This service will be undergoing maintenance at 00:00 UTC, 2016-08-01. It is expected to last about 1 hours
Bug 426741 - ntpdate SELinux security context is not correct in the initscript start of it
ntpdate SELinux security context is not correct in the initscript start of it
Status: CLOSED WORKSFORME
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: selinux-policy (Show other bugs)
5.1
All Linux
low Severity medium
: rc
: ---
Assigned To: Daniel Walsh
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2007-12-25 13:10 EST by R P Herrold
Modified: 2009-10-26 00:20 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-01-03 13:43:51 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description R P Herrold 2007-12-25 13:10:12 EST
Description of problem:

The start of the ntp initscript calls ntpdate to do a rough sync.  It lacks some
SELinux right to read /etc/services, and so always FAILs, and also emits SELinux
errors

Version-Release number of selected component (if applicable):

ALL recent versions and the 5.1 update refresh did not fix it.

How reproducible:

/sbin/service ntp stop
/sbin/service ntp start

yields:

[root@dhcp12 ~]# service ntpd start
ntpd: Synchronizing with time server:                      [FAILED]
Starting ntpd:                                             [  OK  ]
[root@dhcp12 ~]# dmesg

and the time is NOT synced.

The aditional message below is in  the audit log

Steps to Reproduce:

as above

Actual results:

The ntpdste sync is BLOCKED by SELinux permissions issues

Expected results:

For it NOT to emit the SELinux errors, and to set the clock, NEITHER of which
presently work

Additional info:

From the audit log:

audit(1198605648.611:18): avc:  denied  { read } for  pid=2603 comm="ntpdate"
name="services" dev=dm-0 ino=1638433 scontext=user_u:system_r:ntpd_t:s0
tcontext=system_u:object_r:rpm_script_tmp_t:s0 tclass=file
audit(1198605648.612:19): avc:  denied  { getattr } for  pid=2603 comm="ntpdate"
path="/etc/services" dev=dm-0 ino=1638433 scontext=user_u:system_r:ntpd_t:s0
tcontext=system_u:object_r:rpm_script_tmp_t:s0 tclass=file
Comment 1 Daniel Walsh 2008-01-03 13:43:51 EST
/etc/services is labeling incorrectly

restorecon /etc/services 

will fix.

An rpm postinstall script must have updated the file and created it with the
wrong context.  

Comment 2 Brian Pepple 2009-10-26 00:20:09 EDT
*** Bug 529520 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.