Bug 689960

Summary:	openswan debugging facility which allows coredumps in case of problems is broken by selinux policy dontaudit
Product:	Red Hat Enterprise Linux 5	Reporter:	Tuomo Soini <tis>
Component:	selinux-policy	Assignee:	Miroslav Grepl <mgrepl>
Status:	CLOSED ERRATA	QA Contact:	Milos Malik <mmalik>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	5.6	CC:	dwalsh, mmalik, pwouters
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	selinux-policy-2.4.6-304.el5	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:	689953	Environment:
Last Closed:	2011-07-21 09:19:53 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Tuomo Soini 2011-03-22 21:17:25 UTC

+++ This bug was initially created as a clone of Bug #689953 +++

Description of problem:

openswan has facility to enable coredumps by adding config variable dumpdir= in config setup section. Selinux prevents this but doesn't give AVC denial about the issue.

How reproducible:

Always

avc generated with semodule -DB

type=AVC msg=audit(1300825551.591:24204): avc:  denied  { rlimitinh } for  pid=31204 comm="sh" scontext=user_u:system_r:ipsec_t:s0 tcontext=user_u:system_r:ipsec_mgmt_t:s0 tclass=process

This need to be allowed so that openswan startup can enable coredumps.

--- Additional comment from dwalsh on 2011-03-22 16:52:43 EDT ---

We should allow this.

Comment 1 Tuomo Soini 2011-03-22 21:57:37 UTC

# startup scripts of pluto need to be able to set ulimit -c unlimited
allow ipsec_t ipsec_mgmt_t:process rlimitinh;

Comment 2 Miroslav Grepl 2011-03-29 08:17:59 UTC

I will add it.

Comment 4 Miroslav Grepl 2011-04-05 14:38:28 UTC

Fixed in selinux-policy-2.4.6-304.el5

Comment 7 errata-xmlrpc 2011-07-21 09:19:53 UTC

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-1069.html

Comment 8 errata-xmlrpc 2011-07-21 11:56:12 UTC

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-1069.html