Bug 584870 - SELinux is preventing /bin/ln "link" access on slapd.pid.
Summary: SELinux is preventing /bin/ln "link" access on slapd.pid.
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: openldap
Version: 6.0
Hardware: x86_64
OS: Linux
Target Milestone: rc
: ---
Assignee: Jan Zeleny
QA Contact: Ondrej Moriš
Whiteboard: setroubleshoot_trace_hash:0e15968cc8c...
Depends On:
TreeView+ depends on / blocked
Reported: 2010-04-22 15:40 UTC by Matěj Cepl
Modified: 2010-07-02 19:39 UTC (History)
3 users (show)

Fixed In Version: openldap-2.4.19-10.el6
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2010-07-02 19:39:21 UTC
Target Upstream Version:

Attachments (Terms of Use)

Description Matěj Cepl 2010-04-22 15:40:37 UTC

SELinux is preventing /bin/ln "link" access on slapd.pid.

Podrobný popis:

[SELinux je v tolerantním režimu. Přístup byl povolen.]

SELinux denied access requested by ln. It is not expected that this access is
required by ln and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.

Povolení přístupu:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug

Další informace:

Kontext zdroje                staff_u:system_r:initrc_t:s0
Kontext cíle                 staff_u:object_r:slapd_var_run_t:s0
Objekty cíle                 slapd.pid [ file ]
Zdroj                         ln
Cesta zdroje                  /bin/ln
Port                          <Neznámé>
Počítač                    (removed)
RPM balíčky zdroje          coreutils-8.4-6.el6
RPM balíčky cíle           
RPM politiky                  selinux-policy-3.7.19-1.el6
Selinux povolen               True
Typ politiky                  targeted
Vynucovací režim            Permissive
Název zásuvného modulu     catchall
Název počítače            (removed)
Platforma                     Linux (removed) 2.6.32-21.el6.x86_64 #1
                              SMP Mon Apr 12 16:07:36 EDT 2010 x86_64 x86_64
Počet upozornění           5
Poprvé viděno               Čt 22. duben 2010, 17:14:19 CEST
Naposledy viděno             Čt 22. duben 2010, 17:39:27 CEST
Místní ID                   6428fe9d-f83f-4ed1-aaa5-43397787603b
Čísla řádků              

Původní zprávy auditu      

node=(removed) type=AVC msg=audit(1271950767.41:1430): avc:  denied  { link } for  pid=31791 comm="ln" name="slapd.pid" dev=dm-1 ino=131048 scontext=staff_u:system_r:initrc_t:s0 tcontext=staff_u:object_r:slapd_var_run_t:s0 tclass=file

node=(removed) type=SYSCALL msg=audit(1271950767.41:1430): arch=c000003e syscall=265 success=yes exit=0 a0=ffffffffffffff9c a1=7fff548cef4d a2=ffffffffffffff9c a3=7fff548cef69 items=0 ppid=31758 pid=31791 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=3 comm="ln" exe="/bin/ln" subj=staff_u:system_r:initrc_t:s0 key=(null)

Hash String generated from  catchall,ln,initrc_t,slapd_var_run_t,file,link
audit2allow suggests:

#============= initrc_t ==============
allow initrc_t slapd_var_run_t:file link;

Comment 1 Daniel Walsh 2010-04-22 15:47:45 UTC
Is there really any reason to have a hard link to a pid file in the init script?

Can't we just make the pidfile /var/run/openldap/slapd.pid
 and get rid of all the linking stuff?

Comment 3 RHEL Program Management 2010-04-22 18:23:41 UTC
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux major release.  Product Management has requested further
review of this request by Red Hat Engineering, for potential inclusion in a Red
Hat Enterprise Linux Major release.  This request is not yet committed for

Comment 4 Jan Zeleny 2010-04-23 07:35:54 UTC
Keeping /var/run/openldap/slapd.pid would be my first choice as well. It is indeed better from the view of both SELinux and openldap (because it has rw access rights to /var/run/openldap/).

This whole think came from QA/PM goal of making all init scripts and demons LSB compliant and their behavior similar. Can you recommend any way how to make /var/run/slapd.pid, which would be ok for SELinux?

Comment 5 Daniel Walsh 2010-04-23 14:09:05 UTC
Well making it a softlink would probably stop SELinux from complaining and probably closer to what you want anyways.

LSB has a say on where pid files are stored?  Why would it care...  The real problem for SELinux is just complaining about the hard link.

Comment 6 Jan Zeleny 2010-04-26 07:31:13 UTC
Thanks for the advice, I'll try to make it a soft link. LSB doesn't say specifically that it wants pid file directly in /var/run, but there are some references to it in Fedora Packaging guidelines and according to QA, it is convenient to have all pid files uniformly placed.

Comment 9 Ondrej Moriš 2010-05-31 11:14:22 UTC
I see no AVC running slapd via initscript on openldap-servers-2.4.19-11.el6 / RHEL6.0-20100527.2. But openldap-servers-2.4.19-9.el6 produce not AVC as well.

I've manually verified that hard link is now replaced by sym link in initscript.

Considering bug-fix to be successfully verified.

Comment 10 releng-rhel@redhat.com 2010-07-02 19:39:21 UTC
Red Hat Enterprise Linux Beta 2 is now available and should resolve
the problem described in this bug report. This report is therefore being closed
with a resolution of CURRENTRELEASE. You may reopen this bug report if the
solution does not work for you.

Note You need to log in before you can comment on or make changes to this bug.