Bug 658849

Summary:	Please change fail2ban to not use gam_server
Product:	[Fedora] Fedora	Reporter:	Daniel Walsh <dwalsh>
Component:	fail2ban	Assignee:	Axel Thimm <axel.thimm>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	low
Version:	rawhide	CC:	axel.thimm, herrold, jonathan.underwood, mgrepl, txtoth
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	fail2ban-0.8.4-27.fc14	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2011-04-18 04:03:25 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Daniel Walsh 2010-12-01 13:40:09 UTC

At least change it to default to polling.

https://bugzilla.redhat.com/show_bug.cgi?id=656127

In SELinux we are constantly getting birraged with hundreds of bugzillas about fail2ban using gam_server.  gam_server was developed for userspace apps not system services.  SELinux can not allow the access to fail2ban that would be required for gam_server access, so we end up telling everyone who triggers this error to move to a polling situation.

A better solution would be to modify fail2ban to use inotify to watch its config.

Comment 1 Ted X Toth 2011-03-31 17:35:08 UTC

I changed the /etc/fail2ban/jail.conf backend default to 'polling' and the AVCs appear to have stopped. I've only looked around a little but it appears that fail2ban is using the gam_server as an interface to inotify to watch files (more than just it's config) when it could use it directly. Maybe the developer could comment on the use of the gam_server.

Comment 2 Fedora Update System 2011-04-09 19:07:21 UTC

fail2ban-0.8.4-27.fc14 has been submitted as an update for Fedora 14.
https://admin.fedoraproject.org/updates/fail2ban-0.8.4-27.fc14

Comment 3 Fedora Update System 2011-04-09 19:07:53 UTC

fail2ban-0.8.4-27.fc13 has been submitted as an update for Fedora 13.
https://admin.fedoraproject.org/updates/fail2ban-0.8.4-27.fc13

Comment 4 Fedora Update System 2011-04-09 19:08:26 UTC

fail2ban-0.8.4-27.fc15 has been submitted as an update for Fedora 15.
https://admin.fedoraproject.org/updates/fail2ban-0.8.4-27.fc15

Comment 5 Fedora Update System 2011-04-10 01:44:10 UTC

Package fail2ban-0.8.4-27.fc15:
* should fix your issue,
* was pushed to the Fedora 15 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing fail2ban-0.8.4-27.fc15'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/fail2ban-0.8.4-27.fc15
then log in and leave karma (feedback).

Comment 6 Fedora Update System 2011-04-18 04:02:53 UTC

fail2ban-0.8.4-27.fc15 has been pushed to the Fedora 15 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2011-04-25 20:50:37 UTC

fail2ban-0.8.4-27.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2011-04-25 20:55:18 UTC

fail2ban-0.8.4-27.fc14 has been pushed to the Fedora 14 stable repository.  If problems still persist, please make note of it in this bug report.