Bug 966387
| Summary: | wrong permissions for openvpn | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Phil <beaaegicfqmq6rykaqaakty3lqcg6btv> | |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> | |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> | |
| Severity: | high | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 6.4 | CC: | dwalsh, lnovich, mmalik, rhbugzilla | |
| Target Milestone: | rc | |||
| Target Release: | --- | |||
| Hardware: | All | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | Bug Fix | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 966929 (view as bug list) | Environment: | ||
| Last Closed: | 2013-11-21 10:29:09 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
Following AVCs appeared in permissive mode:
----
time->Thu May 23 15:49:27 2013
type=PATH msg=audit(1369316967.990:995): item=0 name="/var/log/openvpn" inode=41295 dev=08:03 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:openvpn_var_log_t:s0
type=CWD msg=audit(1369316967.990:995): cwd="/etc/openvpn"
type=SYSCALL msg=audit(1369316967.990:995): arch=40000003 syscall=33 success=yes exit=0 a0=90fd8f8 a1=7 a2=90fddf4 a3=90fd8f8 items=1 ppid=32672 pid=32681 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="openvpn" exe="/usr/sbin/openvpn" subj=unconfined_u:system_r:openvpn_t:s0 key=(null)
type=AVC msg=audit(1369316967.990:995): avc: denied { read } for pid=32681 comm="openvpn" name="openvpn" dev=sda3 ino=41295 scontext=unconfined_u:system_r:openvpn_t:s0 tcontext=unconfined_u:object_r:openvpn_var_log_t:s0 tclass=dir
----
time->Thu May 23 15:49:27 2013
type=PATH msg=audit(1369316967.983:994): item=1 name="/var/log/openvpn/log" inode=38094 dev=08:03 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:openvpn_var_log_t:s0
type=PATH msg=audit(1369316967.983:994): item=0 name="/var/log/openvpn/" inode=41295 dev=08:03 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:openvpn_var_log_t:s0
type=CWD msg=audit(1369316967.983:994): cwd="/etc/openvpn"
type=SYSCALL msg=audit(1369316967.983:994): arch=40000003 syscall=5 success=yes exit=4 a0=90fddc4 a1=241 a2=180 a3=90fddc4 items=2 ppid=32672 pid=32681 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="openvpn" exe="/usr/sbin/openvpn" subj=unconfined_u:system_r:openvpn_t:s0 key=(null)
type=AVC msg=audit(1369316967.983:994): avc: denied { add_name } for pid=32681 comm="openvpn" name="log" scontext=unconfined_u:system_r:openvpn_t:s0 tcontext=unconfined_u:object_r:openvpn_var_log_t:s0 tclass=dir
type=AVC msg=audit(1369316967.983:994): avc: denied { write } for pid=32681 comm="openvpn" name="openvpn" dev=sda3 ino=41295 scontext=unconfined_u:system_r:openvpn_t:s0 tcontext=unconfined_u:object_r:openvpn_var_log_t:s0 tclass=dir
----
Configuration file contained among others following lines at the time:
log /var/log/openvpn/log
status /var/log/openvpn/status
Back ported from Fedora. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2013-1598.html |
Description of problem: openvpn fails to start since it cannot read/write to /var/log/openvpn. Version-Release number of selected component (if applicable): openvpn-2.3.1-1.el6.x86_64 selinux-policy-targeted-3.7.19-195.el6_4.3.noarch How reproducible: always. Steps to Reproduce: 1. update to openvpn 2.3.1 2. try to start it 3. profit. Actual results: openvpn is unable to read/write /var/log/openvpn and won't start. Expected results: openvpn is able to read/write /var/log/openvpn and starts. Additional info: * audit.log: type=AVC msg=audit(1369295332.800:771735): avc: denied { read write } for pid=27856 comm="openvpn" name="openvpn" dev=dm-3 ino=263685 scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:object_r:openvpn_var_log_t:s0 tclass=dir * fcontext: /var/log/openvpn.* all files system_u:object_r:openvpn_var_log_t:s0 * sesearch -A -s openvpn_t | grep openvpn_var_log_t: allow openvpn_t openvpn_var_log_t : file { ioctl read write create getattr setattr lock append unlink link rename open } ; --> class "dir" is missing anyways: openvpn_t is allowed to read/write to var_log_t.