Bug 885713
| Summary: | SELinux is preventing index.pl (httpd_sys_script_t) "read" to <Desconocido> (httpd_sys_script_t) | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 5 | Reporter: | Miguel González Laredo <lupin3_20hot> | ||||
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> | ||||
| Status: | CLOSED NEXTRELEASE | QA Contact: | BaseOS QE Security Team <qe-baseos-security> | ||||
| Severity: | urgent | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 5.8 | CC: | dwalsh, lupin3_20hot, mmalik | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | x86_64 | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2013-03-25 10:02:30 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
Created attachment 660874 [details]
sealert output
Hoping this info is useful.
Dear Miroslav, could I add some additional information in the way you can review this case? I'd need to solve it for reactivate SELINUX enforcing knowing the perl service will keep working. Thank in advance! Does it work with local policy? Hi Miroslav. The local custom policy, managed by means of audit2allow and semodule, worked but I don't know if that's the right way to solve it! Please, keep this local policy for RHEL5. We are going to fix this issue in RHEL6. |
Description of problem: OTRS software's perl script not working with SELinux. Version-Release number of selected component (if applicable): * CentOS release 5.8 (Final) * selinux-policy-2.4.6-327.el5 * perl-5.8.8-38.el5_8 * PRODUCT = OTRS; VERSION = 2.3.4; BUILDDATE = Tue Jan 20 21:06:45 CET 2009; BUILDHOST = How reproducible: Just installing these components and activing SELinux, in permissive mode is enough to obtain on /var/log/audit/audit.log the SELinux messages. Steps to Reproduce: 1. 2. 3. Actual results: OTRS perl script not working and audit.log displaying the following messages type=AVC msg=audit(1355144264.091:253901): avc: denied { unix_read unix_write } for pid=8875 comm="index.pl" key=44442410 scontext=root:system_r:httpd_sys_script_t:s0 tcontext=system_u:system_r:httpd_sys_script_t:s0 tclass=shm type=AVC msg=audit(1355144264.091:253901): avc: denied { associate } for pid=8875 comm="index.pl" key=44442410 scontext=root:system_r:httpd_sys_script_t:s0 tcontext=system_u:system_r:httpd_sys_script_t:s0 tclass=shm type=SYSCALL msg=audit(1355144264.091:253901): arch=c000003e syscall=29 success=yes exit=2981895 a0=2a6232a a1=1 a2=3ff a3=12 items=0 ppid=28929 pid=8875 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=23607 comm="index.pl" exe="/usr/bin/perl" subj=root:system_r:httpd_sys_script_t:s0 key=(null) fg Expected results: No to show these messages and OTRS perl script to work on enforcing SELinux mode Additional info: Hope you can help to fix this problem.