Bug 614796
| Summary: | openais selinux settings for qpidd | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 5 | Reporter: | ppecka <ppecka> | ||||
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | low | ||||||
| Version: | 5.5 | CC: | aconway, cluster-maint, edamato, jneedle, mgrepl, mmalik, sdake, syeghiay | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | selinux-policy-2.4.6-280.el5 | Doc Type: | Bug Fix | ||||
| Doc Text: |
With SELinux running in the enforcing mode, an attempt to start the qpidd service when the aisexec was already running failed, and the following error message was written to the qpidd.log:
Unexpected error: Timed out waiting for daemon (If store recovery is in progress, use longer wait time)
This was caused by SELinux incorrectly denying qpidd the access to OpenAIS. This update corrects the SELinux policy, resolving this issue.
|
Story Points: | --- | ||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2011-01-13 21:49:57 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
|
Description
ppecka
2010-07-15 09:57:02 UTC
Fixed in selinux-policy-2.4.6-280.el5 You guys will have to add this to your module. An updated qpidd.pp was sent to mcressmean to be included in the RPM. The source qpidd.te was checked in upstream: http://svn.apache.org/viewvc/qpid/trunk/qpid/cpp/etc/selinux/qpidd.te?revision=964551&view=markup&sortby=date The verification was pretty straightforward. qpidd service starts? Things are fine. Doesn't start? Things are broken. Install openais and qpid-cpp-server on a system in Enforcing mode Configure the cluster and add clustery stuff to /etc/qpidd.conf: cluster-mechanism=PLAIN cluster-username=guest cluster-password=guest cluster-name=qpid-test-cluster service openais start service qpidd start If the service starts, everything is likely (check for AVCs anyway). If there is a timeout trying to communicate with openais and AVCs are getting generated, that's a failure. Affects RHEL5 only (RHEL4 does not support cluster, RHEL6 has qpidd policy), and normally we catch this stuff early on in testing since if it's broken, the service doesn't start and AVCs are generated. Milos, what process is running as initrc_t? # ps -eZ | grep initrc Here is the culprit: root:system_r:initrc_t:s0 24456 ? 00:00:00 qpidd From the test machine, which Milos set up: # rpm -qf /usr/share/selinux/packages/qpidd.pp qpidd-0.5.752581-42.el5 So the following http://svn.apache.org/viewvc/qpid/trunk/qpid/cpp/etc/selinux/qpidd.te?revision=964551&view=markup&sortby=date should be added to qpidd.te. I am switching this bug back to Modified since msg=audit(1279183573.736:9822): avc: denied { ipc_owner } for pid=9264 comm="aisexec" capability=15 scontext=root:system_r:aisexec_t:s0 tcontext=root:system_r:aisexec_t:s0 tclass=capability is fixed in the policy.
Technical note added. If any revisions are required, please edit the "Technical Notes" field
accordingly. All revisions will be proofread by the Engineering Content Services team.
New Contents:
With SELinux running in the enforcing mode, an attempt to start the qpidd service when the aisexec was already running failed, and the following error message was written to the qpidd.log:
Unexpected error: Timed out waiting for daemon (If store recovery is in progress, use longer wait time)
This was caused by SELinux incorrectly denying qpidd the access to OpenAIS. This update corrects the SELinux policy, resolving this issue.
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2011-0026.html |