Bug 562523

Summary:	SElinux prevents start of shorewall6
Product:	[Fedora] Fedora	Reporter:	Felix Schwarz <fschwarz>
Component:	selinux-policy	Assignee:	Miroslav Grepl <mgrepl>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	low
Version:	12	CC:	dwalsh, jonathan.underwood, mgrepl, paul
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	selinux-policy-3.6.32-89.fc12	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-02-20 00:21:56 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Felix Schwarz 2010-02-07 08:36:17 UTC

Description of problem:
If SElinux is in enforcing mode, you can not start shorewall6 because it needs to execute '/usr/share/shorewall/compiler.pl'. In syslog I see this error message: "ERROR: Shorewall6 requires the shorewall package which is not installed"

audit2allow < /var/log/audit/audit.log 
#============= shorewall_t ==============
allow shorewall_t usr_t:file execute;

Version-Release number of selected component (if applicable):
shorewall-4.4.4.2-3.fc12.noarch
shorewall6-lite-4.4.4.2-3.fc12.noarch
shorewall6-4.4.4.2-3.fc12.noarch

Steps to Reproduce:
1. Set SElinux to enforcing
2. configure shorewall6
3. service shorewall start

Comment 1 Paul Howarth 2010-02-07 10:12:10 UTC

Labelling /usr/share/shorewall/compiler.pl as bin_t would probably fix this.

Perhaps a better place for this script would be /usr/libexec/shorewall ?

Comment 2 Jonathan Underwood 2010-02-07 13:11:38 UTC

Have reassigned bug to selinux, although Paul's suggestion of moving the compiler to /usr/libexec/shorewall has merit as well. Dan - thoughts?

Comment 3 Daniel Walsh 2010-02-08 20:00:24 UTC

It is fine where it is but now we have labeling of

/usr/share/shorewall/compiler\.pl	--	gen_context(system_u:object_r:bin_t,s0)
/usr/share/shorewall/configpath	--	gen_context(system_u:object_r:bin_t,s0)
/usr/share/shorewall-perl(/.*)?		gen_context(system_u:object_r:bin_t,s0)
/usr/share/shorewall-shell(/.*)?	gen_context(system_u:object_r:bin_t,s0)
/usr/share/shorewall-lite(/.*)? 	gen_context(system_u:object_r:bin_t,s0)
/usr/share/shorewall6-lite(/.*)?	gen_context(system_u:object_r:bin_t,s0)

I would prefer to you create a /usr/share/shorewall/scripts or bin and put the scripts as subdirs of this.

Then I could just label everything bin_t and you can add new executables without having to worry about selinux labeling.


Miroslav add


/usr/share/shorewall/compiler\.pl	--	gen_context(system_u:object_r:bin_t,s0)

Comment 4 Miroslav Grepl 2010-02-09 11:36:13 UTC

Fixed in selinux-policy-3.6.32-86.fc12

Comment 5 Fedora Update System 2010-02-11 22:01:38 UTC

selinux-policy-3.6.32-89.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-89.fc12

Comment 6 Fedora Update System 2010-02-13 00:40:48 UTC

selinux-policy-3.6.32-89.fc12 has been pushed to the Fedora 12 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update selinux-policy'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2010-1836

Comment 7 Fedora Update System 2010-02-20 00:19:51 UTC

selinux-policy-3.6.32-89.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.