Hide Forgot
Description of problem: there is selinux denial on /var/log/wtmp , see steps Version-Release number of selected component (if applicable): openlmi-0.4.1-2.el7.noarch selinux-policy-3.12.1-98.el7.noarch How reproducible: always Steps to Reproduce: 1.create user up to the http://www.openlmi.org/sites/default/files/doc/admin/openlmi-providers/0.4.1/account/usage.html#create-user Actual results: type=AVC msg=audit(1383916188.333:131340): avc: denied { read } for pid=23836 comm="cimprovagt" name="wtmp" dev="dm-1" ino=201909553 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:wtmp_t:s0 tclass=file Expected results: no avc Additional info:
when running in permissive: time->Fri Nov 8 09:22:00 2013 type=SYSCALL msg=audit(1383920520.640:212045): arch=c000003e syscall=2 success=yes exit=10 a0=7fc87422d2e0 a1=80000 a2=7fc87ab45cd5 a3=14 items=0 ppid=1 pid=7492 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="cimprovagt" exe="/usr/libexec/pegasus/cimprovagt" subj=system_u:system_r:pegasus_openlmi_account_t:s0 key=(null) type=AVC msg=audit(1383920520.640:212045): avc: denied { open } for pid=7492 comm="cimprovagt" path="/var/log/wtmp" dev="dm-1" ino=201909553 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:wtmp_t:s0 tclass=file type=AVC msg=audit(1383920520.640:212045): avc: denied { read } for pid=7492 comm="cimprovagt" name="wtmp" dev="dm-1" ino=201909553 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:wtmp_t:s0 tclass=file
It makes sense. commit b9f4f0bc3c85df1fdf9d66fd591287d51ede3155 Author: Miroslav Grepl <mgrepl> Date: Mon Nov 11 13:29:17 2013 +0100 Allow account provider to read login records
This request was resolved in Red Hat Enterprise Linux 7.0. Contact your manager or support representative in case you have further questions about the request.