Created attachment 407475 [details]
ids.te = my selinux policy
Description of problem:
Two problems I found with psad :
1. The selinux policy does not allow psad to start or function properly if (targeted) selinux is enforced.
2. The init script does not function properly.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Install psad.
2. With selinux, targeted policy, in enforcing mode try to start psad.
psad fails to start
psad starts and is fully functional.
Watch out for some of the additional features such as:
1. from the psad config file "TCPWRAPPERS_BLOCK_METHOD Y;"
with this option psad needs access to /etc/hosts.deny ;)
2. psad --sig-update
Here is my policy for psad ( see attachment ids.te )
3. After adding that policy
checkmodule -M -m -o ids.mod ids.te
semodule_package -o ids.pp -m ids.mod
semodule -i ids.pp
psad will start from the command line and functions properly with selinux in enforcing mode.
4. However, starting psad via a service continue to fail. No SELinux alerts or entries in the logs ( /var/log/audit/audit.log is empty).
service psad start => continues to fail
If selinux is put into permissive mode
service psad start => works.
If one then installs psad from teh psad tar ball (via install.pl) , psad then works normally, including as a service
service psad starts - with selinux in enforcing
psad-2.1.7-1.fc13 has been submitted as an update for Fedora 13.
psad-2.1.7-1.fc14 has been submitted as an update for Fedora 14.
psad-2.1.7-1.fc14 has been pushed to the Fedora 14 testing repository. If problems still persist, please make note of it in this bug report.
If you want to test the update, you can install it with
su -c 'yum --enablerepo=updates-testing update psad'. You can provide feedback for this update here: https://admin.fedoraproject.org/updates/psad-2.1.7-1.fc14
psad-2.1.7-1.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report.
psad-2.1.7-1.fc14 has been pushed to the Fedora 14 stable repository. If problems still persist, please make note of it in this bug report.