Bug 169434 - selinux prevents webalizer running from cron
selinux prevents webalizer running from cron
Product: Fedora
Classification: Fedora
Component: webalizer (Show other bugs)
i686 Linux
medium Severity medium
: ---
: ---
Assigned To: Joe Orton
Depends On:
  Show dependency treegraph
Reported: 2005-09-28 06:13 EDT by Adam
Modified: 2008-05-06 11:31 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2008-05-06 11:31:35 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Adam 2005-09-28 06:13:30 EDT
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.10) Gecko/20050716 Firefox/1.0.6

Description of problem:
I get the following in my audit.log every time that webalizer tries to run

type=AVC msg=audit(1127901301.330:87706): avc:  denied  { search } for  pid=32347 comm="webalizer" name="/" dev=dm-3 ino=2 sc
ontext=user_u:system_r:webalizer_t tcontext=user_u:object_r:user_home_dir_t tclass=dir
type=SYSCALL msg=audit(1127901301.330:87706): arch=40000003 syscall=33 success=no exit=-13 a0=8060468 a1=0 a2=ad7ff4 a3=80617
f0 items=1 pid=32347 auid=504 uid=504 gid=504 euid=504 suid=504 fsuid=504 egid=504 sgid=504 fsgid=504 comm="webalizer" exe="/
type=CWD msg=audit(1127901301.330:87706):  cwd="/home/mud"
type=PATH msg=audit(1127901301.330:87706): item=0 name="webalizer.conf" flags=401  inode=2 dev=fd:03 mode=042775 ouid=504 ogi
d=504 rdev=00:00

The audit2allow program suggests
# audit2allow -l -i audit.log
allow webalizer_t home_root_t:dir search;
allow webalizer_t user_home_dir_t:dir search;

Version-Release number of selected component (if applicable):
webalizer-2.01_10-28, selinux-policy-targeted-1.27.1-2.2

How reproducible:

Steps to Reproduce:
1. Add cron job to run webalizer

Actual Results:  Webalizer does not run

Expected Results:  Webalizer should run

Additional info:
Comment 1 Jarkko 2006-04-07 08:57:09 EDT
Um, actually I think selinux prevents webalizer to be used at all (FC5). At
least I had to set enforcing to permissive to be able to use webalizer (i was
debugging it, so i ran it manually in a local directory - not from cron - and
did not use the default conf file).
Comment 2 Steve Snodgrass 2006-05-21 09:57:00 EDT
I'm also seeing this on FC5 - selinux logs hundreds of these errors:

May 17 04:02:01 centauri kernel: audit(1147852921.955:12): avc:  denied  {
create } for  pid=3323 comm="webalizer" scontext=user_u:system_r:webalizer_t:s0
tcontext=user_u:system_r:webalizer_t:s0 tclass=netlink_route_socket

[root@centauri log]# rpm -q webalizer selinux-policy-targeted

If it makes any difference, the system in question is a XenU domain.
Comment 3 Daniel Hammer 2006-10-06 02:30:57 EDT
I experience the same. Lots of avc entries in /var/log/messages of type:

Oct  6 04:04:22 aleph kernel: audit(1160100261.928:37316): avc:  denied  {
create } for  pid=14438 comm="webalizer" scontext=user_u:system_r:webalizer_t:s0
tcontext=user_u:system_r:webalizer_t:s0 tclass=netlink_route_socket
Comment 4 Stephen John Smoogen 2007-01-01 20:20:52 EST
This bug is in FC6 and should be fixed for both this and RHEL-5
Comment 5 Christian Iseli 2007-01-22 06:26:43 EST
This report targets the FC3 or FC4 products, which have now been EOL'd.

Could you please check that it still applies to a current Fedora release, and
either update the target product or close it ?

Comment 6 Stephen John Smoogen 2007-01-22 11:34:06 EST
I have updated the target product. The problem is still seen on my FC6 system
that I installed with. I am guessing that the product may need a boolean policy
added to it.
Comment 7 Bug Zapper 2008-04-03 22:02:21 EDT
Fedora apologizes that these issues have not been resolved yet. We're
sorry it's taken so long for your bug to be properly triaged and acted
on. We appreciate the time you took to report this issue and want to
make sure no important bugs slip through the cracks.

If you're currently running a version of Fedora Core between 1 and 6,
please note that Fedora no longer maintains these releases. We strongly
encourage you to upgrade to a current Fedora release. In order to
refocus our efforts as a project we are flagging all of the open bugs
for releases which are no longer maintained and closing them.

If this bug is still open against Fedora Core 1 through 6, thirty days
from now, it will be closed 'WONTFIX'. If you can reporduce this bug in
the latest Fedora version, please change to the respective version. If
you are unable to do this, please add a comment to this bug requesting
the change.

Thanks for your help, and we apologize again that we haven't handled
these issues to this point.

The process we are following is outlined here:

We will be following the process here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping to ensure this
doesn't happen again.

And if you'd like to join the bug triage team to help make things
better, check out http://fedoraproject.org/wiki/BugZappers
Comment 8 Bug Zapper 2008-05-06 11:31:33 EDT
This bug is open for a Fedora version that is no longer maintained and
will not be fixed by Fedora. Therefore we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen thus bug against that version.

Thank you for reporting this bug and we are sorry it could not be fixed.

Note You need to log in before you can comment on or make changes to this bug.