Bug 727419

Are you still seeing this, it got lost in the flood of bugs.

Haven't seen it for a while. In fact I'm not even sure I was able to reproduce it.

I see this periodically.  I'm wondering if it's coincidental that I get an error message :

-------------------------------------------
/etc/cron.daily/logrotate:

/etc/init.d/functions: line 58: /dev/stderr: Permission denied
Restarting murmur (via systemctl):  [  OK  ]
-------------------------------------------

emailed to me at the same time the alert is generated.  

I have a mumble server running on this machine.  If it helps, rpm -qa | grep murmur returns:

murmur-1.2.3-3.fc15.x86_64

(In reply to comment #3)
> I see this periodically.  I'm wondering if it's coincidental that I get an
> error message :
> 
> -------------------------------------------
> /etc/cron.daily/logrotate:
> 
> /etc/init.d/functions: line 58: /dev/stderr: Permission denied
> Restarting murmur (via systemctl):  [  OK  ]
> -------------------------------------------
> 
> emailed to me at the same time the alert is generated.  
> 
> I have a mumble server running on this machine.  If it helps, rpm -qa | grep
> murmur returns:
> 
> murmur-1.2.3-3.fc15.x86_64

can you reproduce this? If so run sudo semodule -DB and then reproduce the issue. enclose the avc denials that you are seeing (ausearch -m avc -ts today). Afterwards run sudo semodule -B to undo the -DB. 

I suspect this was silently denied.

I will also write a SELinux policy for murmur. If you want to help me test the murmur policy let me know, thanks

I'm unable to reproduce this by running logrotate as root from the command line.  I've queued up an anacron execution with -f -d in hopes that will regenerate the error (which I normally only see once a week), and have changed the murmur file in /etc/logrotate.d to rotate daily.  Hopefully I'll be able to capture the error quickly.

As for testing a policy file, I'd be happy to assist.

Actually, in looking at my audit logs for this week, I find the following, which might be helpful:


ausearch -m avc -ts this-week
----
time->Sun Mar 11 03:12:11 2012
type=SYSCALL msg=audit(1331457131.825:660): arch=c000003e syscall=2 success=no exit=-13 a0=20b5ba0 a1=0 a2=1b6 a3=0 items=0 ppid=22807 pid=22808 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=57 comm="service" exe="/bin/bash" subj=system_u:system_r:logrotate_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1331457131.825:660): avc:  denied  { open } for  pid=22808 comm="service" dev=pipefs ino=117150 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_cronjob_t:s0-s0:c0.c1023 tclass=fifo_file
----
time->Sun Mar 11 03:12:11 2012
type=SYSCALL msg=audit(1331457131.828:661): arch=c000003e syscall=2 success=no exit=-13 a0=20b5ba0 a1=0 a2=1b6 a3=0 items=0 ppid=22807 pid=22808 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=57 comm="service" exe="/bin/bash" subj=system_u:system_r:logrotate_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1331457131.828:661): avc:  denied  { open } for  pid=22808 comm="service" dev=pipefs ino=117150 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_cronjob_t:s0-s0:c0.c1023 tclass=fifo_file
----

I guess we should allow it, it is just the service script opening /dev/stderr which is currently owned byt the fifo_file from system_cronjob_t.

Miroslav lets add

	allow $1 crond_t:fifo_file rw_fifo_file_perms;
	allow $1 system_cronjob_t:fifo_file rw_fifo_file_perms;

To cron_system_entry for RHEL6 and F15, F16.

Created attachment 569988 [details]
AVC list

Here's the burst of avc messages which occur at the same time I receive the email from anacron, run with semodule -DB set.

Please let me know if I need to do anything further, thanks!

This message is a notice that Fedora 15 is now at end of life. Fedora
has stopped maintaining and issuing updates for Fedora 15. It is
Fedora's policy to close all bug reports from releases that are no
longer maintained. At this time, all open bugs with a Fedora 'version'
of '15' have been closed as WONTFIX.

(Please note: Our normal process is to give advanced warning of this
occurring, but we forgot to do that. A thousand apologies.)

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, feel free to reopen
this bug and simply change the 'version' to a later Fedora version.

Bug Reporter: Thank you for reporting this issue and we are sorry that
we were unable to fix it before Fedora 15 reached end of life. If you
would still like to see this bug fixed and are able to reproduce it
against a later version of Fedora, you are encouraged to click on
"Clone This Bug" (top right of this page) and open it against that
version of Fedora.

Although we aim to fix as many bugs as possible during every release's
lifetime, sometimes those efforts are overtaken by events. Often a
more recent Fedora release includes newer upstream software that fixes
bugs or makes them obsolete.

The process we are following is described here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping