Description of the problem: I paste 3 errors from the stock config of munin-node SELinux is preventing /usr/sbin/postconf from create access on the udp_socket . ***** Plugin catchall (100. confidence) suggests ************************** If you believe that postconf should be allowed create access on the udp_socket by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep postconf /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:mail_munin_plugin_t:s0 Target Context system_u:system_r:mail_munin_plugin_t:s0 Target Objects [ udp_socket ] Source postconf Source Path /usr/sbin/postconf Port <Unknown> Host strange.miceliux.com Source RPM Packages postfix-2.10.3-1.fc20.x86_64 Target RPM Packages Policy RPM selinux-policy-3.12.1-127.fc20.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name strange.miceliux.com Platform Linux strange.miceliux.com 3.13.6-200.fc20.x86_64 #1 SMP Fri Mar 7 17:02:28 UTC 2014 x86_64 x86_64 Alert Count 1 First Seen 2014-03-13 21:58:42 CET Last Seen 2014-03-13 21:58:42 CET Local ID 4772fb3e-6811-4e48-9241-bcddfdea53c5 Raw Audit Messages type=AVC msg=audit(1394744322.638:219755): avc: denied { create } for pid=867 comm="postconf" scontext=system_u:system_r:mail_munin_plugin_t:s0 tcontext=system_u:system_r:mail_munin_plugin_t:s0 tclass=udp_socket type=SYSCALL msg=audit(1394744322.638:219755): arch=x86_64 syscall=socket success=no exit=EACCES a0=2 a1=80002 a2=0 a3=400 items=0 ppid=866 pid=867 auid=4294967295 uid=0 gid=99 euid=0 suid=0 fsuid=0 egid=99 sgid=99 fsgid=99 ses=4294967295 tty=(none) comm=postconf exe=/usr/sbin/postconf subj=system_u:system_r:mail_munin_plugin_t:s0 key=(null) Hash: postconf,mail_munin_plugin_t,mail_munin_plugin_t,udp_socket,create ------------------ SELinux is preventing /usr/sbin/postconf from search access on the directory . ***** Plugin catchall (100. confidence) suggests ************************** If you believe that postconf should be allowed search access on the directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep postconf /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:mail_munin_plugin_t:s0 Target Context system_u:object_r:sysctl_net_t:s0 Target Objects [ dir ] Source postconf Source Path /usr/sbin/postconf Port <Unknown> Host strange.miceliux.com Source RPM Packages postfix-2.10.3-1.fc20.x86_64 Target RPM Packages Policy RPM selinux-policy-3.12.1-127.fc20.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name strange.miceliux.com Platform Linux strange.miceliux.com 3.13.6-200.fc20.x86_64 #1 SMP Fri Mar 7 17:02:28 UTC 2014 x86_64 x86_64 Alert Count 1 First Seen 2014-03-13 21:58:42 CET Last Seen 2014-03-13 21:58:42 CET Local ID c734ef9c-6164-4b8c-a1ac-c846798863c0 Raw Audit Messages type=AVC msg=audit(1394744322.638:219757): avc: denied { search } for pid=867 comm="postconf" name="net" dev="proc" ino=2173812 scontext=system_u:system_r:mail_munin_plugin_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=dir type=SYSCALL msg=audit(1394744322.638:219757): arch=x86_64 syscall=access success=no exit=EACCES a0=7fff596d96c0 a1=4 a2=7fff596d96d4 a3=400 items=0 ppid=866 pid=867 auid=4294967295 uid=0 gid=99 euid=0 suid=0 fsuid=0 egid=99 sgid=99 fsgid=99 ses=4294967295 tty=(none) comm=postconf exe=/usr/sbin/postconf subj=system_u:system_r:mail_munin_plugin_t:s0 key=(null) Hash: postconf,mail_munin_plugin_t,sysctl_net_t,dir,search ------------------ SELinux is preventing /usr/sbin/postconf from read access on the file . ***** Plugin catchall (100. confidence) suggests ************************** If you believe that postconf should be allowed read access on the file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep postconf /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:mail_munin_plugin_t:s0 Target Context system_u:object_r:proc_net_t:s0 Target Objects [ file ] Source postconf Source Path /usr/sbin/postconf Port <Unknown> Host strange.miceliux.com Source RPM Packages postfix-2.10.3-1.fc20.x86_64 Target RPM Packages Policy RPM selinux-policy-3.12.1-127.fc20.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name strange.miceliux.com Platform Linux strange.miceliux.com 3.13.6-200.fc20.x86_64 #1 SMP Fri Mar 7 17:02:28 UTC 2014 x86_64 x86_64 Alert Count 1 First Seen 2014-03-13 21:58:42 CET Last Seen 2014-03-13 21:58:42 CET Local ID c29e30eb-e2df-4334-ba46-391073bc942d Raw Audit Messages type=AVC msg=audit(1394744322.637:219754): avc: denied { read } for pid=867 comm="postconf" name="unix" dev="proc" ino=4026532002 scontext=system_u:system_r:mail_munin_plugin_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file type=SYSCALL msg=audit(1394744322.637:219754): arch=x86_64 syscall=access success=no exit=EACCES a0=7fff596d96c0 a1=4 a2=7fff596d96ce a3=400 items=0 ppid=866 pid=867 auid=4294967295 uid=0 gid=99 euid=0 suid=0 fsuid=0 egid=99 sgid=99 fsgid=99 ses=4294967295 tty=(none) comm=postconf exe=/usr/sbin/postconf subj=system_u:system_r:mail_munin_plugin_t:s0 key=(null) Hash: postconf,mail_munin_plugin_t,proc_net_t,file,read
commit d750de316c9fd196bfd6333084940f2086afff22 Author: Miroslav Grepl <mgrepl> Date: Fri Mar 14 10:09:14 2014 +0100 Allow munin mail plugins to read network systcl
selinux-policy-3.12.1-149.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-149.fc20
Package selinux-policy-3.12.1-149.fc20: * should fix your issue, * was pushed to the Fedora 20 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-149.fc20' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2014-4604/selinux-policy-3.12.1-149.fc20 then log in and leave karma (feedback).
