Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: my be related with bug 1013372 on a fedora 20 install and launch couchdb OK replicate a db I have on a couchdb webserver issue when trying to get a view on that local replicated db SELinux is preventing /usr/lib64/erlang/lib/couch-1.5.0/priv/couchjs from using the 'execmem' accesses on a process. ***** Plugin catchall (100. confidence) suggests ************************** If vous pensez que couchjs devrait être autorisé à accéder execmem sur les processus étiquetés rabbitmq_beam_t par défaut. Then vous devriez rapporter ceci en tant qu'anomalie. Vous pouvez générer un module de stratégie local pour autoriser cet accès. Do autoriser cet accès pour le moment en exécutant : # grep couchjs /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:rabbitmq_beam_t:s0 Target Context system_u:system_r:rabbitmq_beam_t:s0 Target Objects [ process ] Source couchjs Source Path /usr/lib64/erlang/lib/couch-1.5.0/priv/couchjs Port <Unknown> Host (removed) Source RPM Packages couchdb-1.5.0-1.fc20.x86_64 Target RPM Packages Policy RPM selinux-policy-3.12.1-166.fc20.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 3.14.8-200.fc20.x86_64 #1 SMP Mon Jun 16 21:57:53 UTC 2014 x86_64 x86_64 Alert Count 1500 First Seen 2014-06-26 11:11:00 CEST Last Seen 2014-06-26 11:32:02 CEST Local ID 360669d5-7346-4da3-9911-7a38130c1620 Raw Audit Messages type=AVC msg=audit(1403775122.967:15300): avc: denied { execmem } for pid=9540 comm="couchjs" scontext=system_u:system_r:rabbitmq_beam_t:s0 tcontext=system_u:system_r:rabbitmq_beam_t:s0 tclass=process type=SYSCALL msg=audit(1403775122.967:15300): arch=x86_64 syscall=mmap success=yes exit=140365948039168 a0=0 a1=10000 a2=7 a3=22 items=0 ppid=9508 pid=9540 auid=4294967295 uid=991 gid=989 euid=991 suid=991 fsuid=991 egid=989 sgid=989 fsgid=989 tty=(none) ses=4294967295 comm=couchjs exe=/usr/lib64/erlang/lib/couch-1.5.0/priv/couchjs subj=system_u:system_r:rabbitmq_beam_t:s0 key=(null) Hash: couchjs,rabbitmq_beam_t,rabbitmq_beam_t,process,execmem Additional info: reporter: libreport-2.2.2 hashmarkername: setroubleshoot kernel: 3.14.8-200.fc20.x86_64 type: libreport
I fix and changed lot of issues related to couchdb,rabbitmq,ejabberd, now I close this, then it's appears again feel free to contact me.
Could anyone know, why is execmem needed?
commit 019ea58f76d9a70ee4c9ceab34319bfab978b02a Author: Lukas Vrabec <lvrabec> Date: Mon Dec 1 12:49:51 2014 +0100 Dontaudit couchdb to list /var commit 933e40ab94b18fdaca471cfb712f6a2228caf77b Merge: 7048265 7b8271e Author: Lukas Vrabec <wrabcak.github.com> Date: Mon Dec 1 12:27:08 2014 +0100 Merge pull request #6 from wtogami/couchdb_policy_fix Couchdb policy fixes
selinux-policy-3.12.1-196.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-196.fc20
Package selinux-policy-3.12.1-196.fc20: * should fix your issue, * was pushed to the Fedora 20 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-196.fc20' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2014-16229/selinux-policy-3.12.1-196.fc20 then log in and leave karma (feedback).
selinux-policy-3.12.1-196.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.