Bug 583538
| Summary: | psad has a few issues - I attached a selinux policy which may help | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | bodhi.zazen <bodhi.zazen> | ||||
| Component: | psad | Assignee: | Peter Vrabec <pvrabec> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | low | ||||||
| Version: | 13 | CC: | antillon.maurizio, bodhi.zazen, pvrabec | ||||
| Target Milestone: | --- | ||||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | psad-2.1.7-1.fc14 | Doc Type: | Bug Fix | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2011-01-05 21:20:22 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
psad-2.1.7-1.fc13 has been submitted as an update for Fedora 13. https://admin.fedoraproject.org/updates/psad-2.1.7-1.fc13 psad-2.1.7-1.fc14 has been submitted as an update for Fedora 14. https://admin.fedoraproject.org/updates/psad-2.1.7-1.fc14 psad-2.1.7-1.fc14 has been pushed to the Fedora 14 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update psad'. You can provide feedback for this update here: https://admin.fedoraproject.org/updates/psad-2.1.7-1.fc14 psad-2.1.7-1.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report. psad-2.1.7-1.fc14 has been pushed to the Fedora 14 stable repository. If problems still persist, please make note of it in this bug report. |
Created attachment 407475 [details] ids.te = my selinux policy Description of problem: Two problems I found with psad : 1. The selinux policy does not allow psad to start or function properly if (targeted) selinux is enforced. 2. The init script does not function properly. Version-Release number of selected component (if applicable): psad version 2.1.3 release 3.fc12 How reproducible: Always. Steps to Reproduce: 1. Install psad. 2. With selinux, targeted policy, in enforcing mode try to start psad. Actual results: psad fails to start Expected results: psad starts and is fully functional. Additional info: Watch out for some of the additional features such as: 1. from the psad config file "TCPWRAPPERS_BLOCK_METHOD Y;" with this option psad needs access to /etc/hosts.deny ;) 2. psad --sig-update Here is my policy for psad ( see attachment ids.te ) 3. After adding that policy checkmodule -M -m -o ids.mod ids.te semodule_package -o ids.pp -m ids.mod semodule -i ids.pp psad will start from the command line and functions properly with selinux in enforcing mode. 4. However, starting psad via a service continue to fail. No SELinux alerts or entries in the logs ( /var/log/audit/audit.log is empty). service psad start => continues to fail If selinux is put into permissive mode service psad start => works. If one then installs psad from teh psad tar ball (via install.pl) , psad then works normally, including as a service service psad starts - with selinux in enforcing HTH