Bug 741670

Summary:

SELinux is preventing sh (dhcpc_t) "execute" to ./iptables (iptables_exec_t).

Detailed Description:

SELinux denied access requested by sh. It is not expected that this access is
required by sh and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.

Allowing Access:

Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for ./iptables,

restorecon -v './iptables'

If this does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Additional Information:

Source Context                system_u:system_r:dhcpc_t
Target Context                system_u:object_r:iptables_exec_t
Target Objects                ./iptables [ file ]
Source                        sh
Source Path                   /bin/bash
Port                          <Unknown>
Host                          localhost.localdomain
Source RPM Packages           bash-3.2-32.el5
Target RPM Packages           
Policy RPM                    selinux-policy-2.4.6-316.el5
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   catchall_file
Host Name                     localhost.localdomain
Platform                      Linux localhost.localdomain 2.6.18-274.3.1.el5xen
                              #1 SMP Fri Aug 26 19:08:58 EDT 2011 x86_64 x86_64
Alert Count                   384
First Seen                    Mon 22 Aug 2011 11:57:23 AM PDT
Last Seen                     Tue 27 Sep 2011 05:26:50 AM PDT
Local ID                      4a813ab8-d0cc-43e3-93c0-b506259979c9
Line Numbers                  

Raw Audit Messages            

host=localhost.localdomain type=AVC msg=audit(1317126410.221:9934): avc:  denied  { execute } for  pid=14511 comm="sh" name="iptables" dev=dm-0 ino=196608185 scontext=system_u:system_r:dhcpc_t:s0 tcontext=system_u:object_r:iptables_exec_t:s0 tclass=file

host=localhost.localdomain type=SYSCALL msg=audit(1317126410.221:9934): arch=c000003e syscall=59 success=no exit=-13 a0=1a1b60c0 a1=1a1b61d0 a2=1a19fdb0 a3=8 items=0 ppid=14510 pid=14511 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sh" exe="/bin/bash" subj=system_u:system_r:dhcpc_t:s0 key=(null)