| Summary: | SELinux prevented local from using NIS (yp). | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Dave Russell <drussell> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED INSUFFICIENT_DATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 13 | CC: | dwalsh, mgrepl, nstrug |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | setroubleshoot_trace_hash:7b522321774d622f8dec13753803afebbbda0f28ae29f619cd0f9dec03615c9b | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-05-09 17:46:32 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
Did you try to turn on the 'allow_ypbind' boolean? |
Summary: SELinux prevented local from using NIS (yp). Detailed Description: [SELinux is in permissive mode. This access was not denied.] SELinux prevented local from using NIS (yp) for authentication. If you have configured the system to use NIS this access is expected but is not currently allowed by SELinux. Otherwise this access may signal an intrusion. Allowing Access: Changing the "allow_ypbind" boolean to true will allow this access: "setsebool -P allow_ypbind=1." Fix Command: setsebool -P allow_ypbind=1 Additional Information: Source Context system_u:system_r:postfix_local_t:s0 Target Context system_u:object_r:var_yp_t:s0 Target Objects /var/yp [ dir ] Source local Source Path /usr/libexec/postfix/local Port <Unknown> Host (removed) Source RPM Packages postfix-2.7.0-1.fc13 Target RPM Packages filesystem-2.4.31-1.fc13 Policy RPM selinux-policy-3.7.19-54.fc13 Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Plugin Name allow_ypbind Host Name (removed) Platform Linux (removed) 2.6.34.6-54.fc13.x86_64 #1 SMP Sun Sep 5 17:16:27 UTC 2010 x86_64 x86_64 Alert Count 92 First Seen Tue 14 Sep 2010 12:26:57 PM BST Last Seen Wed 15 Sep 2010 07:54:38 AM BST Local ID 5b4c68f9-3f34-4ca5-b4d5-9765ceefbb2a Line Numbers Raw Audit Messages node=(removed) type=AVC msg=audit(1284533678.96:34531): avc: denied { search } for pid=24245 comm="local" name="yp" dev=dm-1 ino=3015925 scontext=system_u:system_r:postfix_local_t:s0 tcontext=system_u:object_r:var_yp_t:s0 tclass=dir node=(removed) type=SYSCALL msg=audit(1284533678.96:34531): arch=c000003e syscall=2 success=no exit=-2 a0=7fff5661e730 a1=0 a2=7fff5661e74a a3=7fff5661e4b0 items=0 ppid=1692 pid=24245 auid=4294967295 uid=0 gid=0 euid=89 suid=0 fsuid=89 egid=89 sgid=0 fsgid=89 tty=(none) ses=4294967295 comm="local" exe="/usr/libexec/postfix/local" subj=system_u:system_r:postfix_local_t:s0 key=(null) Hash String generated from allow_ypbind,local,postfix_local_t,var_yp_t,dir,search audit2allow suggests: #============= postfix_local_t ============== #!!!! This avc can be allowed using the boolean 'allow_ypbind' allow postfix_local_t var_yp_t:dir search;