Description of problem:

When FreeRADIUS starts, it calls ptrace on itself to determine if it's running under a debugger. That is later used to decide whether to break into the debugger, or simply exit, when a critical error occurs.

However, SELinux policy prevents it from executing ptrace:

    type=AVC msg=audit(1487944609.686:744): avc:  denied  { ptrace } for  pid=15592 comm="radiusd" scontext=system_u:system_r:radiusd_t:s0 tcontext=system_u:system_r:radiusd_t:s0 tclass=process
    type=SYSCALL msg=audit(1487944609.686:744): arch=c000003e syscall=101 success=no exit=-13 a0=10 a1=3ce6 a2=0 a3=0 items=0 ppid=15590 pid=15592 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="radiusd" exe="/usr/sbin/radiusd" subj=system_u:system_r:radiusd_t:s0 key
=(null)

Since ptrace reports the same error code for both permission denied and already being traced, FreeRADIUS assumes it is already running under a debugger. That results in FreeRADIUS killing itself with SIGTRAP, when it attempts to break into the non-existent debugger, upon a critical error.

Since FreeRADIUS drops into a dedicated uid/gid after startup, there doesn't seem to be much danger of letting it use the ptrace call.

Please consider changing the policy to let FreeRADIUS execute ptrace, perhaps only when running as root.

Version-Release number of selected component (if applicable):
selinux-policy-3.13.1-102.el7_3.13.noarch
freeradius-3.0.12-2.el7.x86_64

How reproducible:
Always

Steps to Reproduce:

    sudo service radiusd start
    sudo grep 'denied.*ptrace.*radiusd' /var/log/audit/audit.log | tail -n1

Actual results:

    type=AVC msg=audit(1487944609.686:744): avc:  denied  { ptrace } for  pid=15592 comm="radiusd" scontext=system_u:system_r:radiusd_t:s0 tcontext=system_u:system_r:radiusd_t:s0 tclass=process

Expected results:

No output

Additional info:

Code calling ptrace in FreeRADIUS:
https://github.com/FreeRADIUS/freeradius-server/blob/release_3_0_12/src/lib/debug.c#L120