Bug 728699
| Summary: | SELinux prevents hddtemp from listening on 'localhost' | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Simon Matter <simon.matter> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 6.0 | CC: | dwalsh, mmalik |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-3.7.19-109.el6 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-12-06 10:10:24 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Hm, the above was wrong, this one works:
module invocahddtemp 1.0;
require {
type net_conf_t;
type etc_t;
type hddtemp_t;
class file { read open };
}
#============= hddtemp_t ==============
allow hddtemp_t etc_t:file { read open };
allow hddtemp_t net_conf_t:file { read open };
I added a fix to Fedora. Will backport to RHEL6 Fixed in selinux-policy-3.7.19-107.el6 Fixed in selinux-policy-3.7.19-109.el6 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2011-1511.html |
Description of problem: SELinux prevents hddtemp from listeing on 'localhost' when running as daemon from init script, but listeing on '127.0.0.1' is allowed. The EPEL hddtemp package listens on '127.0.0.1' but IMHO that's not the correct way because it won't work on IPv6 only hosts. Version-Release number of selected component (if applicable): selinux-policy-targeted-3.7.19-54.el6_0.5 (I have checked selinux-policy-targeted-3.7.19-93.el6_1.2 and it seems to behave the same) How reproducible: Steps to Reproduce: 1. Install hddtemp (for example from EPEL) 2. Run it from the init script with "--listen=localhost" 3. Actual results: It won't start Expected results: It should start the same way as when running it with 'hddtemp --daemon --listen=localhost --unit=C /dev/sda' as root from console. Additional info: allow2audit tells me the following is required: ---------------- module myhddtemp 1.0; require { type net_conf_t; type etc_t; type hddtemp_t; class file read; } #============= hddtemp_t ============== allow hddtemp_t etc_t:file read; allow hddtemp_t net_conf_t:file read; ---------------- So, name resolution is not allowed by default I guess. If I understand the whole SELinux thing correctly this correction should be made in the default selinux-policy-targeted. I know hddtemp is not part of EL6 but since the same issue applies to Fedora I guess it doesn't hurt if it would be fixed. Thanks, Simon