Bug 677622 - allow unconfined_t unlabeled_t:rawip_socket { read write };
Summary: allow unconfined_t unlabeled_t:rawip_socket { read write };
Keywords:
Status: CLOSED DUPLICATE of bug 517676
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: kernel
Version: 6.0
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Red Hat Kernel Manager
QA Contact: Red Hat Kernel QE team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-02-15 11:44 UTC by Jaroslav Kortus
Modified: 2011-02-16 21:59 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-02-16 21:59:46 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description Jaroslav Kortus 2011-02-15 11:44:04 UTC
Description of problem:
During our cluster test one of the tool registers via rpc and distributes workload to member nodes. In RHEL6 this is denied by selinux.

Version-Release number of selected component (if applicable):
selinux-policy-3.7.19-54.el6.noarch

How reproducible:
via cluster dd_io test

Steps to Reproduce:
1. run dd_io test from rhel6 driver
2.
3.
  
Actual results:
time->Tue Feb 15 04:57:47 2011
type=SYSCALL msg=audit(1297767467.791:15310): arch=c000003e syscall=45 success=no exit=-13 a0=a a1=7fff4a0ce9d0 a2=1770 a3=0 items=0 ppid=14391 pid=14397 auid=14025 uid=14025 gid=14025 euid=14025 suid=14025 fsuid=14025 egid=14025 sgid=14025 fsgid=14025 tty=pts1 ses=2502 comm="d_iogen" exe="/tmp/sts-jk-6/bin/d_iogen" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1297767467.791:15310): avc:  denied  { read } for  pid=14397 comm="d_iogen" laddr=10.15.89.97 lport=34181 faddr=10.15.89.75 fport=44523 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s0 tclass=rawip_socket


Expected results:
no denial for unconfined_t

Additional info:

Comment 2 Nate Straz 2011-02-15 15:15:50 UTC
Our test uses sctp sockets to distribute the load.

Comment 3 Daniel Walsh 2011-02-16 20:24:39 UTC
This is a kernel issue, we should not be seeing unlabeled_t rawip_sockets.

Comment 4 Stephen Smalley 2011-02-16 20:44:18 UTC
Lack of SELinux SCTP support is bug 517676.

Comment 5 Daniel Walsh 2011-02-16 21:59:46 UTC

*** This bug has been marked as a duplicate of bug 517676 ***


Note You need to log in before you can comment on or make changes to this bug.