Red Hat Bugzilla – Bug 1256127
SELinux is preventing /usr/libexec/pcp/bin/pmwebd from 'execute' accesses on the file /usr/bin/bash.
Last modified: 2015-09-16 17:20:29 EDT
Description of problem: SELinux is preventing /usr/libexec/pcp/bin/pmwebd from 'execute' accesses on the file /usr/bin/bash. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that pmwebd should be allowed execute access on the bash file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep pmwebd /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:pcp_pmwebd_t:s0 Target Context system_u:object_r:shell_exec_t:s0 Target Objects /usr/bin/bash [ file ] Source pmwebd Source Path /usr/libexec/pcp/bin/pmwebd Port <Unknown> Host (removed) Source RPM Packages pcp-webapi-3.10.4-1.fc22.x86_64 Target RPM Packages bash-4.3.39-6.fc22.x86_64 Policy RPM selinux-policy-3.13.1-128.8.fc22.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 4.1.3-200.fc22.x86_64 #1 SMP Wed Jul 22 19:51:58 UTC 2015 x86_64 x86_64 Alert Count 417 First Seen 2015-08-11 11:20:56 JST Last Seen 2015-08-11 12:34:05 JST Local ID ed0aa31c-180e-455f-923c-5d1a9cd5be99 Raw Audit Messages type=AVC msg=audit(1439264045.185:3393): avc: denied { execute } for pid=24784 comm="pmwebd" name="bash" dev="dm-2" ino=2229816 scontext=system_u:system_r:pcp_pmwebd_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file permissive=0 type=SYSCALL msg=audit(1439264045.185:3393): arch=x86_64 syscall=execve success=no exit=EACCES a0=7f025846a393 a1=7ffebafa6620 a2=55914f9412c0 a3=7f0259962280 items=0 ppid=21347 pid=24784 auid=4294967295 uid=985 gid=974 euid=985 suid=985 fsuid=985 egid=974 sgid=974 fsgid=974 tty=(none) ses=4294967295 comm=pmwebd exe=/usr/libexec/pcp/bin/pmwebd subj=system_u:system_r:pcp_pmwebd_t:s0 key=(null) Hash: pmwebd,pcp_pmwebd_t,shell_exec_t,file,execute Version-Release number of selected component: selinux-policy-3.13.1-128.8.fc22.noarch Additional info: reporter: libreport-2.6.2 hashmarkername: setroubleshoot kernel: 4.1.4-200.fc22.x86_64 type: libreport
commit ebf1c596bc212058f1da4d1b009c14b9614feb8a Author: Lukas Vrabec <lvrabec@redhat.com> Date: Thu Aug 27 15:19:26 2015 +0200 Allow pmweb daemon to exec shell. BZ(1256127)
selinux-policy-3.13.1-128.13.fc22 has been submitted as an update to Fedora 22. https://bodhi.fedoraproject.org/updates/FEDORA-2015-15798
selinux-policy-3.13.1-128.13.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report.\nIf you want to test the update, you can install it with \n su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-15798
selinux-policy-3.13.1-128.13.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.