Red Hat Bugzilla – Bug 237247
SELinux Amavisd/Clamd denial
Last modified: 2008-08-02 19:40:36 EDT
Description of problem: The clamd.amavisd service runs as the amavis user under the clamd_t context. Since it is installed as part of amavisd-new, it should be able to run with access to some areas labeled as amavis_t. Version-Release number of selected component (if applicable): selinux-policy-2.4.6-57.fc6 amavisd-new-2.4.4-2.fc6 clamav-server-sysv-0.88.7-2.fc6 clamav-update-0.88.7-2.fc6 clamav-data-0.88.7-2.fc6 clamav-server-0.88.7-2.fc6 clamav-lib-0.88.7-2.fc6 How reproducible: Every time Steps to Reproduce: 1. Start amavisd 2. Start clamd.amavisd Actual results: avc: denied { create } for comm="clamd.amavisd" dev=sda2 egid=104 euid=103 exe="/usr/sbin/clamd" exit=5 fsgid=104 fsuid=103 gid=104 items=0 name="clamd.pid" pid=3137 scontext=system_u:system_r:clamd_t:s0 sgid=104 subj=system_u:system_r:clamd_t:s0 suid=103 tclass=file tcontext=system_u:object_r:amavis_var_run_t:s0 tty=(none) uid=103 Expected results: No denial should exist Additional info: Running in permissive mode.
So clamd is trying to create its pid file under /var/run/amavis?
yes, it want's to create it's clamd.pid file there. it wants create and getattr perms. i assume this is so it can create the file, then check if it's there to determine if it's running (for init, i think).
Fixed in selinux-policy-2.4.6-69
Fedora apologizes that these issues have not been resolved yet. We're sorry it's taken so long for your bug to be properly triaged and acted on. We appreciate the time you took to report this issue and want to make sure no important bugs slip through the cracks. If you're currently running a version of Fedora Core between 1 and 6, please note that Fedora no longer maintains these releases. We strongly encourage you to upgrade to a current Fedora release. In order to refocus our efforts as a project we are flagging all of the open bugs for releases which are no longer maintained and closing them. http://fedoraproject.org/wiki/LifeCycle/EOL If this bug is still open against Fedora Core 1 through 6, thirty days from now, it will be closed 'WONTFIX'. If you can reporduce this bug in the latest Fedora version, please change to the respective version. If you are unable to do this, please add a comment to this bug requesting the change. Thanks for your help, and we apologize again that we haven't handled these issues to this point. The process we are following is outlined here: http://fedoraproject.org/wiki/BugZappers/F9CleanUp We will be following the process here: http://fedoraproject.org/wiki/BugZappers/HouseKeeping to ensure this doesn't happen again. And if you'd like to join the bug triage team to help make things better, check out http://fedoraproject.org/wiki/BugZappers