Bug 597309

Summary: SELinux is preventing /usr/sbin/hald "name_bind" access .
Product: [Fedora] Fedora Reporter: Jonathan Abbey <jonabbey>
Component: selinux-policyAssignee: Daniel Walsh <dwalsh>
Status: CLOSED NOTABUG QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: 13CC: dwalsh, mgrepl
Target Milestone: ---   
Target Release: ---   
Hardware: i386   
OS: Linux   
Whiteboard: setroubleshoot_trace_hash:497c93937187a15cb964f2096bc717aacf59f80f9d65565b8e6f07e424658d5e
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-06-01 14:46:52 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Jonathan Abbey 2010-05-28 15:58:24 UTC

SELinux is preventing /usr/sbin/hald "name_bind" access .

Detailed Description:

SELinux denied access requested by hald. It is not expected that this access is
required by hald and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug

Additional Information:

Source Context                system_u:system_r:hald_t:s0
Target Context                system_u:object_r:rndc_port_t:s0
Target Objects                None [ tcp_socket ]
Source                        hald
Source Path                   /usr/sbin/hald
Port                          953
Host                          (removed)
Source RPM Packages           hal-0.5.14-3.fc13
Target RPM Packages           
Policy RPM                    selinux-policy-3.7.19-15.fc13
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     (removed)
Platform                      Linux (removed)
                     #1 SMP Thu May 13
                              05:38:26 UTC 2010 i686 i686
Alert Count                   1
First Seen                    Fri 28 May 2010 10:34:13 AM CDT
Last Seen                     Fri 28 May 2010 10:34:13 AM CDT
Local ID                      245c058a-3270-4634-bdf9-cfd578eb6156
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1275060853.879:12): avc:  denied  { name_bind } for  pid=1201 comm="hald" src=953 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:rndc_port_t:s0 tclass=tcp_socket

node=(removed) type=SYSCALL msg=audit(1275060853.879:12): arch=40000003 syscall=102 success=no exit=-13 a0=2 a1=bf882508 a2=9c8ff4 a3=bf88251c items=0 ppid=1200 pid=1201 auid=4294967295 uid=68 gid=482 euid=68 suid=68 fsuid=68 egid=482 sgid=482 fsgid=482 tty=(none) ses=4294967295 comm="hald" exe="/usr/sbin/hald" subj=system_u:system_r:hald_t:s0 key=(null)

Hash String generated from  catchall,hald,hald_t,rndc_port_t,tcp_socket,name_bind
audit2allow suggests:

#============= hald_t ==============
allow hald_t rndc_port_t:tcp_socket name_bind;

Comment 1 Daniel Walsh 2010-05-28 16:04:13 UTC
Why is hal trying to bind to port 953?  Are you running in an NIS environment?

Comment 2 Jonathan Abbey 2010-05-28 16:38:14 UTC
I am, yes.

Comment 3 Jonathan Abbey 2010-05-28 16:40:21 UTC
I'm afraid I possibly reported this SEAlert before turning on allow_ypbind?

For some reason, the Fedora 13 installer does not toggle allow_ypbind on, even though I told the firstboot configurator that I wanted to use NIS authentication.. ;-(

I've got a separate bug filed on that one.

Comment 4 Daniel Walsh 2010-06-01 14:46:52 UTC
# setsebool -P allow_ypbind 1