Bug 544855
| Summary: | SELinux prevented kerneloops from using NIS (yp). | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Eugene Kanter <ekanter> |
| Component: | selinux-policy | Assignee: | Daniel Walsh <dwalsh> |
| Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | 12 | CC: | dwalsh, mgrepl |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | i386 | ||
| OS: | Linux | ||
| Whiteboard: | setroubleshoot_trace_hash:ea2612c7285bfc8a9cb1503f45c8779a317297f9556fb85f67187141ced5d9ce | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2009-12-07 09:45:00 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
*** This bug has been marked as a duplicate of bug 538428 *** |
Summary: SELinux prevented kerneloops from using NIS (yp). Detailed Description: SELinux prevented kerneloops from using NIS (yp) for authentication. If you have configured the system to use NIS this access is expected but is not currently allowed by SELinux. Otherwise this access may signal an intrusion. Allowing Access: Changing the "allow_ypbind" boolean to true will allow this access: "setsebool -P allow_ypbind=1." Fix Command: setsebool -P allow_ypbind=1 Additional Information: Source Context system_u:system_r:kerneloops_t:s0 Target Context system_u:object_r:var_yp_t:s0 Target Objects ./yp [ dir ] Source kerneloops Source Path /usr/sbin/kerneloops Port <Unknown> Host (removed) Source RPM Packages kerneloops-0.11-1.fc9 Target RPM Packages Policy RPM selinux-policy-3.3.1-84.fc9 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name allow_ypbind Host Name (removed) Platform Linux (removed) 2.6.25.14-108.fc9.i686 #1 SMP Mon Aug 4 14:08:11 EDT 2008 i686 athlon Alert Count 2 First Seen Wed 10 Sep 2008 10:36:27 PM EDT Last Seen Wed 10 Sep 2008 10:36:27 PM EDT Local ID 3a244eb2-7813-4c1c-8415-509928131b56 Line Numbers Raw Audit Messages node=(removed) type=AVC msg=audit(1221100587.907:60): avc: denied { search } for pid=2271 comm="kerneloops" name="yp" dev=dm-0 ino=856818 scontext=system_u:system_r:kerneloops_t:s0 tcontext=system_u:object_r:var_yp_t:s0 tclass=dir node=(removed) type=SYSCALL msg=audit(1221100587.907:60): arch=40000003 syscall=5 success=no exit=-13 a0=bfaac0e0 a1=0 a2=9a8ae4 a3=bfaac0e0 items=0 ppid=1 pid=2271 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="kerneloops" exe="/usr/sbin/kerneloops" subj=system_u:system_r:kerneloops_t:s0 key=(null) Hash String generated from selinux-policy-3.3.1-84.fc9,allow_ypbind,kerneloops,kerneloops_t,var_yp_t,dir,search audit2allow suggests: #============= kerneloops_t ============== allow kerneloops_t var_yp_t:dir search;