Bug 584870
Summary: | SELinux is preventing /bin/ln "link" access on slapd.pid. | ||
---|---|---|---|
Product: | Red Hat Enterprise Linux 6 | Reporter: | Matěj Cepl <mcepl> |
Component: | openldap | Assignee: | Jan Zeleny <jzeleny> |
Status: | CLOSED CURRENTRELEASE | QA Contact: | Ondrej Moriš <omoris> |
Severity: | medium | Docs Contact: | |
Priority: | high | ||
Version: | 6.0 | CC: | dwalsh, jplans, omoris |
Target Milestone: | rc | ||
Target Release: | --- | ||
Hardware: | x86_64 | ||
OS: | Linux | ||
Whiteboard: | setroubleshoot_trace_hash:0e15968cc8cfb94f5278d9554e680963a3339935edf31d2902f3dc31ea7c3bf7 | ||
Fixed In Version: | openldap-2.4.19-10.el6 | Doc Type: | Bug Fix |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2010-07-02 19:39:21 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: |
Description
Matěj Cepl
2010-04-22 15:40:37 UTC
Is there really any reason to have a hard link to a pid file in the init script? Can't we just make the pidfile /var/run/openldap/slapd.pid and get rid of all the linking stuff? This request was evaluated by Red Hat Product Management for inclusion in a Red Hat Enterprise Linux major release. Product Management has requested further review of this request by Red Hat Engineering, for potential inclusion in a Red Hat Enterprise Linux Major release. This request is not yet committed for inclusion. Keeping /var/run/openldap/slapd.pid would be my first choice as well. It is indeed better from the view of both SELinux and openldap (because it has rw access rights to /var/run/openldap/). This whole think came from QA/PM goal of making all init scripts and demons LSB compliant and their behavior similar. Can you recommend any way how to make /var/run/slapd.pid, which would be ok for SELinux? Well making it a softlink would probably stop SELinux from complaining and probably closer to what you want anyways. LSB has a say on where pid files are stored? Why would it care... The real problem for SELinux is just complaining about the hard link. Thanks for the advice, I'll try to make it a soft link. LSB doesn't say specifically that it wants pid file directly in /var/run, but there are some references to it in Fedora Packaging guidelines and according to QA, it is convenient to have all pid files uniformly placed. I see no AVC running slapd via initscript on openldap-servers-2.4.19-11.el6 / RHEL6.0-20100527.2. But openldap-servers-2.4.19-9.el6 produce not AVC as well. I've manually verified that hard link is now replaced by sym link in initscript. Considering bug-fix to be successfully verified. Red Hat Enterprise Linux Beta 2 is now available and should resolve the problem described in this bug report. This report is therefore being closed with a resolution of CURRENTRELEASE. You may reopen this bug report if the solution does not work for you. |