Bug 471882 - dhcpd omapi prohibited by SELinux policy
dhcpd omapi prohibited by SELinux policy
Status: CLOSED CURRENTRELEASE
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: selinux-policy (Show other bugs)
5.2
All Linux
medium Severity low
: rc
: ---
Assigned To: Daniel Walsh
BaseOS QE
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2008-11-17 09:26 EST by Frode Nordahl
Modified: 2012-10-16 07:44 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-02-07 06:48:49 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)
SELinux Policy Module to make OMAPI work in ISC DHCPD (180 bytes, text/plain)
2008-11-17 09:26 EST, Frode Nordahl
no flags Details

  None (edit)
Description Frode Nordahl 2008-11-17 09:26:21 EST
Created attachment 323764 [details]
SELinux Policy Module to make OMAPI work in ISC DHCPD

Description of problem:
ISC DHCPD has the ability to be remote controlled through the use of OMAPI. However the default SELinux policy does not allow DHCPD to bind to the OMAPI port.

How reproducible:
100%

Steps to Reproduce:
1. Set up a RHEL system with SELinux enforcing targeted mode.
2. Set up ISC DHCPD with the following statement in /etc/dhcpd.conf: "omapi-port 7911;"
3. Start ISC-DHCPD
  
Actual results:
OMAPI communication is not possible, and ISC-DHCPD provokes the following error messages:

syslog:
dhcpd: Can't start OMAPI protocol: unexpected error

dmesg / audit:
audit(): avc:  denied  { name_bind } for  pid=X comm="dhcpd" src=7911 scontext=root:system_r:dhcpd_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket


Expected results:
No errors and working omapi communication.

Additional info:
I have attached the SELinux security policy module we use to make it work here.
Comment 1 Daniel Walsh 2008-11-17 14:52:40 EST
Fixed in the U3 policy,
selinux-policy-2.4.6-187.el5

You can grab a preview on

http://people.redhat.com/dwalsh/SELinux/RHEL5

Note You need to log in before you can comment on or make changes to this bug.