Bug 694985

Summary: SELinux is preventing /usr/bin/perl from 'ioctl' accesses on the file /etc/sysctl.conf.
Product: [Fedora] Fedora Reporter: Robert Hinson <oppiet35>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 14CC: dwalsh, mgrepl
Target Milestone: ---   
Target Release: ---   
Hardware: i386   
OS: Linux   
Whiteboard: setroubleshoot_trace_hash:aacb88c45f164b89d3387e97f7ffd138cc2dff09eda2c21c234da536bafd3ad9
Fixed In Version: selinux-policy-3.9.7-40.fc14 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-04-25 00:00:16 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Robert Hinson 2011-04-09 13:21:33 UTC
SELinux is preventing /usr/bin/perl from 'ioctl' accesses on the file /etc/sysctl.conf.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that perl should be allowed ioctl access on the sysctl.conf file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep perl /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:logwatch_t:s0-s0:c0.c1023
Target Context                system_u:object_r:system_conf_t:s0
Target Objects                /etc/sysctl.conf [ file ]
Source                        perl
Source Path                   /usr/bin/perl
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           perl-5.12.3-142.fc14
Target RPM Packages           initscripts-9.20.2-1.fc14.1
Policy RPM                    selinux-policy-3.9.7-37.fc14
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     (removed)
Platform                      Linux (removed)
                              2.6.35.11-83.fc14.i686 #1 SMP Mon Feb 7 07:04:18
                              UTC 2011 i686 i686
Alert Count                   7
First Seen                    Sat 26 Mar 2011 03:12:12 AM CDT
Last Seen                     Sat 09 Apr 2011 07:40:24 AM CDT
Local ID                      b44c61fe-adbd-44b2-bb9c-aab20eeb272a

Raw Audit Messages
type=AVC msg=audit(1302352824.572:54): avc:  denied  { ioctl } for  pid=3311 comm="perl" path="/etc/sysctl.conf" dev=dm-0 ino=19996 scontext=system_u:system_r:logwatch_t:s0-s0:c0.c1023 tcontext=system_u:object_r:system_conf_t:s0 tclass=file


type=SYSCALL msg=audit(1302352824.572:54): arch=i386 syscall=ioctl success=no exit=ENOTTY a0=3 a1=5401 a2=bfb9f998 a3=bfb9f9d8 items=0 ppid=2966 pid=3311 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4 comm=perl exe=/usr/bin/perl subj=system_u:system_r:logwatch_t:s0-s0:c0.c1023 key=(null)

Hash: perl,logwatch_t,system_conf_t,file,ioctl

audit2allow

#============= logwatch_t ==============
allow logwatch_t system_conf_t:file ioctl;

audit2allow -R

#============= logwatch_t ==============
allow logwatch_t system_conf_t:file ioctl;

Comment 1 Miroslav Grepl 2011-04-11 06:15:52 UTC
Fixed in selinux-policy-3.9.7-39.fc14

Comment 2 Fedora Update System 2011-04-21 14:50:21 UTC
selinux-policy-3.9.7-40.fc14 has been submitted as an update for Fedora 14.
https://admin.fedoraproject.org/updates/selinux-policy-3.9.7-40.fc14

Comment 3 Fedora Update System 2011-04-21 22:25:55 UTC
Package selinux-policy-3.9.7-40.fc14:
* should fix your issue,
* was pushed to the Fedora 14 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.9.7-40.fc14'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/selinux-policy-3.9.7-40.fc14
then log in and leave karma (feedback).

Comment 4 Fedora Update System 2011-04-24 23:59:07 UTC
selinux-policy-3.9.7-40.fc14 has been pushed to the Fedora 14 stable repository.  If problems still persist, please make note of it in this bug report.