Bug 489539

Summary: avc: denied { read write ioctl } for comm="oracle" path="/dev/console"
Product: [Community] Spacewalk Reporter: Milan Zázrivec <mzazrivec>
Component: InstallationAssignee: Jan Pazdziora (Red Hat) <jpazdziora>
Status: CLOSED CURRENTRELEASE QA Contact: Milan Zázrivec <mzazrivec>
Severity: medium Docs Contact:
Priority: low    
Version: 0.5CC: bperkins
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-09-17 07:11:04 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 456553    
Attachments:
Description Flags
part of /var/log/audit/audit.log none

Description Milan Zázrivec 2009-03-10 16:25:44 UTC 
Created attachment 334670 [details]
part of /var/log/audit/audit.log

Description of problem:
SELinux denials occurred when starting oracle-xe with selinux enabled on
a paravirtualized xen-guest (startup viewing from host system via
xm console ...).

Version-Release number of selected component (if applicable):
oracle-xe-selinux-10.2-9.el5
oracle-nofcontext-selinux-0.1-23.5.el5

How reproducible:
Always

Steps to Reproduce:
1. Install RHEL-5.3 as a paravirtualized guest, selinux enabled.
2. Follow Oracle-XE installation instructions documented at
   https://fedorahosted.org/spacewalk/wiki/OracleXeSetup
3. oracle-xe-selinux and oracle-instantclient-selinux need to be installed.
4. Reboot your guest.
5. "xm console your-guest-name" from your host (this needs to be on when
   oracle-xe is starting for the denial to show up).
  
Actual results:
Attachment.

Expected results:
No denials.

Additional info:
N/A
Comment 1 Jan Pazdziora (Red Hat) 2009-04-10 11:12:06 UTC 
With RHEL 5.3 and

# rpm -qa | grep oracle | sort
oracle-instantclient-basic-10.2.0.4-1
oracle-instantclient-selinux-10.2-8.el5
oracle-instantclient-sqlplus-10.2.0.4-1
oracle-lib-compat-10.2-19.el5
oracle-nofcontext-selinux-0.1-23.6.el5
oracle-xe-selinux-10.2-9.el5
oracle-xe-univ-10.2.0.1-1.0

and

# rpm -qa | grep selinux | sort
libselinux-1.33.4-5.1.el5
libselinux-python-1.33.4-5.1.el5
libselinux-utils-1.33.4-5.1.el5
oracle-instantclient-selinux-10.2-8.el5
oracle-nofcontext-selinux-0.1-23.6.el5
oracle-xe-selinux-10.2-9.el5
selinux-policy-2.4.6-203.el5
selinux-policy-targeted-2.4.6-203.el5

I was (no longer) able to reproduce the issue.

As such, moving ON_QA for Spacewalk 0.5.
Comment 2 Jesus M. Rodriguez 2009-04-14 14:13:29 UTC 
Spacewalk 0.5 released.
Comment 3 Miroslav Suchý 2009-09-17 07:11:04 UTC 
Spacewalk 0.5 has been released for long time ago.