| Summary: | selinux blocking dhclient | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Matt <bugzilla.redhat> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | low | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 15 | CC: | dwalsh, mgrepl |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | noarch | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-3.9.16-18.fc15 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-05-02 03:38:58 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
Fixed in selinux-policy-3.9.16-17.fc15 *** Bug 699471 has been marked as a duplicate of this bug. *** selinux-policy-3.9.16-18.fc15 has been submitted as an update for Fedora 15. https://admin.fedoraproject.org/updates/selinux-policy-3.9.16-18.fc15 Package selinux-policy-3.9.16-18.fc15: * should fix your issue, * was pushed to the Fedora 15 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.9.16-18.fc15' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/selinux-policy-3.9.16-18.fc15 then log in and leave karma (feedback). selinux-policy-3.9.16-18.fc15 has been pushed to the Fedora 15 stable repository. If problems still persist, please make note of it in this bug report. Thanks for the fast work. The new patches are installed on all servers and I have seen no further errors. |
SELinux is preventing dhclient-script from getattr access on the file /bin/systemctl. ***** Plugin catchall (100. confidence) suggests *************************** If you believe that dhclient-script should be allowed getattr access on the systemctl file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep dhclient-script /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:dhcpc_t:s0 Target Context system_u:object_r:systemd_systemctl_exec_t:s0 Target Objects /bin/systemctl [ file ] Source dhclient-script Source Path dhclient-script Port <Unknown> Host kimba.campbell.littlelionstudios.com Source RPM Packages Target RPM Packages systemd-units-24-1.fc15 Policy RPM selinux-policy-3.9.16-15.fc15 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name kimba.campbell.littlelionstudios.com Platform Linux kimba.campbell.littlelionstudios.com 2.6.38.2-9.fc15.i686 #1 SMP Wed Mar 30 16:54:01 UTC 2011 i686 i686 Alert Count 1 First Seen Fri 22 Apr 2011 07:09:29 PM PDT Last Seen Fri 22 Apr 2011 07:09:29 PM PDT Local ID 0c77a1b4-01fe-408c-94a5-257a884488cc Raw Audit Messages type=AVC msg=audit(1303524569.447:185): avc: denied { getattr } for pid=23697 comm="dhclient-script" path="/bin/systemctl" dev=sda2 ino=12270 scontext=system_u:system_r:dhcpc_t:s0 tcontext=system_u:object_r:systemd_systemctl_exec_t:s0 tclass=file Hash: dhclient-script,dhcpc_t,systemd_systemctl_exec_t,file,getattr audit2allow #============= dhcpc_t ============== allow dhcpc_t systemd_systemctl_exec_t:file getattr; audit2allow -R #============= dhcpc_t ============== allow dhcpc_t systemd_systemctl_exec_t:file getattr;