Bug 859019

+++ This bug was initially created as a clone of Bug #856098 +++

Description of problem:
service slapd start cause avc message, slaptest fail to write. /usr/lib/systemd/system/slapd.service have in config ExecStartPre=/usr/libexec/openldap/check-config.sh which run slaptest

type=AVC msg=audit(1347360019.846:833): avc:  denied  { write } for  pid=12425 comm="slaptest" path="/tmp/tmp.t4gJT7yp7p" dev="dm-2" ino=654207 scontext=system_u:system_r:slapd_t:s0 tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=file

Version-Release number of selected component (if applicable):
selinux-policy-3.11.1-11.el7
openldap-2.4.32-2.el7

How reproducible:
always

--- Additional comment from mmalik on 2012-09-11 10:33:30 CEST ---

Following AVCs appeared in enforcing mode:
----
time->Tue Sep 11 10:27:23 2012
type=PATH msg=audit(1347352043.811:10189): item=1 name=(null) inode=3670626 dev=08:04 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0
type=PATH msg=audit(1347352043.811:10189): item=0 name="/usr/sbin/slaptest" inode=3678745 dev=08:04 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:slapd_exec_t:s0
type=CWD msg=audit(1347352043.811:10189):  cwd="/"
type=EXECVE msg=audit(1347352043.811:10189): argc=2 a0="/usr/sbin/slaptest" a1="-u"
type=SYSCALL msg=audit(1347352043.811:10189): arch=c000003e syscall=59 success=yes exit=0 a0=1fa9e50 a1=1fa9420 a2=1fa8f90 a3=18 items=2 ppid=31277 pid=31278 auid=4294967295 uid=55 gid=55 euid=55 suid=55 fsuid=55 egid=55 sgid=55 fsgid=55 tty=(none) ses=4294967295 comm="slaptest" exe="/usr/sbin/slapd" subj=system_u:system_r:slapd_t:s0 key=(null)
type=AVC msg=audit(1347352043.811:10189): avc:  denied  { write } for  pid=31278 comm="slaptest" path="/tmp/tmp.ERiA2LfAdC" dev="tmpfs" ino=320241 scontext=system_u:system_r:slapd_t:s0 tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=file
type=AVC msg=audit(1347352043.811:10189): avc:  denied  { write } for  pid=31278 comm="slaptest" path="/tmp/tmp.ERiA2LfAdC" dev="tmpfs" ino=320241 scontext=system_u:system_r:slapd_t:s0 tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=file
----

--- Additional comment from dwalsh on 2012-09-11 13:54:53 CEST ---

Does slaptest do something like

command < _EOF
line1
line2
_EOF

BTW is this a real test or just some testing code you guys are doing?

--- Additional comment from mmalik on 2012-09-11 14:10:49 CEST ---

slaptest is a part of openldap-servers package and it's executed from slapd.service file.

--- Additional comment from mmalik on 2012-09-11 14:16:03 CEST ---

# rpm -ql openldap-servers | grep slaptest
/usr/sbin/slaptest
/usr/share/man/man8/slaptest.8.gz
# cat /usr/lib/systemd/system/slapd.service 
[Unit]
Description=OpenLDAP Server Daemon
After=syslog.target

[Service]
Type=forking
PIDFile=/var/run/openldap/slapd.pid
Environment="SLAPD_URLS=ldap:/// ldapi:///" "SLAPD_OPTIONS="
EnvironmentFile=/etc/sysconfig/slapd
ExecStartPre=/usr/libexec/openldap/check-config.sh
ExecStart=/usr/sbin/slapd -u ldap -h ${SLAPD_URLS} $SLAPD_OPTIONS

[Install]
WantedBy=multi-user.target
# head /usr/libexec/openldap/check-config.sh
#!/bin/sh
# Author: Jan Vcelak <jvcelak>

. /usr/libexec/openldap/functions

function check_config_syntax()
{
	retcode=0
	tmp_slaptest=`mktemp`
	run_as_ldap "/usr/sbin/slaptest $SLAPD_GLOBAL_OPTIONS -u" &>$tmp_slaptest
# ls -l /usr/sbin/slaptest 
lrwxrwxrwx. 1 root root 5 Aug 22 10:36 /usr/sbin/slaptest -> slapd
#

--- Additional comment from dwalsh on 2012-09-18 17:03:45 CEST ---

How about
	
	run_as_ldap "/usr/sbin/slaptest $SLAPD_GLOBAL_OPTIONS -u" &> /var/run/openldap/slaptest.log

--- Additional comment from dwalsh on 2012-09-18 17:04:06 CEST ---

Services should not be using /tmp.