Hide Forgot
Description of problem: During our cluster test one of the tool registers via rpc and distributes workload to member nodes. In RHEL6 this is denied by selinux. Version-Release number of selected component (if applicable): selinux-policy-3.7.19-54.el6.noarch How reproducible: via cluster dd_io test Steps to Reproduce: 1. run dd_io test from rhel6 driver 2. 3. Actual results: time->Tue Feb 15 04:57:47 2011 type=SYSCALL msg=audit(1297767467.791:15310): arch=c000003e syscall=45 success=no exit=-13 a0=a a1=7fff4a0ce9d0 a2=1770 a3=0 items=0 ppid=14391 pid=14397 auid=14025 uid=14025 gid=14025 euid=14025 suid=14025 fsuid=14025 egid=14025 sgid=14025 fsgid=14025 tty=pts1 ses=2502 comm="d_iogen" exe="/tmp/sts-jk-6/bin/d_iogen" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1297767467.791:15310): avc: denied { read } for pid=14397 comm="d_iogen" laddr=10.15.89.97 lport=34181 faddr=10.15.89.75 fport=44523 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s0 tclass=rawip_socket Expected results: no denial for unconfined_t Additional info:
Our test uses sctp sockets to distribute the load.
This is a kernel issue, we should not be seeing unlabeled_t rawip_sockets.
Lack of SELinux SCTP support is bug 517676.
*** This bug has been marked as a duplicate of bug 517676 ***