Bug 216251 - avc denial when writing to ntp drift file
avc denial when writing to ntp drift file
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Daniel Walsh
Ben Levenson
Depends On:
  Show dependency treegraph
Reported: 2006-11-17 18:51 EST by James Morris
Modified: 2007-11-30 17:11 EST (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2006-11-20 13:57:55 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description James Morris 2006-11-17 18:51:30 EST
Description of problem:

When the ntp server tries to write to its drift file, it gets an avc denial.

Version-Release number of selected component (if applicable):

How reproducible:


Steps to Reproduce:
1. Boot system with ntp active
2. Wait
Actual results:

avc denial

Expected results:

no avc denial

Additional info:

ntpd[1563]: can't open /etc/ntp/ntp.drift.TEMP: Permission denied


type=AVC msg=audit(1163805144.503:65): avc:  denied  { write } for  pid=1563
comm="ntpd" name="ntp" dev=md1 ino=5342396 scontext
=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir
type=SYSCALL msg=audit(1163805144.503:65): arch=40000003 syscall=5 success=no
exit=-13 a0=95c6e50 a1=241 a2=1b6 a3=95c7890 items
=0 ppid=1 pid=1563 auid=4294967295 uid=38 gid=38 euid=38 suid=38 fsuid=38
egid=38 sgid=38 fsgid=38 tty=(none) comm="ntpd" exe="/
usr/sbin/ntpd" subj=system_u:system_r:ntpd_t:s0 key=(null)
Comment 1 Daniel Walsh 2006-11-20 13:57:55 EST
drift files are supposed to go in /var/lib/ntp.

Otherwize you need to write custom policy

In my /etc/ntp.conf it says.

# Drift file.  Put this in a directory which the daemon can write to.
# No symbolic links allowed, either, since the daemon updates the file
# by creating a temporary in the same directory and then rename()'ing
# it to the file.
driftfile /var/lib/ntp/drift

Note You need to log in before you can comment on or make changes to this bug.