Bug 559218
| Summary: | SELinux is preventing /bin/bash "execute" access on /sbin/iptables-multi. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | paul <paullee0> |
| Component: | selinux-policy | Assignee: | Daniel Walsh <dwalsh> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | 12 | CC: | bugzilla.redhat, dwalsh, maurizio.antillon, mgrepl |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | i386 | ||
| OS: | Linux | ||
| Whiteboard: | setroubleshoot_trace_hash:5fa7abf57f3010dd989f9672792cf86acec2858280393a3da1cf7035de4e3e67 | ||
| Fixed In Version: | selinux-policy-3.6.32-120.fc12 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2010-08-20 01:45:25 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
paul
2010-01-27 13:36:42 UTC
Do you have dhcpc_t changing iptables on your machine? *** Bug 559220 has been marked as a duplicate of this bug. *** *** Bug 560328 has been marked as a duplicate of this bug. *** *** Bug 562337 has been marked as a duplicate of this bug. *** *** Bug 565434 has been marked as a duplicate of this bug. *** Referring to bug 562338 generate in same occasion:- ... ... paul 2010-02-10 07:48:14 EST I should have written a script /etc/dhcp/dhclient-eth1-up-hooks which should run whenever dhclient update the ip. This in turn run a script that contain iptables command to setup my firewall, extracts:- $IPTABLES -A INPUT -p udp -d $EXTIP --dport 4500 -j ACCEPT $IPTABLES -A INPUT -p 50 -d $EXTIP -j ACCEPT $IPTABLES -A INPUT -p 51 -d $EXTIP -j ACCEPT ... ... Daniel Walsh 2010-02-10 11:14:33 EST Does everything work other then generating this AVC message? ... ... paul 2010-07-17 23:47:46 EDT No. Iptables command was denied... e.g. ... /etc/rc.firewall-iptables-stronger_P226g_f13: line 49: /sbin/iptables: Permission denied /etc/rc.firewall-iptables-stronger_P226g_f13: line 50: /sbin/iptables: Permission denied /etc/rc.firewall-iptables-stronger_P226g_f13: line 52: /sbin/iptables: Permission denied /etc/rc.firewall-iptables-stronger_P226g_f13: line 54: /sbin/iptables: Permission denied Paul add this custom policy to allow your access. # cat > mydovecot.te << _EOF policy_module(mydhcpc,1.0) gen_require(` type dhcpc_t; ') iptables_domtrans(dhcpc_t) _EOF # make -f /usr/share/selinux/devel/Makefile # semodule -i mydhcpc.pp Miroslav, This seems to be fairly common, what do you think about adding a boolean, dhcpc_run_iptables? > Miroslav, This seems to be fairly common Yes, it looks so. >, what do you think about adding a > boolean, dhcpc_run_iptables? Sounds good add this option for users. Fixed in selinux-policy-3.6.32-120.fc12 selinux-policy-3.6.32-120.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-120.fc12 selinux-policy-3.6.32-120.fc12 has been pushed to the Fedora 12 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-120.fc12 selinux-policy-3.6.32-120.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report. This is still a problem in Fedora 15 The problem is with a different file, dhclient-script denied getattr on systemctl and bash denied getattr on systemctl. Please open a new bug. Done, thanks! Matt |