Bug 246220 - Squid fails to start due to selinux
Summary: Squid fails to start due to selinux
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted
Version: 7
Hardware: x86_64
OS: Linux
low
medium
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Ben Levenson
URL:
Whiteboard:
Keywords:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2007-06-29 11:18 UTC by Daniel Rowe
Modified: 2007-11-30 22:12 UTC (History)
1 user (show)

(edit)
Clone Of:
(edit)
Last Closed: 2007-07-08 03:32:05 UTC


Attachments (Terms of Use)

Description Daniel Rowe 2007-06-29 11:18:39 UTC
Description of problem:

Squid will not start due to selinux problem:

avc: denied { read, write } for comm="squid" dev=tmpfs egid=23 euid=23
exe="/usr/sbin/squid" exit=-13 fsgid=23 fsuid=23 gid=23 items=0
name="SYSV002f8802" path=2F535953563030326638383032202864656C6574656429 pid=3042
scontext=system_u:system_r:squid_t:s0 sgid=23 subj=system_u:system_r:squid_t:s0
suid=0 tclass=file tcontext=system_u:object_r:tmpfs_t:s0 tty=(none) uid=23 

Version-Release number of selected component (if applicable):

squid-2.6.STABLE13-1.fc7
selinux-policy-targeted-2.6.4-21.fc7
selinux-policy-2.6.4-21.fc7

How reproducible:

Every time.

Steps to Reproduce:

Try and start squid.
  
Actual results:

Fail to start with messages in audit.

Expected results:

Should start.

Comment 1 Gianluca Varisco 2007-06-29 13:51:30 UTC
The file context (fcontext) for /usr/sbin/squid seems wrong; can you attach
there the output of:

# ls -Z `which squid`

It should be:

-rwxr-xr-x  root root system_u:object_r:squid_exec_t   /usr/sbin/squid

So, if it's wrong, open a terminal and type:

# restorecon /usr/sbin/squid

After that restart squid and it should work.

Comment 2 Daniel Rowe 2007-06-30 06:18:02 UTC
[root@bajor ~]# ls -Z `which squid`
-rwxr-xr-x  root root system_u:object_r:squid_exec_t   /usr/sbin/squid
[root@bajor ~]# restorecon /usr/sbin/squid
[root@bajor ~]# ls -Z `which squid`
-rwxr-xr-x  root root system_u:object_r:squid_exec_t   /usr/sbin/squid
[root@bajor ~]# service squid start
Starting squid: ....................                       [FAILED]

avc: denied { read, write } for comm="squid" dev=tmpfs egid=23 euid=23
exe="/usr/sbin/squid" exit=-13 fsgid=23 fsuid=23 gid=23 items=0
name="SYSV00479802" path=2F535953563030343739383032202864656C6574656429 pid=4582
scontext=user_u:system_r:squid_t:s0 sgid=23 subj=user_u:system_r:squid_t:s0
suid=0 tclass=file tcontext=user_u:object_r:tmpfs_t:s0 tty=(none) uid=23 

Comment 3 Daniel Walsh 2007-07-02 01:15:33 UTC
Fixed in selinux-policy-2.6.4-24

Comment 4 Daniel Rowe 2007-07-08 03:32:05 UTC
Confirmed fixed:

selinux-policy-2.6.4-25.fc7
selinux-policy-targeted-2.6.4-25.fc7


Note You need to log in before you can comment on or make changes to this bug.