| Summary: | puppetmasterd needs name_bind and node_bind | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Milos Jakubicek <xjakub> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 14 | CC: | dwalsh, mgrepl, ssnodgra, vanmeeuwen+fedora |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-3.9.7-46.fc14 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-10-30 00:33:50 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
CC'ing puppet maintainer This looks like puppetmasterd is picking out random udp ports to listen on? Any idea what it is doing? Does puppetmasterd resolve user passwd entries? This isn't the only problem with selinux and the puppet master, though it is one of them. For the record, I use the following add-on module to make puppet 2.6.8 work right on RHEL6 with selinux-policy-3.7.19-93 (which includes puppet module 1.0.0).
# Fix selinux policy problems that interfere with the puppetmaster as of
# selinux policy version 3.7.19-93
module puppetfix 1.1;
require {
type sysfs_t;
type puppetmaster_t;
type puppet_etc_t;
type puppet_var_lib_t;
type passwd_exec_t;
type node_t;
type port_t;
class dir search;
class file { relabelfrom relabelto getattr execute };
class udp_socket { name_bind node_bind };
}
#============= puppetmaster_t ==============
# Needed for normal operation
allow puppetmaster_t passwd_exec_t:file { getattr execute };
allow puppetmaster_t puppet_etc_t:file { relabelfrom relabelto };
allow puppetmaster_t puppet_var_lib_t:file { relabelfrom relabelto };
allow puppetmaster_t sysfs_t:dir search;
# Needed for receiving certificate signing requests from agents
allow puppetmaster_t node_t:udp_socket node_bind;
allow puppetmaster_t port_t:udp_socket name_bind;
We have fixes in F15, F16 which I need to backport. Fixed in selinux-policy-3.9.7-46.fc14 selinux-policy-3.9.7-46.fc14 has been submitted as an update for Fedora 14. https://admin.fedoraproject.org/updates/selinux-policy-3.9.7-46.fc14 Package selinux-policy-3.9.7-46.fc14: * should fix your issue, * was pushed to the Fedora 14 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.9.7-46.fc14' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2011-14734 then log in and leave karma (feedback). selinux-policy-3.9.7-46.fc14 has been pushed to the Fedora 14 stable repository. If problems still persist, please make note of it in this bug report. |
Description of problem: Adding a puppet node by running "puppetd --server <puppetmaster> --waitforcert 60 --test" on the client side results into: type=AVC msg=audit(1301648392.239:15466): avc: denied { read } for pid=5732 comm="python" name="pyconfig-64.h" dev=dm-2 ino=1706329 scontext=system_u:system_r:nrpe_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file type=AVC msg=audit(1301648395.006:15467): avc: denied { node_bind } for pid=2788 comm="puppetmasterd" src=51293 scontext=unconfined_u:system_r:puppetmaster_t:s0 tcontext=system_u:object_r:node_t:s0 tclass=udp_socket type=AVC msg=audit(1301648443.036:15468): avc: denied { name_bind } for pid=2788 comm="puppetmasterd" src=64287 scontext=unconfined_u:system_r:puppetmaster_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=udp_socket type=AVC msg=audit(1301648447.338:15469): avc: denied { read } for pid=5758 comm="python" name="pyconfig-64.h" dev=dm-2 ino=1706329 scontext=system_u:system_r:nrpe_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file type=AVC msg=audit(1301648455.725:15470): avc: denied { node_bind } for pid=2788 comm="puppetmasterd" src=57914 scontext=unconfined_u:system_r:puppetmaster_t:s0 tcontext=system_u:object_r:node_t:s0 tclass=udp_socket type=AVC msg=audit(1301648503.675:15477): avc: denied { name_bind } for pid=2788 comm="puppetmasterd" src=4724 scontext=unconfined_u:system_r:puppetmaster_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=udp_socket type=AVC msg=audit(1301648516.503:15478): avc: denied { name_bind } for pid=2788 comm="puppetmasterd" src=26296 scontext=unconfined_u:system_r:puppetmaster_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=udp_socket type=AVC msg=audit(1301648564.313:15479): avc: denied { name_bind } for pid=2788 comm="puppetmasterd" src=21356 scontext=unconfined_u:system_r:puppetmaster_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=udp_socket type=AVC msg=audit(1301648577.258:15480): avc: denied { name_bind } for pid=2788 comm="puppetmasterd" src=9240 scontext=unconfined_u:system_r:puppetmaster_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=udp_socket type=AVC msg=audit(1301648625.151:15481): avc: denied { node_bind } for pid=2788 comm="puppetmasterd" src=45857 scontext=unconfined_u:system_r:puppetmaster_t:s0 tcontext=system_u:object_r:node_t:s0 tclass=udp_socket Version-Release number of selected component (if applicable): selinux-policy-3.9.7-37.fc14.noarch