Red Hat Bugzilla – Bug 658849
Please change fail2ban to not use gam_server
Last modified: 2011-04-25 16:55:46 EDT
At least change it to default to polling.
In SELinux we are constantly getting birraged with hundreds of bugzillas about fail2ban using gam_server. gam_server was developed for userspace apps not system services. SELinux can not allow the access to fail2ban that would be required for gam_server access, so we end up telling everyone who triggers this error to move to a polling situation.
A better solution would be to modify fail2ban to use inotify to watch its config.
I changed the /etc/fail2ban/jail.conf backend default to 'polling' and the AVCs appear to have stopped. I've only looked around a little but it appears that fail2ban is using the gam_server as an interface to inotify to watch files (more than just it's config) when it could use it directly. Maybe the developer could comment on the use of the gam_server.
fail2ban-0.8.4-27.fc14 has been submitted as an update for Fedora 14.
fail2ban-0.8.4-27.fc13 has been submitted as an update for Fedora 13.
fail2ban-0.8.4-27.fc15 has been submitted as an update for Fedora 15.
* should fix your issue,
* was pushed to the Fedora 15 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing fail2ban-0.8.4-27.fc15'
as soon as you are able to.
Please go to the following url:
then log in and leave karma (feedback).
fail2ban-0.8.4-27.fc15 has been pushed to the Fedora 15 stable repository. If problems still persist, please make note of it in this bug report.
fail2ban-0.8.4-27.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report.
fail2ban-0.8.4-27.fc14 has been pushed to the Fedora 14 stable repository. If problems still persist, please make note of it in this bug report.