Bug 658849 - Please change fail2ban to not use gam_server
Summary: Please change fail2ban to not use gam_server
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: fail2ban
Version: rawhide
Hardware: Unspecified
OS: Unspecified
low
medium
Target Milestone: ---
Assignee: Axel Thimm
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-12-01 13:40 UTC by Daniel Walsh
Modified: 2011-04-25 20:55 UTC (History)
5 users (show)

Fixed In Version: fail2ban-0.8.4-27.fc14
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-04-18 04:03:25 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Daniel Walsh 2010-12-01 13:40:09 UTC
At least change it to default to polling.

https://bugzilla.redhat.com/show_bug.cgi?id=656127

In SELinux we are constantly getting birraged with hundreds of bugzillas about fail2ban using gam_server.  gam_server was developed for userspace apps not system services.  SELinux can not allow the access to fail2ban that would be required for gam_server access, so we end up telling everyone who triggers this error to move to a polling situation.

A better solution would be to modify fail2ban to use inotify to watch its config.

Comment 1 Ted X Toth 2011-03-31 17:35:08 UTC
I changed the /etc/fail2ban/jail.conf backend default to 'polling' and the AVCs appear to have stopped. I've only looked around a little but it appears that fail2ban is using the gam_server as an interface to inotify to watch files (more than just it's config) when it could use it directly. Maybe the developer could comment on the use of the gam_server.

Comment 2 Fedora Update System 2011-04-09 19:07:21 UTC
fail2ban-0.8.4-27.fc14 has been submitted as an update for Fedora 14.
https://admin.fedoraproject.org/updates/fail2ban-0.8.4-27.fc14

Comment 3 Fedora Update System 2011-04-09 19:07:53 UTC
fail2ban-0.8.4-27.fc13 has been submitted as an update for Fedora 13.
https://admin.fedoraproject.org/updates/fail2ban-0.8.4-27.fc13

Comment 4 Fedora Update System 2011-04-09 19:08:26 UTC
fail2ban-0.8.4-27.fc15 has been submitted as an update for Fedora 15.
https://admin.fedoraproject.org/updates/fail2ban-0.8.4-27.fc15

Comment 5 Fedora Update System 2011-04-10 01:44:10 UTC
Package fail2ban-0.8.4-27.fc15:
* should fix your issue,
* was pushed to the Fedora 15 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing fail2ban-0.8.4-27.fc15'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/fail2ban-0.8.4-27.fc15
then log in and leave karma (feedback).

Comment 6 Fedora Update System 2011-04-18 04:02:53 UTC
fail2ban-0.8.4-27.fc15 has been pushed to the Fedora 15 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2011-04-25 20:50:37 UTC
fail2ban-0.8.4-27.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2011-04-25 20:55:18 UTC
fail2ban-0.8.4-27.fc14 has been pushed to the Fedora 14 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.