Bug 553454

Summary: SELinux is preventing /usr/sbin/aiccu "create" access.
Product: [Fedora] Fedora Reporter: Tomasz Torcz <tomek>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: 12CC: dwalsh, mgrepl
Target Milestone: ---   
Target Release: ---   
Hardware: i386   
OS: Linux   
Whiteboard: setroubleshoot_trace_hash:23bc37c901cd5ed9fbf67a62d2e2b0da26d97c1ce464db1b7026fd292afe0a30
Fixed In Version: 3.6.32-69.fc12 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-01-19 19:41:50 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Tomasz Torcz 2010-01-07 22:24:48 UTC 
Podsumowanie:

SELinux is preventing /usr/sbin/aiccu "create" access.

aiccu is supposed to crate and configure TUN devices. It is the point of it's existence.

Szczegółowy opis:

SELinux denied access requested by aiccu. It is not expected that this access is
required by aiccu and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.

Zezwalanie na dostęp:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Please file a bug
report.

Dodatkowe informacje:

Kontekst źródłowy          system_u:system_r:initrc_t:s0
Kontekst docelowy             system_u:system_r:initrc_t:s0
Obiekty docelowe              None [ tun_socket ]
Źródło                     aiccu
Ścieżka źródłowa         /usr/sbin/aiccu
Port                          <Nieznane>
Komputer                      (removed)
Źródłowe pakiety RPM       aiccu-2007.01.15-7.fc12
Docelowe pakiety RPM          
Pakiet RPM polityki           selinux-policy-3.6.32-66.fc12
SELinux jest włączony       True
Typ polityki                  targeted
Tryb wymuszania               Enforcing
Nazwa wtyczki                 catchall
Nazwa komputera               (removed)
Platforma                     Linux (removed)
                              2.6.32.3-10.fc12.i686.PAE #1 SMP Thu Jan 7
                              11:00:45 UTC 2010 i686 athlon
Liczba alarmów               1
Po raz pierwszy               czw, 7 sty 2010, 22:56:20
Po raz ostatni                czw, 7 sty 2010, 22:56:20
Lokalny identyfikator         ceee4958-77a3-4281-8643-5ec996413de6
Liczba wierszy                

Surowe komunikaty audytu      

node=(removed) type=AVC msg=audit(1262901380.854:10457): avc:  denied  { create } for  pid=1948 comm="aiccu" scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=tun_socket

node=(removed) type=SYSCALL msg=audit(1262901380.854:10457): arch=40000003 syscall=54 success=no exit=-13 a0=4 a1=400454ca a2=bfc8312c a3=8056ae4 items=0 ppid=1 pid=1948 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="aiccu" exe="/usr/sbin/aiccu" subj=system_u:system_r:initrc_t:s0 key=(null)



Hash String generated from  selinux-policy-3.6.32-66.fc12,catchall,aiccu,initrc_t,initrc_t,tun_socket,create
audit2allow suggests:

#============= initrc_t ==============
allow initrc_t self:tun_socket create;
Comment 1 Daniel Walsh 2010-01-08 15:23:07 UTC 
Miroslav, add

	allow $1 self:socket_class_set create_socket_perms;

To unconfined_domain_noaudit in unconfined.if

In F11, F12 and RHEL5.

I will add a policy for aiccu in F13.

Tomasz

# grep avc /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp
Comment 2 Miroslav Grepl 2010-01-08 15:37:47 UTC 
Fixed in selinux-policy-3.6.32-68.fc12.noarch
Comment 3 Fedora Update System 2010-01-12 23:28:04 UTC 
selinux-policy-3.6.32-69.fc12 has been pushed to the Fedora 12 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update selinux-policy'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2010-0362
Comment 4 Fedora Update System 2010-01-19 19:40:53 UTC 
selinux-policy-3.6.32-69.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.