Created attachment 407475 [details]
ids.te = my selinux policy

Description of problem:

Two problems I found with psad :

1. The selinux policy does not allow psad to start or function properly if (targeted) selinux is enforced.

2. The init script does not function properly. 


Version-Release number of selected component (if applicable):

psad 
version 2.1.3 
release 3.fc12

How reproducible:

Always.

Steps to Reproduce:
1. Install psad.
2. With selinux, targeted policy, in enforcing mode try to start psad.
  
Actual results:

psad fails to start

Expected results:

psad starts and is fully functional.

Additional info:

Watch out for some of the additional features such as:

1. from the psad config file "TCPWRAPPERS_BLOCK_METHOD    Y;"

with this option psad needs access to /etc/hosts.deny ;)

2. psad --sig-update 

Here is my policy for psad ( see attachment ids.te )

3. After adding that policy 

checkmodule -M -m -o ids.mod ids.te
semodule_package -o ids.pp -m ids.mod
semodule -i ids.pp

psad will start from the command line and functions properly with selinux in enforcing mode.

4. However, starting psad via a service continue to fail. No SELinux alerts or entries in the logs ( /var/log/audit/audit.log is empty).

service psad start => continues to fail

If selinux is put into permissive mode

service psad start => works.

If one then installs psad from teh psad tar ball (via install.pl) , psad then works normally, including as a service

service psad starts - with selinux in enforcing

HTH