Bug 905167
| Summary: | SELinux is preventing /usr/bin/boinc_client from using the execmem access on a process. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Germano Massullo <germano.massullo> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 18 | CC: | dominick.grift, dwalsh, mgrepl |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2013-02-08 02:25:26 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
What does # ls -Z /usr/bin/boinc_client # matchpathcon /usr/bin/boinc_client I entered # grep boinc_client /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp I don't know if it could affect the results of the commands you told me to enter. -rwxr-xr-x. root root system_u:object_r:boinc_exec_t:s0 /usr/bin/boinc_client /usr/bin/boinc_client system_u:object_r:boinc_exec_t:s0 Does it work with the local policy? (In reply to comment #3) > Does it work with the local policy? Do you mean # grep boinc_client /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp ? Yes, with these commands, BOINC works correctly Ok, thank you. Fixed in selinux-policy-3.11.1-74.fc18.noarch selinux-policy-3.11.1-74.fc18 has been submitted as an update for Fedora 18. https://admin.fedoraproject.org/updates/selinux-policy-3.11.1-74.fc18 Package selinux-policy-3.11.1-74.fc18: * should fix your issue, * was pushed to the Fedora 18 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.11.1-74.fc18' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-1693/selinux-policy-3.11.1-74.fc18 then log in and leave karma (feedback). selinux-policy-3.11.1-74.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report. |
Description of problem: In Fedora 18, something went wrong with SELinux and BOINC SELinux is preventing /usr/bin/boinc_client from using the execmem access on a process. ***** Plugin catchall (100. confidence) suggests *************************** If si crede che boinc_client dovrebbe avere possibilità di accesso execmem ai processi etichettati boinc_t in modo predefinito. Then si dovrebbe riportare il problema come bug. E' possibile generare un modulo di politica locale per consentire questo accesso. Do consentire questo accesso per il momento eseguendo: # grep boinc_client /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:boinc_t:s0 Target Context system_u:system_r:boinc_t:s0 Target Objects [ process ] Source boinc_client Source Path /usr/bin/boinc_client Port <Unknown> Source RPM Packages boinc-client-7.0.29-2.r25790svn.fc18.x86_64 Target RPM Packages Policy RPM selinux-policy-3.11.1-73.fc18.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name Magic-4 Platform Linux 3.7.4-204.fc18.x86_64 #1 SMP Wed Jan 23 16:44:29 UTC 2013 x86_64 x86_64 Alert Count 7 First Seen 2013-01-26 19:15:26 CET Last Seen 2013-01-28 18:46:50 CET Raw Audit Messages type=AVC msg=audit(1359395210.779:329): avc: denied { execmem } for pid=1782 comm="boinc_client" scontext=system_u:system_r:boinc_t:s0 tcontext=system_u:system_r:boinc_t:s0 tclass=process type=SYSCALL msg=audit(1359395210.779:329): arch=x86_64 syscall=mmap success=no exit=EACCES a0=7fc099963000 a1=3d000 a2=7 a3=812 items=0 ppid=1781 pid=1782 auid=4294967295 uid=991 gid=988 euid=991 suid=991 fsuid=991 egid=988 sgid=988 fsgid=988 ses=4294967295 tty=(none) comm=boinc_client exe=/usr/bin/boinc_client subj=system_u:system_r:boinc_t:s0 key=(null) Hash: boinc_client,boinc_t,boinc_t,process,execmem audit2allow #============= boinc_t ============== allow boinc_t self:process execmem; audit2allow -R #============= boinc_t ============== allow boinc_t self:process execmem;