680539 – dnsmasq supports enable-dbus, but selinux says no

Bug 680539 - dnsmasq supports enable-dbus, but selinux says no

Summary: dnsmasq supports enable-dbus, but selinux says no

Keywords:
Status:	CLOSED ERRATA
Alias:	None
Product:	Red Hat Enterprise Linux 6
Classification:	Red Hat
Component:	selinux-policy
Sub Component:
Version:	6.2
Hardware:	All
OS:	Linux
Priority:	medium
Severity:	medium
Target Milestone:	rc
Target Release:	---
Assignee:	Miroslav Grepl
QA Contact:	Milos Malik
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2011-02-25 20:31 UTC by Alex Williamson
Modified:	2012-10-15 14:01 UTC (History)
CC List:	2 users (show)
Fixed In Version:	selinux-policy-3.7.19-74.el6
Doc Type:	Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed:	2011-05-19 11:57:54 UTC
Target Upstream Version:

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHBA-2011:0526	0	normal	SHIPPED_LIVE	selinux-policy bug fix and enhancement update	2011-05-19 09:37:41 UTC

Description Alex Williamson 2011-02-25 20:31:00 UTC

Description of problem:

/etc/init.d/dnsmasq.conf:
enable-dbus

$ service dnsmasq start
Starting dnsmasq: 
dnsmasq: DBus error: Connection ":1.83" is not allowed to own the service "uk.org.thekelleys.dnsmasq" due to SELinux policy
                                                           [FAILED]

Version-Release number of selected component (if applicable):
dnsmasq-2.48-4.el6.x86_64
libselinux-2.0.94-3.el6.x86_64
libselinux-devel-2.0.94-3.el6.x86_64
selinux-policy-3.7.19-71.el6.noarch
selinux-policy-targeted-3.7.19-71.el6.noarch
libselinux-python-2.0.94-3.el6.x86_64
libselinux-utils-2.0.94-3.el6.x86_64

How reproducible:
100%

Steps to Reproduce:
1. Try to use enable-dbus option in dnsmasq
2.
3.
  
Actual results:
denied

Expected results:
supported

Additional info:

Comment 2 Daniel Walsh 2011-02-25 20:45:05 UTC

Please attach the AVC messages you are seeing

ausearch -m avc -ts recent

Comment 3 Alex Williamson 2011-02-25 21:06:50 UTC

ausearch just tells me:

# ausearch -m avc -ts recent
<no matches>

But here's what comes up in /var/log/audit/audit.log:

type=USER_AVC msg=audit(1298667909.962:1150): user pid=2153 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { acquire_svc } for service=uk.org.thekelleys.dnsmasq spid=20227 scontext=unconfined_u:system_r:dnsmasq_t:s0 tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=dbus : exe="/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'

Comment 4 Daniel Walsh 2011-02-25 21:24:25 UTC

Miroslav can you add:
	
dbus_connect_system_bus(dnsmasq_t)



Can dnsmasq be autostarted by dbus?

Comment 5 Alex Williamson 2011-02-28 13:43:37 UTC

(In reply to comment #4)
> Can dnsmasq be autostarted by dbus?

I have no idea.  I'm just trying to run a local dns caching/multiplexing server, starting via normal init scripts and using dbus to set and clear servers.  I suppose it's possible to launch via dbus, but I've never tried it.

Comment 6 Daniel Walsh 2011-02-28 18:16:23 UTC

Ok Miroslav lets just add the connect call.

Comment 8 Miroslav Grepl 2011-03-01 14:06:52 UTC

Fixed in selinux-policy-3.7.19-74.el6

Comment 11 errata-xmlrpc 2011-05-19 11:57:54 UTC

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-0526.html

Note You need to log in before you can comment on or make changes to this bug.