Bug 556919
| Summary: | selinux prevents afs access to /etc/resolv.conf | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Jack Neely <jjneely> | ||||||
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> | ||||||
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||||
| Severity: | medium | Docs Contact: | |||||||
| Priority: | low | ||||||||
| Version: | 12 | CC: | dan, dwalsh, mgrepl | ||||||
| Target Milestone: | --- | ||||||||
| Target Release: | --- | ||||||||
| Hardware: | All | ||||||||
| OS: | Linux | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | 3.6.32-78.fc12 | Doc Type: | Bug Fix | ||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2010-02-02 01:22:02 UTC | Type: | --- | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Attachments: |
|
||||||||
could you attach the output of nm -D /usr/sbin/afsd I am looking to see if it calls getpw* or other functions. Created attachment 385507 [details]
nm -D /usr/sbin/afsd > /tmp/nm.out
I didn't see getpw functions. Attached as requested.
Created attachment 385538 [details]
afs patch to add resolving and a couple of other access
Miroslav, please add to F12 policy.
Fixed in selinux-policy-3.6.32-74.fc12.noarch selinux-policy-3.6.32-78.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-78.fc12 I can confirm this corrects the above issues with OpenAFS. Thanks! Jack, thank you for testing. Could you click the following link and update the karma please. http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-78.fc12 selinux-policy-3.6.32-78.fc12 has been pushed to the Fedora 12 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2010-1207 *** Bug 560088 has been marked as a duplicate of this bug. *** selinux-policy-3.6.32-78.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report. |
Description of problem: I'm packaging OpenAFS for RPMFusion and the current packages can be found in their rpmfusion-updates-testing repo. On Fedora 12 I'm getting avc denied access for the afsd daemon to resolv.conf which prevents OpenAFS from locating AFS cells (Using dynroot). SELinux: initialized (dev afs, type afs), uses genfs_contexts type=1400 audit(1263930484.895:21052): avc: denied { read } for pid=1544 comm="afsd" name="resolv.conf" dev=dm-0 ino=245 scontext=unconfined_u:system_r:afs_t:s0 tcontext=system_u:object_r:net_conf_t:s0 tclass=file type=1400 audit(1263930484.896:21053): avc: denied { read } for pid=1544 comm="afsd" name="resolv.conf" dev=dm-0 ino=245 scontext=unconfined_u:system_r:afs_t:s0 tcontext=system_u:object_r:net_conf_t:s0 tclass=file Version-Release number of selected component (if applicable): # rpm -qa selinux-\* selinux-policy-targeted-3.6.32-69.fc12.noarch selinux-policy-3.6.32-69.fc12.noarch