Bug 199082 - selinux stops radiusd
selinux stops radiusd
Product: Fedora
Classification: Fedora
Component: freeradius (Show other bugs)
All Linux
medium Severity high
: ---
: ---
Assigned To: Thomas Woerner
Depends On:
  Show dependency treegraph
Reported: 2006-07-17 03:26 EDT by Frank Büttner
Modified: 2007-11-30 17:11 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2007-08-28 09:04:12 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Frank Büttner 2006-07-17 03:26:01 EDT
Description of problem:
When selinux is in enforce mode the radius daemon start will fail

Version-Release number of selected component (if applicable):

How reproducible:
run service radiusd start
Actual results:
start fail's

Expected results:
running radiusd

Additional info:
error at audit:
Jul 17 09:16:14 kernel: audit(1153120574.167:12): avc:  denied  { write } for 
pid=2442 comm=radiusd name="db.daily" dev=md1 ino=7858082
scontext=system_u:system_r:radiusd_t tcontext=system_u:object_r:radiusd_etc_t
Comment 1 Daniel Walsh 2006-07-17 10:30:50 EDT
I am adding the ability to write db.daily in the /etc/raddb directory.  Are
there any others that it needs to be able to write?

Having configuration data in the same directory as writable data is somewhat
hard to deal with for SELinux and would be better if this was in a subdirectory.
Comment 2 Frank Büttner 2006-07-17 11:23:37 EDT
It is no problem to put the file db.dayly in /var but then you must tell me and
the maintainer of the radius package where the file shut be live. So that
selinux will not block it. There can be mutch other files that will be write
able. This will depend of the parts of the daemon that are enabled. I think it
will be better  to make an general change for radius so that all files that need
write able must live in /var/radius or somethink.
Comment 3 Thomas Woerner 2007-08-28 09:04:12 EDT
The db files moved to /var/lib/raddb in package freeradius-1.1.7-1.

Note You need to log in before you can comment on or make changes to this bug.