Bug 703638

Summary: SELinux is preventing /opt/ruby-enterprise-1.8.7-2011.03/lib/ruby/gems/1.8/gems/passenger-3.0.7/agents/PassengerWatchdog from using the 'chown' capabilities.
Product: [Fedora] Fedora Reporter: Robert <aersunstrike>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 14CC: aersunstrike, dwalsh, mgrepl
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard: setroubleshoot_trace_hash:3842fd9a640eddc224cff91cbff1fa631e71ecf366af20410d70efd6109fd23e
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-10-07 19:41:00 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Robert 2011-05-10 21:55:47 UTC
SELinux is preventing /opt/ruby-enterprise-1.8.7-2011.03/lib/ruby/gems/1.8/gems/passenger-3.0.7/agents/PassengerWatchdog from using the 'chown' capabilities.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that PassengerWatchdog should have the chown capability by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep PassengerWatchd /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                unconfined_u:system_r:httpd_sys_script_t:s0
Target Context                unconfined_u:system_r:httpd_sys_script_t:s0
Target Objects                Unknown [ capability ]
Source                        PassengerWatchd
Source Path                   /opt/ruby-enterprise-1.8.7-2011.03/lib/ruby/gems/1
                              .8/gems/passenger-3.0.7/agents/PassengerWatchdog
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.9.7-40.fc14
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 2.6.35.12-90.fc14.x86_64 #1
                              SMP Fri Apr 22 16:01:29 UTC 2011 x86_64 x86_64
Alert Count                   13
First Seen                    Tue 10 May 2011 09:56:11 PM BST
Last Seen                     Tue 10 May 2011 10:35:51 PM BST
Local ID                      e7de84d5-b367-4353-b58b-1000561d7ada

Raw Audit Messages
type=AVC msg=audit(1305063351.973:40108): avc:  denied  { chown } for  pid=3667 comm="PassengerWatchd" capability=0  scontext=unconfined_u:system_r:httpd_sys_script_t:s0 tcontext=unconfined_u:system_r:httpd_sys_script_t:s0 tclass=capability


type=SYSCALL msg=audit(1305063351.973:40108): arch=x86_64 syscall=chown success=no exit=EPERM a0=25fa9f8 a1=30 a2=30 a3=7fffcda31bd0 items=0 ppid=2604 pid=3667 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=161 comm=PassengerWatchd exe=/opt/ruby-enterprise-1.8.7-2011.03/lib/ruby/gems/1.8/gems/passenger-3.0.7/agents/PassengerWatchdog subj=unconfined_u:system_r:httpd_sys_script_t:s0 key=(null)

Hash: PassengerWatchd,httpd_sys_script_t,httpd_sys_script_t,capability,chown

audit2allow

#============= httpd_sys_script_t ==============
#!!!! This avc is allowed in the current policy

allow httpd_sys_script_t self:capability chown;

audit2allow -R

#============= httpd_sys_script_t ==============
#!!!! This avc is allowed in the current policy

allow httpd_sys_script_t self:capability chown;

Comment 1 Miroslav Grepl 2011-05-11 07:18:51 UTC
I think it is time for a new passenger policy which was created for Passenger3.

Robert,
I could send you a local policy for testing?

Comment 2 Robert 2011-05-11 10:24:31 UTC
(In reply to comment #1)
> I think it is time for a new passenger policy which was created for Passenger3.
> 
> Robert,
> I could send you a local policy for testing?

I wish I could help, however I tried to setup a policy already via the SELinux Troubleshooter and in the end reverted to the setup we had here before installing Passenger. If you know how to remove a recently added policy however, I could remove it and try the setup again (the server was trying to run Gitorious on Passenger).

Thank you for the prompt answer.
-- Robert