Bug 677622 - allow unconfined_t unlabeled_t:rawip_socket { read write };
allow unconfined_t unlabeled_t:rawip_socket { read write };
Status: CLOSED DUPLICATE of bug 517676
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: kernel (Show other bugs)
6.0
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Red Hat Kernel Manager
Red Hat Kernel QE team
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2011-02-15 06:44 EST by Jaroslav Kortus
Modified: 2011-02-16 16:59 EST (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2011-02-16 16:59:46 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jaroslav Kortus 2011-02-15 06:44:04 EST
Description of problem:
During our cluster test one of the tool registers via rpc and distributes workload to member nodes. In RHEL6 this is denied by selinux.

Version-Release number of selected component (if applicable):
selinux-policy-3.7.19-54.el6.noarch

How reproducible:
via cluster dd_io test

Steps to Reproduce:
1. run dd_io test from rhel6 driver
2.
3.
  
Actual results:
time->Tue Feb 15 04:57:47 2011
type=SYSCALL msg=audit(1297767467.791:15310): arch=c000003e syscall=45 success=no exit=-13 a0=a a1=7fff4a0ce9d0 a2=1770 a3=0 items=0 ppid=14391 pid=14397 auid=14025 uid=14025 gid=14025 euid=14025 suid=14025 fsuid=14025 egid=14025 sgid=14025 fsgid=14025 tty=pts1 ses=2502 comm="d_iogen" exe="/tmp/sts-jk-6/bin/d_iogen" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1297767467.791:15310): avc:  denied  { read } for  pid=14397 comm="d_iogen" laddr=10.15.89.97 lport=34181 faddr=10.15.89.75 fport=44523 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s0 tclass=rawip_socket


Expected results:
no denial for unconfined_t

Additional info:
Comment 2 Nate Straz 2011-02-15 10:15:50 EST
Our test uses sctp sockets to distribute the load.
Comment 3 Daniel Walsh 2011-02-16 15:24:39 EST
This is a kernel issue, we should not be seeing unlabeled_t rawip_sockets.
Comment 4 Stephen Smalley 2011-02-16 15:44:18 EST
Lack of SELinux SCTP support is bug 517676.
Comment 5 Daniel Walsh 2011-02-16 16:59:46 EST

*** This bug has been marked as a duplicate of bug 517676 ***

Note You need to log in before you can comment on or make changes to this bug.