Description of problem: If SElinux is in enforcing mode, you can not start shorewall6 because it needs to execute '/usr/share/shorewall/compiler.pl'. In syslog I see this error message: "ERROR: Shorewall6 requires the shorewall package which is not installed" audit2allow < /var/log/audit/audit.log #============= shorewall_t ============== allow shorewall_t usr_t:file execute; Version-Release number of selected component (if applicable): shorewall-4.4.4.2-3.fc12.noarch shorewall6-lite-4.4.4.2-3.fc12.noarch shorewall6-4.4.4.2-3.fc12.noarch Steps to Reproduce: 1. Set SElinux to enforcing 2. configure shorewall6 3. service shorewall start
Labelling /usr/share/shorewall/compiler.pl as bin_t would probably fix this. Perhaps a better place for this script would be /usr/libexec/shorewall ?
Have reassigned bug to selinux, although Paul's suggestion of moving the compiler to /usr/libexec/shorewall has merit as well. Dan - thoughts?
It is fine where it is but now we have labeling of /usr/share/shorewall/compiler\.pl -- gen_context(system_u:object_r:bin_t,s0) /usr/share/shorewall/configpath -- gen_context(system_u:object_r:bin_t,s0) /usr/share/shorewall-perl(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/share/shorewall-shell(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/share/shorewall-lite(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/share/shorewall6-lite(/.*)? gen_context(system_u:object_r:bin_t,s0) I would prefer to you create a /usr/share/shorewall/scripts or bin and put the scripts as subdirs of this. Then I could just label everything bin_t and you can add new executables without having to worry about selinux labeling. Miroslav add /usr/share/shorewall/compiler\.pl -- gen_context(system_u:object_r:bin_t,s0)
Fixed in selinux-policy-3.6.32-86.fc12
selinux-policy-3.6.32-89.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-89.fc12
selinux-policy-3.6.32-89.fc12 has been pushed to the Fedora 12 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2010-1836
selinux-policy-3.6.32-89.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.