| Summary: | SELinux is preventing /usr/sbin/dnsmasq from 'search' accesses on the directory /home. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | M J <login> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED WONTFIX | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 14 | CC: | dominick.grift, dwalsh, mgrepl |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | setroubleshoot_trace_hash:8e828a9cc51175c98352a3084288318f2cb76ef5107f4b8dd2a97f8d3049fc0b | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2012-08-16 14:41:51 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
How did you start dnsmasq? /etc/init.d/dnsmasq start or service dnsmasq start I've tried both and neither works. dnsmasq will crash after generting this security exception. Ok, try to start the service using # semanage permissive -a dnsmasq_t # service dnsmasq start # auseearch -m avc -ts recent MJ did you setup something in dnsmasq config to search for content in /home? This message is a notice that Fedora 14 is now at end of life. Fedora has stopped maintaining and issuing updates for Fedora 14. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At this time, all open bugs with a Fedora 'version' of '14' have been closed as WONTFIX. (Please note: Our normal process is to give advanced warning of this occurring, but we forgot to do that. A thousand apologies.) Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, feel free to reopen this bug and simply change the 'version' to a later Fedora version. Bug Reporter: Thank you for reporting this issue and we are sorry that we were unable to fix it before Fedora 14 reached end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged to click on "Clone This Bug" (top right of this page) and open it against that version of Fedora. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete. The process we are following is described here: http://fedoraproject.org/wiki/BugZappers/HouseKeeping |
SELinux is preventing /usr/sbin/dnsmasq from 'search' accesses on the directory /home. ***** Plugin catchall (100. confidence) suggests *************************** If you believe that dnsmasq should be allowed search access on the home directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep dnsmasq /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context unconfined_u:system_r:dnsmasq_t:s0 Target Context system_u:object_r:home_root_t:s0 Target Objects /home [ dir ] Source dnsmasq Source Path /usr/sbin/dnsmasq Port <Unknown> Host (removed) Source RPM Packages dnsmasq-2.52-1.fc13 Target RPM Packages filesystem-2.4.35-1.fc14 Policy RPM selinux-policy-3.9.7-44.fc14 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 2.6.35.14-97.fc14.x86_64 #1 SMP Sat Sep 17 00:15:37 UTC 2011 x86_64 x86_64 Alert Count 3 First Seen Tue 25 Oct 2011 03:28:55 AM MDT Last Seen Tue 25 Oct 2011 04:09:31 AM MDT Local ID 7a108d32-495d-40d6-9a92-f8dcea95daed Raw Audit Messages type=AVC msg=audit(1319537371.754:168): avc: denied { search } for pid=4994 comm="dnsmasq" name="home" dev=sda1 ino=393217 scontext=unconfined_u:system_r:dnsmasq_t:s0 tcontext=system_u:object_r:home_root_t:s0 tclass=dir type=SYSCALL msg=audit(1319537371.754:168): arch=x86_64 syscall=stat success=no exit=EACCES a0=7fff4d290a30 a1=7fff4d290af0 a2=7fff4d290af0 a3=ffffffff items=0 ppid=4993 pid=4994 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm=dnsmasq exe=/usr/sbin/dnsmasq subj=unconfined_u:system_r:dnsmasq_t:s0 key=(null) Hash: dnsmasq,dnsmasq_t,home_root_t,dir,search audit2allow #============= dnsmasq_t ============== allow dnsmasq_t home_root_t:dir search; audit2allow -R #============= dnsmasq_t ============== allow dnsmasq_t home_root_t:dir search; ---SNIP--- I can't see any reasons why dnsmasq should need access to the /home directory. I've looked through its configuration file and documentation extensively and there is no mention of why it needs to do this. There have been no similar reports of this on the internet and so it looks like a peculiarity of dnsmasq and Fedora 14.