| Summary: | allow unconfined_t unlabeled_t:rawip_socket { read write }; | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Jaroslav Kortus <jkortus> |
| Component: | kernel | Assignee: | Red Hat Kernel Manager <kernel-mgr> |
| Status: | CLOSED DUPLICATE | QA Contact: | Red Hat Kernel QE team <kernel-qe> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 6.0 | CC: | dwalsh, eparis, jmorris, nstraz, sdsmall |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-02-16 21:59:46 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
Our test uses sctp sockets to distribute the load. This is a kernel issue, we should not be seeing unlabeled_t rawip_sockets. Lack of SELinux SCTP support is bug 517676. *** This bug has been marked as a duplicate of bug 517676 *** |
Description of problem: During our cluster test one of the tool registers via rpc and distributes workload to member nodes. In RHEL6 this is denied by selinux. Version-Release number of selected component (if applicable): selinux-policy-3.7.19-54.el6.noarch How reproducible: via cluster dd_io test Steps to Reproduce: 1. run dd_io test from rhel6 driver 2. 3. Actual results: time->Tue Feb 15 04:57:47 2011 type=SYSCALL msg=audit(1297767467.791:15310): arch=c000003e syscall=45 success=no exit=-13 a0=a a1=7fff4a0ce9d0 a2=1770 a3=0 items=0 ppid=14391 pid=14397 auid=14025 uid=14025 gid=14025 euid=14025 suid=14025 fsuid=14025 egid=14025 sgid=14025 fsgid=14025 tty=pts1 ses=2502 comm="d_iogen" exe="/tmp/sts-jk-6/bin/d_iogen" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1297767467.791:15310): avc: denied { read } for pid=14397 comm="d_iogen" laddr=10.15.89.97 lport=34181 faddr=10.15.89.75 fport=44523 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s0 tclass=rawip_socket Expected results: no denial for unconfined_t Additional info: