Bug 518886
| Summary: | SELinux is preventing snmpd (snmpd_t) "open" removable_device_t | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Anthony Messina <amessina> |
| Component: | selinux-policy-targeted | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED ERRATA | QA Contact: | Ben Levenson <benl> |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | 11 | CC: | dwalsh |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | i686 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | 3.6.12-80.fc11 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2009-08-28 21:57:00 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Miroslav, Change storage_dontaudit_read_removable_device dontaudit $1 removable_device_t:blk_file read_file_perms; dontaudit $1 removable_device_t:blk_file read_blk_file_perms; Fixed in selinux-policy-3.6.12-80.fc11 selinux-policy-3.6.12-80.fc11 has been submitted as an update for Fedora 11. http://admin.fedoraproject.org/updates/selinux-policy-3.6.12-80.fc11 selinux-policy-3.6.12-80.fc11 has been pushed to the Fedora 11 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F11/FEDORA-2009-8895 (In reply to comment #3) > Fixed in selinux-policy-3.6.12-80.fc11 I confirm this fixes the problem I reported. Thanks. selinux-policy-3.6.12-80.fc11 has been pushed to the Fedora 11 stable repository. If problems still persist, please make note of it in this bug report. |
I am not sure why, one one of my i686.PAE machines, I get the following error in permissive mode. Cacti polls the server every 5 minutes for stats and it never fails that I get the following error. Except for the difference in hostname" the snmpd.conf file is exactly the same as another of my machines (another i686.PAE) Source Context system_u:system_r:snmpd_t:s0 Target Context system_u:object_r:removable_device_t:s0 Target Objects fd0 [ blk_file ] Source snmpd Source Path /usr/sbin/snmpd Port <Unknown> Host example.com Source RPM Packages net-snmp-5.4.2.1-12.fc11 Target RPM Packages Policy RPM selinux-policy-3.6.12-78.fc11 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Permissive Plugin Name catchall Host Name example.com Platform Linux example.com 2.6.29.6-217.2.8.fc11.i686.PAE #1 SMP Sat Aug 15 01:07:59 EDT 2009 i686 i686 Alert Count 2082 First Seen Mon Aug 10 14:50:10 2009 Last Seen Sun Aug 23 06:05:13 2009 Local ID fb730e45-96ca-433a-8025-5dcb3b510682 Line Numbers Raw Audit Messages node=example.com type=AVC msg=audit(1251025513.42:2388): avc: denied { open } for pid=1631 comm="snmpd" name="fd0" dev=tmpfs ino=6110 scontext=system_u:system_r:snmpd_t:s0 tcontext=system_u:object_r:removable_device_t:s0 tclass=blk_file node=example.com type=SYSCALL msg=audit(1251025513.42:2388): arch=40000003 syscall=5 success=yes exit=13 a0=bf9e7b2c a1=8800 a2=0 a3=30 items=0 ppid=1 pid=1631 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="snmpd" exe="/usr/sbin/snmpd" subj=system_u:system_r:snmpd_t:s0 key=(null)