I continue to see these AVCs with: selinux-policy-3.12.1-149.fc20.noarch selinux-policy-targeted-3.12.1-149.fc20.noarch SELinux is preventing /usr/sbin/postconf from create access on the udp_socket . ***** Plugin catchall (100. confidence) suggests ************************** If cree que de manera predeterminada, postconf debería permitir acceso create sobre udp_socket. Then debería reportar esto como un error. Puede generar un módulo de política local para permitir este acceso. Do permita el acceso momentáneamente executando: # grep postconf /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:mail_munin_plugin_t:s0 Target Context system_u:system_r:mail_munin_plugin_t:s0 Target Objects [ udp_socket ] Source postconf Source Path /usr/sbin/postconf Port <Unknown> Host <removed> Source RPM Packages postfix-2.10.3-1.fc20.x86_64 Target RPM Packages Policy RPM selinux-policy-3.12.1-149.fc20.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name <removed> Platform Linux <removed> 3.14.0-1.fc20.x86_64 #1 SMP Sat Apr 5 15:41:16 CEST 2014 x86_64 x86_64 Alert Count 10468 First Seen 2014-03-13 21:58:42 CET Last Seen 2014-04-09 12:55:09 CEST Local ID 4772fb3e-6811-4e48-9241-bcddfdea53c5 Raw Audit Messages type=AVC msg=audit(1397040909.817:12065): avc: denied { create } for pid=27937 comm="postconf" scontext=system_u:system_r:mail_munin_plugin_t:s0 tcontext=system_u:system_r:mail_munin_plugin_t:s0 tclass=udp_socket type=SYSCALL msg=audit(1397040909.817:12065): arch=x86_64 syscall=socket success=no exit=EACCES a0=2 a1=80002 a2=0 a3=400 items=0 ppid=27936 pid=27937 auid=4294967295 uid=0 gid=99 euid=0 suid=0 fsuid=0 egid=99 sgid=99 fsgid=99 tty=(none) ses=4294967295 comm=postconf exe=/usr/sbin/postconf subj=system_u:system_r:mail_munin_plugin_t:s0 key=(null) Hash: postconf,mail_munin_plugin_t,mail_munin_plugin_t,udp_socket,create ----------------------------- SELinux is preventing /usr/sbin/postconf from read access on the file . ***** Plugin catchall (100. confidence) suggests ************************** If cree que de manera predeterminada, postconf debería permitir acceso read sobre file. Then debería reportar esto como un error. Puede generar un módulo de política local para permitir este acceso. Do permita el acceso momentáneamente executando: # grep postconf /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:mail_munin_plugin_t:s0 Target Context system_u:object_r:proc_net_t:s0 Target Objects [ file ] Source postconf Source Path /usr/sbin/postconf Port <Unknown> Host <removed> Source RPM Packages postfix-2.10.3-1.fc20.x86_64 Target RPM Packages Policy RPM selinux-policy-3.12.1-149.fc20.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name <removed> Platform Linux <removed> 3.14.0-1.fc20.x86_64 #1 SMP Sat Apr 5 15:41:16 CEST 2014 x86_64 x86_64 Alert Count 14485 First Seen 2014-03-13 21:58:42 CET Last Seen 2014-04-09 12:55:09 CEST Local ID c29e30eb-e2df-4334-ba46-391073bc942d Raw Audit Messages type=AVC msg=audit(1397040909.817:12066): avc: denied { read } for pid=27937 comm="postconf" name="if_inet6" dev="proc" ino=4026532093 scontext=system_u:system_r:mail_munin_plugin_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file type=SYSCALL msg=audit(1397040909.817:12066): arch=x86_64 syscall=access success=no exit=EACCES a0=7fff2c673de0 a1=4 a2=7fff2c673df2 a3=400 items=0 ppid=27936 pid=27937 auid=4294967295 uid=0 gid=99 euid=0 suid=0 fsuid=0 egid=99 sgid=99 fsgid=99 tty=(none) ses=4294967295 comm=postconf exe=/usr/sbin/postconf subj=system_u:system_r:mail_munin_plugin_t:s0 key=(null) Hash: postconf,mail_munin_plugin_t,proc_net_t,file,read
selinux-policy-3.12.1-149.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
Sorry, I continue to see the same AVCs. See comment #4 selinux-policy-3.12.1-149.fc20.noarch selinux-policy-targeted-3.12.1-149.fc20.noarch
selinux-policy-3.12.1-158.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-158.fc20
Package selinux-policy-3.12.1-158.fc20: * should fix your issue, * was pushed to the Fedora 20 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-158.fc20' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2014-5660/selinux-policy-3.12.1-158.fc20 then log in and leave karma (feedback).
selinux-policy-3.12.1-158.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.