Bug 597309 - SELinux is preventing /usr/sbin/hald "name_bind" access .
SELinux is preventing /usr/sbin/hald "name_bind" access .
Status: CLOSED NOTABUG
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
13
i386 Linux
low Severity medium
: ---
: ---
Assigned To: Daniel Walsh
Fedora Extras Quality Assurance
setroubleshoot_trace_hash:497c9393718...
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2010-05-28 11:58 EDT by Jonathan Abbey
Modified: 2010-06-01 10:46 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-06-01 10:46:52 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jonathan Abbey 2010-05-28 11:58:24 EDT
Summary:

SELinux is preventing /usr/sbin/hald "name_bind" access .

Detailed Description:

SELinux denied access requested by hald. It is not expected that this access is
required by hald and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug
report.

Additional Information:

Source Context                system_u:system_r:hald_t:s0
Target Context                system_u:object_r:rndc_port_t:s0
Target Objects                None [ tcp_socket ]
Source                        hald
Source Path                   /usr/sbin/hald
Port                          953
Host                          (removed)
Source RPM Packages           hal-0.5.14-3.fc13
Target RPM Packages           
Policy RPM                    selinux-policy-3.7.19-15.fc13
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     (removed)
Platform                      Linux (removed)
                              2.6.33.4-95.fc13.i686.PAE #1 SMP Thu May 13
                              05:38:26 UTC 2010 i686 i686
Alert Count                   1
First Seen                    Fri 28 May 2010 10:34:13 AM CDT
Last Seen                     Fri 28 May 2010 10:34:13 AM CDT
Local ID                      245c058a-3270-4634-bdf9-cfd578eb6156
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1275060853.879:12): avc:  denied  { name_bind } for  pid=1201 comm="hald" src=953 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:rndc_port_t:s0 tclass=tcp_socket

node=(removed) type=SYSCALL msg=audit(1275060853.879:12): arch=40000003 syscall=102 success=no exit=-13 a0=2 a1=bf882508 a2=9c8ff4 a3=bf88251c items=0 ppid=1200 pid=1201 auid=4294967295 uid=68 gid=482 euid=68 suid=68 fsuid=68 egid=482 sgid=482 fsgid=482 tty=(none) ses=4294967295 comm="hald" exe="/usr/sbin/hald" subj=system_u:system_r:hald_t:s0 key=(null)



Hash String generated from  catchall,hald,hald_t,rndc_port_t,tcp_socket,name_bind
audit2allow suggests:

#============= hald_t ==============
allow hald_t rndc_port_t:tcp_socket name_bind;
Comment 1 Daniel Walsh 2010-05-28 12:04:13 EDT
Why is hal trying to bind to port 953?  Are you running in an NIS environment?
Comment 2 Jonathan Abbey 2010-05-28 12:38:14 EDT
I am, yes.
Comment 3 Jonathan Abbey 2010-05-28 12:40:21 EDT
I'm afraid I possibly reported this SEAlert before turning on allow_ypbind?

For some reason, the Fedora 13 installer does not toggle allow_ypbind on, even though I told the firstboot configurator that I wanted to use NIS authentication.. ;-(

I've got a separate bug filed on that one.
Comment 4 Daniel Walsh 2010-06-01 10:46:52 EDT
# setsebool -P allow_ypbind 1

Note You need to log in before you can comment on or make changes to this bug.