| Summary: | pulse: cannot create heartbeat socket | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 5 | Reporter: | Milos Malik <mmalik> | ||||||
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> | ||||||
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> | ||||||
| Severity: | medium | Docs Contact: | |||||||
| Priority: | medium | ||||||||
| Version: | 5.7 | CC: | dwalsh | ||||||
| Target Milestone: | rc | ||||||||
| Target Release: | --- | ||||||||
| Hardware: | All | ||||||||
| OS: | Linux | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | selinux-policy-2.4.6-312.el5 | Doc Type: | Bug Fix | ||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2011-07-21 09:20:53 UTC | Type: | --- | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Attachments: |
|
||||||||
Created attachment 504095 [details]
simple configuration file
It does not help. The AVC still appears. piranha_lvs_can_network_connect --> on When I use another configuration file following AVCs appear:
----
time->Fri Jun 10 11:03:23 2011
type=SYSCALL msg=audit(1307718203.347:688): arch=14 syscall=37 success=no exit=
-13 a0=7e09 a1=f a2=ffffffff a3=4000 items=0 ppid=1 pid=28008 auid=0 uid=0 gid=
0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="pulse" exe
="/usr/sbin/pulse" subj=root:system_r:piranha_pulse_t:s0 key=(null)
type=AVC msg=audit(1307718203.347:688): avc: denied { signal } for pid=28008 comm="pulse" scontext=root:system_r:piranha_pulse_t:s0 tcontext=root:system_r:piranha_pulse_t:s0 tclass=process
----
time->Fri Jun 10 11:03:21 2011
type=SYSCALL msg=audit(1307718201.000:207): arch=14 syscall=11 success=no exit=-13 a0=1000ed4c a1=ff8bf160 a2=ff8bfeac a3=ffa0a18 items=0 ppid=28008 pid=28499 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="pulse" exe="/usr/sbin/pulse" subj=root:system_r:piranha_pulse_t:s0 key=(null)
type=AVC msg=audit(1307718201.000:207): avc: denied { execute } for pid=28499 comm="pulse" name="fos" dev=dm-0 ino=4410270 scontext=root:system_r:piranha_pulse_t:s0 tcontext=system_u:object_r:piranha_fos_exec_t:s0 tclass=file
----
Created attachment 504142 [details]
another simple configuration file
Fixed in rawhide. b5350cd2ad1d30366e26790e302290f8a17fa6e4 There is a type causing the second avc, and we should allow all signals within a single domain. Fixed in selinux-policy-2.4.6-312.el5 An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2011-1069.html An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2011-1069.html |
Description of problem: If /etc/sysconfig/ha/lvs.cf contains following lines (as suggested in /usr/share/doc/piranha-0.8.4/sample.cf) then the pulse service will not run because of SELinux. heartbeat = 1 heartbeat_port = 1050 Version-Release number of selected component (if applicable): selinux-policy-devel-2.4.6-311.el5 selinux-policy-strict-2.4.6-311.el5 selinux-policy-2.4.6-311.el5 selinux-policy-mls-2.4.6-311.el5 selinux-policy-targeted-2.4.6-311.el5 selinux-policy-minimum-2.4.6-311.el5 piranha-0.8.4-22.el5 ipvsadm-1.24-13.el5 How reproducible: always Steps to Reproduce: # setenforce 1 # service pulse start Starting pulse: pulse: cannot create heartbeat socket. running as root? [FAILED] Actual results: * pulse service is not running * following AVC appeared ---- time->Fri Jun 10 08:28:06 2011 type=SYSCALL msg=audit(1307708886.913:112): arch=40000003 syscall=102 success=no exit=-13 a0=2 a1=bfa48ff0 a2=3 a3=41a items=0 ppid=19029 pid=19030 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="pulse" exe="/usr/sbin/pulse" subj=root:system_r:piranha_pulse_t:s0 key=(null) type=AVC msg=audit(1307708886.913:112): avc: denied { name_bind } for pid=19030 comm="pulse" src=1050 scontext=root:system_r:piranha_pulse_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=udp_socket ---- Expected results: * no AVCs * pulse service is running