Bug 834089

I also get an AVC for 'shutdown access' on the same unix_stream_socket.

These AVC are generated when attempting to connect to the local smokeping webpage after upgrading to F17 (from F16).  The smokeping page returns a 500 Internal Server Error.

'setenforce 0' allows the page to load and function normally.  No additional AVCs are generate (besides the ones mentioned above) while running in permissive mode.

When you put this in permissive mode do you get additional AVC messages?

Created attachment 594534 [details]
output of 'grep smokeping.fcgi /var/log/audit/audit.log'

Attached a list of additional AVCs that are raised when running smokeping while in permissive mode.

Jeff, does it work with the following local policy

# cat mypol.te
policy_module(mypol,1.0)

require{
 type httpd_smokeping_cgi_script_t;
 type httpd_t;
}

allow httpd_smokeping_cgi_script_t httpd_t:unix_stream_socket { ioctl accept getattr };
auth_read_passwd(httpd_smokeping_cgi_script_t)




Execute:

# make -f /usr/share/selinux/devel/Makefile mypol.pp
# semoodule -i mypol.pp

and re-test with enforcing mode.

Created attachment 594831 [details]
AVCs generated after 'systemctl restart smokeping.service' (in permssive mode)

Miroslav,
It did not work with the policy you provided; I still received an AVC for 'shutdown' access on the socket.

I added 'shutdown' access to the  mypol.te, recompiled and reapplied using: 

# cat mypol.te
policy_module(mypol,1.0)

require{
 type httpd_smokeping_cgi_script_t;
 type httpd_t;
}

allow httpd_smokeping_cgi_script_t httpd_t:unix_stream_socket { ioctl accept getattr shutdown};

# make -f /usr/share/selinux/devel/Makefile mypol.pp
# semoodule -i mypol.pp



That worked better, but resulted in a new AVC.  Oddly, when I switched to permissive mode the new AVC did not recur.  I switched back to enforcing and it still did not recur.  I am guessing this AVC was related to the SELinux policy having changed while the process was running.

At that point, my smokeping installation seemed to be working with the local policy installed, in enforcing mode, without generating any AVCs.  Just to be thorough, I decided to restart the smokeping service, which resulted in a new AVC.  I then switched to permissive mode, restated the smokeping service and received the attached AVCs.

Ok, try to add to your policy


require{
 type smokeping_t;
}
corecmd_exec_bin(smokeping_t)


and recompile/reload your local policy.

commit 5c4671c1dd50dbe7c81273136b34cd2d5546b28e
Author: Miroslav Grepl <mgrepl>
Date:   Wed Oct 17 10:48:59 2012 +0200

    Allow smokeping to execute bin_t

selinux-policy-3.10.0-156.fc17 has been submitted as an update for Fedora 17.
https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-156.fc17

Package selinux-policy-3.10.0-156.fc17:
* should fix your issue,
* was pushed to the Fedora 17 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-156.fc17'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-16347/selinux-policy-3.10.0-156.fc17
then log in and leave karma (feedback).

I also tried to get smokeping running, it seems my f17 doesn't work out of the box with fcgi. So I went ahead with plain cgi version of smokeping. I had to add these rules to get it working:

$ sudo grep smokeping /var/log/audit/audit.log | audit2allow 


#============= httpd_smokeping_cgi_script_t ==============
#!!!! This avc is allowed in the current policy

allow httpd_smokeping_cgi_script_t self:capability net_raw;
#!!!! This avc is allowed in the current policy

allow httpd_smokeping_cgi_script_t self:rawip_socket create;

#============= smokeping_t ==============
#!!!! This avc is allowed in the current policy

allow smokeping_t bin_t:file { read execute open execute_no_trans };


unfortunately I found this bug only after doing those instead of just downloading the selinux-policy from testing.

selinux-policy-3.10.0-156.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.