpcbind" subj=unconfined_u:system_r:rpcbind_t:s0 key=(null)

I have also found that my Fedora 9 fails to start nfs statd on boot-up and fails to turn-off rpcbind when shutting down. On December 7th everything was working OK and the bug appeared after having run yum update. After the update the two following warnings were issued by setroubleshootd:

SummarySELinux is preventing rpcbind (rpcbind_t) "setgid" rpcbind_t. Detailed DescriptionSELinux denied access requested by rpcbind. It is not expected that this access is required by rpcbind and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing AccessYou can generate a local policy module to allow this access - see FAQ Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report against this package. Additional InformationSource Context:  unconfined_u:system_r:rpcbind_t:s0Target Context:  unconfined_u:system_r:rpcbind_t:s0Target Objects:  None [ capability ]Source:  rpcbindSource Path:  /sbin/rpcbindPort:  <Unknown>Host:  ws0lSource RPM Packages:  rpcbind-0.1.7-1.fc9Target RPM Packages:  Policy RPM:  selinux-policy-3.3.1-111.fc9Selinux Enabled:  TruePolicy Type:  targetedMLS Enabled:  TrueEnforcing Mode:  EnforcingPlugin Name:  catchallHost Name:  ws0lPlatform:  Linux ws0l 2.6.27.5-41.fc9.i686 #1 SMP Thu Nov 13 20:52:14 EST 2008 i686 i686Alert Count:  1First Seen:  Wed 17 Dec 2008 05:41:01 PM UTCLast Seen:  Wed 17 Dec 2008 05:41:01 PM UTCLocal ID:  47ae0003-ed81-4d6e-9dec-a37808ebd394Line Numbers:  Raw Audit Messages :node=ws0l type=AVC msg=audit(1229535661.718:38): avc: denied { setgid } for pid=6941 comm="rpcbind" capability=6 scontext=unconfined_u:system_r:rpcbind_t:s0 tcontext=unconfined_u:system_r:rpcbind_t:s0 tclass=capability node=ws0l type=SYSCALL msg=audit(1229535661.718:38): arch=40000003 syscall=214 success=no exit=-1 a0=20 a1=2db9bc a2=2105b0 a3=bfa23b90 items=0 ppid=6940 pid=6941 auid=501 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="rpcbind" exe="/sbin/rpcbind" subj=unconfined_u:system_r:rpcbind_t:s0 key=(null) 

SummarySELinux is preventing sshd (sshd_t) "search" crond_t. Detailed DescriptionSELinux denied access requested by sshd. It is not expected that this access is required by sshd and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing AccessYou can generate a local policy module to allow this access - see FAQ Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report against this package. Additional InformationSource Context:  system_u:system_r:sshd_t:s0-s0:c0.c1023Target Context:  system_u:system_r:crond_t:s0-s0:c0.c1023Target Objects:  None [ key ]Source:  sshdSource Path:  /usr/sbin/sshdPort:  <Unknown>Host:  ws0lSource RPM Packages:  openssh-server-5.1p1-3.fc9Target RPM Packages:  Policy RPM:  selinux-policy-3.3.1-107.fc9Selinux Enabled:  TruePolicy Type:  targetedMLS Enabled:  TrueEnforcing Mode:  EnforcingPlugin Name:  catchallHost Name:  ws0lPlatform:  Linux ws0l 2.6.27.5-41.fc9.i686 #1 SMP Thu Nov 13 20:52:14 EST 2008 i686 i686Alert Count:  15First Seen:  Tue 02 Dec 2008 09:16:11 AM UTCLast Seen:  Tue 02 Dec 2008 10:27:44 AM UTCLocal ID:  832c4a89-e9a6-4521-9590-e026f21e82b7Line Numbers:  Raw Audit Messages :node=ws0l type=AVC msg=audit(1228213664.81:195): avc: denied { search } for pid=3431 comm="sshd" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:crond_t:s0-s0:c0.c1023 tclass=key node=ws0l type=SYSCALL msg=audit(1228213664.81:195): arch=40000003 syscall=288 success=no exit=-13 a0=0 a1=fffffffd a2=0 a3=0 items=0 ppid=2350 pid=3431 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)

the selinux-policy-3.3.1-115 is available in the yum repos which
fixes this problem... please update... 

The selinux-policy can also be found at:
http://koji.fedoraproject.org/koji/buildinfo?buildID=73996

*** Bug 476919 has been marked as a duplicate of this bug. ***

*** Bug 476928 has been marked as a duplicate of this bug. ***