Bugzilla (bugzilla.redhat.com) will be under maintenance for infrastructure upgrades and will not be available on July 31st between 12:30 AM - 05:30 AM UTC. We appreciate your understanding and patience. You can follow status.redhat.com for details.
Bug 1409963 - SELinux is preventing dhcpd from using the 'fowner' capabilities.
Summary: SELinux is preventing dhcpd from using the 'fowner' capabilities.
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 25
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Lukas Vrabec
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:19fe146c0b5635bdd31af116825...
: 1385210 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-01-04 03:06 UTC by Chris Caudle
Modified: 2017-01-11 07:24 UTC (History)
8 users (show)

Fixed In Version: selinux-policy-3.13.1-225.6.fc25
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-01-11 07:24:56 UTC
Type: ---


Attachments (Terms of Use)

Description Chris Caudle 2017-01-04 03:06:51 UTC
Description of problem:
modified /etc/dhcp/dhcpd.conf and restarted dhcpd.  SELinux warnings about fowner 
capability do not seem to prevent dhcpd from working properly.
SELinux is preventing dhcpd from using the 'fowner' capabilities.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that dhcpd should have the fowner capability by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'dhcpd' --raw | audit2allow -M my-dhcpd
# semodule -X 300 -i my-dhcpd.pp

Additional Information:
Source Context                system_u:system_r:dhcpd_t:s0
Target Context                system_u:system_r:dhcpd_t:s0
Target Objects                Unknown [ capability ]
Source                        dhcpd
Source Path                   dhcpd
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-225.3.fc25.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 4.8.15-300.fc25.x86_64 #1 SMP Thu
                              Dec 15 23:10:23 UTC 2016 x86_64 x86_64
Alert Count                   3
First Seen                    2017-01-02 15:23:11 CST
Last Seen                     2017-01-03 20:01:20 CST
Local ID                      8411ce3f-6264-428b-8eb1-f0f4c41a7ba5

Raw Audit Messages
type=AVC msg=audit(1483495280.31:777): avc:  denied  { fowner } for  pid=25117 comm="dhcpd" capability=3  scontext=system_u:system_r:dhcpd_t:s0 tcontext=system_u:system_r:dhcpd_t:s0 tclass=capability permissive=0


Hash: dhcpd,dhcpd_t,dhcpd_t,capability,fowner

Version-Release number of selected component:
selinux-policy-3.13.1-225.3.fc25.noarch

Additional info:
reporter:       libreport-2.8.0
hashmarkername: setroubleshoot
kernel:         4.8.15-300.fc25.x86_64
type:           libreport

Potential duplicate: bug 1385210

Comment 1 Lukas Vrabec 2017-01-08 20:18:21 UTC
*** Bug 1385210 has been marked as a duplicate of this bug. ***

Comment 2 Fedora Update System 2017-01-08 22:24:17 UTC
selinux-policy-3.13.1-225.6.fc25 has been submitted as an update to Fedora 25. https://bodhi.fedoraproject.org/updates/FEDORA-2017-66d634473a

Comment 3 Fedora Update System 2017-01-10 03:26:47 UTC
selinux-policy-3.13.1-225.6.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-66d634473a

Comment 4 Fedora Update System 2017-01-11 07:24:56 UTC
selinux-policy-3.13.1-225.6.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.