Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: SELinux is preventing /usr/sbin/squid from 'read' accesses on the file /etc/squid/squid.conf. ***** Plugin catchall (100. confidence) suggests ************************** If aby squid powinno mieć domyślnie read dostęp do squid.conf file. Then proszę to zgłosić jako błąd. Można utworzyć lokalny moduł polityki, aby umożliwić ten dostęp. Do można tymczasowo zezwolić na ten dostęp wykonując polecenia: # grep squid /var/log/audit/audit.log | audit2allow -M mojapolityka # semodule -i mojapolityka.pp Additional Information: Source Context system_u:system_r:logrotate_t:s0-s0:c0.c1023 Target Context system_u:object_r:squid_conf_t:s0 Target Objects /etc/squid/squid.conf [ file ] Source squid Source Path /usr/sbin/squid Port <Unknown> Host (removed) Source RPM Packages squid-3.3.11-1.fc20.x86_64 Target RPM Packages squid-3.3.11-1.fc20.x86_64 Policy RPM selinux-policy-3.12.1-117.fc20.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 3.12.7-300.fc20.x86_64 #1 SMP Fri Jan 10 15:35:31 UTC 2014 x86_64 x86_64 Alert Count 1 First Seen 2014-01-19 11:43:01 CET Last Seen 2014-01-19 11:43:01 CET Local ID ceb9ea39-3afb-4b91-9651-3fca6a31f6c6 Raw Audit Messages type=AVC msg=audit(1390128181.947:396): avc: denied { read } for pid=4690 comm="squid" name="squid.conf" dev="dm-2" ino=915993 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:squid_conf_t:s0 tclass=file type=SYSCALL msg=audit(1390128181.947:396): arch=x86_64 syscall=open success=no exit=EACCES a0=7f692e164530 a1=0 a2=1b6 a3=1 items=0 ppid=4689 pid=4690 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=2 tty=(none) comm=squid exe=/usr/sbin/squid subj=system_u:system_r:logrotate_t:s0-s0:c0.c1023 key=(null) Hash: squid,logrotate_t,squid_conf_t,file,read Additional info: reporter: libreport-2.1.11 hashmarkername: setroubleshoot kernel: 3.12.7-300.fc20.x86_64 type: libreport
commit b7ed5ddcaaa12f96e01367fdee88294fec31b770 Author: Miroslav Grepl <mgrepl> Date: Sun Jan 19 22:00:54 2014 +0100 Allow logrotate to read squid.conf
selinux-policy-3.12.1-119.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-119.fc20
Package selinux-policy-3.12.1-119.fc20: * should fix your issue, * was pushed to the Fedora 20 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-119.fc20' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2014-1249/selinux-policy-3.12.1-119.fc20 then log in and leave karma (feedback).
selinux-policy-3.12.1-119.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.