Bug 809120

Summary: SELinux is preventing /usr/lib64/yp/ypxfr from 'read, write' accesses on the file /run/ypserv.pid
Product: [Fedora] Fedora Reporter: Ralf Corsepius <rc040203>
Component: ypservAssignee: Honza Horak <hhorak>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 16CC: dominick.grift, dwalsh, hhorak, kklic, mgrepl
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: ypserv-2.26-10.fc16 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-04-26 20:11:58 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Attachments:
Description Flags
sealert -l cec6e0ba-8123-4668-81da-3056221d0470 none

Description Ralf Corsepius 2012-04-02 14:20:23 UTC
Description of problem:

Non a yp-slave server with selinux enabled, each yppush on a remote yp-master triggers this sealert:

Apr  2 13:46:47 beck setroubleshoot: SELinux is preventing /usr/lib64/yp/ypxfr from 'read, write' accesses on the file /run/ypserv.pid. For complete SELinux messages. run sealert -l cec6e0ba-8123-4668-81da-3056221d0470

Version-Release number of selected component (if applicable):
selinux-policy-3.10.0-80.fc16.noarch

How reproducible:
Always

Steps to Reproduce:
1. Set up a yp-master and yp-slave server
2. On the yp-master, run (cd /var/yp && make)
  
Actual results:
SEAlert above being risen on the yp-slave server

Expected results:
Function, no sealert.

Additional info:

Comment 1 Ralf Corsepius 2012-04-02 14:22:07 UTC
Created attachment 574521 [details]
sealert -l cec6e0ba-8123-4668-81da-3056221d0470

Comment 2 Daniel Walsh 2012-04-02 19:18:52 UTC
Looks like ypserv is leaking an open file descriptor to /var/run/ypserv.pid

fcntl(fd, F_SETFILE,FD_CLOEXEC)

http://danwalsh.livejournal.com/53603.html

Comment 3 Honza Horak 2012-04-13 19:00:55 UTC
(In reply to comment #2)
> Looks like ypserv is leaking an open file descriptor to /var/run/ypserv.pid

Thanks for the tip.

Ralf, can you, please, test the following build, if it fixes the problem?
http://koji.fedoraproject.org/koji/taskinfo?taskID=3989154

Comment 4 Ralf Corsepius 2012-04-15 22:17:17 UTC
(In reply to comment #3)
> Ralf, can you, please, test the following build, if it fixes the problem?
> http://koji.fedoraproject.org/koji/taskinfo?taskID=3989154
AFAICT, after ca. 2 days of using it, it seems to fix this particular issue for me (yppush seems to be working, again).

Comment 5 Fedora Update System 2012-04-16 11:04:31 UTC
ypserv-2.27-2.fc17 has been submitted as an update for Fedora 17.
https://admin.fedoraproject.org/updates/ypserv-2.27-2.fc17

Comment 6 Fedora Update System 2012-04-16 11:50:15 UTC
ypserv-2.26-10.fc16 has been submitted as an update for Fedora 16.
https://admin.fedoraproject.org/updates/ypserv-2.26-10.fc16

Comment 7 Fedora Update System 2012-04-16 21:55:12 UTC
Package ypserv-2.27-2.fc17:
* should fix your issue,
* was pushed to the Fedora 17 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing ypserv-2.27-2.fc17'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-5970/ypserv-2.27-2.fc17
then log in and leave karma (feedback).

Comment 8 Fedora Update System 2012-04-26 20:11:58 UTC
ypserv-2.27-2.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2012-04-27 05:51:55 UTC
ypserv-2.26-10.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.