Bug 200476 - avc denied when using squid max_filedesc option
Summary: avc denied when using squid max_filedesc option
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted
Version: 5
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2006-07-28 01:36 UTC by Zing
Modified: 2008-05-01 15:38 UTC (History)
0 users

Fixed In Version: Current
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2007-03-28 20:03:50 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Zing 2006-07-28 01:36:20 UTC
Description of problem:
Trying to use the max_filedesc option in /etc/squid/squid.conf
will fail against the squid selinux policy.

Version-Release number of selected component (if applicable):
squid-2.5.STABLE14-2.FC5
selinux-policy-targeted-2.3.2-1.fc5

How reproducible:
always

Steps to Reproduce:
1. set "max_filedesc 8192" in squid.conf
2. start squid
  
Actual results:
squid fails to start

Expected results:
squid should start

Additional info:
here's the local.te that I generated from audit2allow
and using successfully:

========= local.te =========
module local 1.0;

require {
	class capability sys_resource;
	class process setrlimit;
	type squid_t; 
	role system_r; 
};

allow squid_t self:capability sys_resource;
allow squid_t self:process setrlimit;
============== end ==============

Comment 1 Daniel Walsh 2006-08-11 19:26:54 UTC
Fixed in  selinux-policy-2.3.6-3.fc5

Comment 2 Daniel Walsh 2007-03-28 20:03:50 UTC
Closing bugs



Note You need to log in before you can comment on or make changes to this bug.