Hide Forgot
Description of problem: The luci service (which is one of many cluster services executed in the automated test below) starts but something is blocked by SELinux. Version-Release number of selected component (if applicable): selinux-policy-3.7.19-78.el6.noarch selinux-policy-targeted-3.7.19-78.el6.noarch selinux-policy-doc-3.7.19-78.el6.noarch selinux-policy-mls-3.7.19-78.el6.noarch selinux-policy-minimum-3.7.19-78.el6.noarch How reproducible: always Steps to Reproduce: 1) get a RHEL-6.1 machine with active targeted policy 2) log into the machine as root 3) run following commands: # yum -y install audit cman cmirror corosync fence-agents grep initscripts kmod-cmirror libselinux libselinux-utils luci lvm2-cluster mktemp NetworkManager openais policycoreutils ricci sed selinux-policy selinux-policy-targeted setools setools-console # yum -y install rh-tests-selinux-policy-Regression-bz271561-corosync-and-similar # service auditd stop # service auditd start # cd /mnt/testarea/tests/selinux-policy/Regression/bz271561-corosync-and-similar # make run Actual results: ---- time->Fri Mar 11 07:30:15 2011 type=SYSCALL msg=audit(1299846615.180:9890): arch=40000003 syscall=5 success=yes exit=3 a0=890b020 a1=8241 a2=1b6 a3=8cd90f1 items=0 ppid=11574 pid=11595 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyS0 ses=1 comm="paster" exe="/usr/bin/python" subj=unconfined_u:system_r:piranha_web_t:s0 key=(null) type=AVC msg=audit(1299846615.180:9890): avc: denied { write } for pid=11595 comm="paster" name="luci.ini" dev=dm-0 ino=919336 scontext=unconfined_u:system_r:piranha_web_t:s0 tcontext=unconfined_u:object_r:piranha_web_conf_t:s0 tclass=file type=AVC msg=audit(1299846615.180:9890): avc: denied { create } for pid=11595 comm="paster" name="luci.ini" scontext=unconfined_u:system_r:piranha_web_t:s0 tcontext=unconfined_u:object_r:piranha_web_conf_t:s0 tclass=file type=AVC msg=audit(1299846615.180:9890): avc: denied { add_name } for pid=11595 comm="paster" name="luci.ini" scontext=unconfined_u:system_r:piranha_web_t:s0 tcontext=system_u:object_r:piranha_web_conf_t:s0 tclass=dir type=AVC msg=audit(1299846615.180:9890): avc: denied { write } for pid=11595 comm="paster" name="etc" dev=dm-0 ino=919381 scontext=unconfined_u:system_r:piranha_web_t:s0 tcontext=system_u:object_r:piranha_web_conf_t:s0 tclass=dir ---- Expected results: no AVCs
Looks like the policy allows pirana_web_t to manage all files in /var/lib/luci except for files in /var/lib/luci/etc and /var/lib/luci/cert? Should the web interface be allowed to edit those also?
Marek, is this something new? Milos, could you add output of # ls -lZR /var/lib/luci
@Miroslav: I believe that those AVC does not have anything common with pulse/piranha because they are not installed according to test case mentioned in comment 1
[root@ibm-ls22-05 ~]# ls -lZR /var/lib/luci /var/lib/luci: drwxr-xr-x. luci luci system_u:object_r:piranha_web_data_t:s0 certs drwxr-xr-x. luci luci system_u:object_r:piranha_web_data_t:s0 data drwxr-xr-x. luci luci system_u:object_r:piranha_web_conf_t:s0 etc /var/lib/luci/certs: -rw-------. luci luci unconfined_u:object_r:piranha_web_data_t:s0 host.pem /var/lib/luci/data: -rw-r-----. luci luci unconfined_u:object_r:piranha_web_data_t:s0 luci.db /var/lib/luci/etc: -rw-r--r--. luci luci system_u:object_r:piranha_web_conf_t:s0 cacert.config -rw-r-----. luci luci unconfined_u:object_r:piranha_web_conf_t:s0 luci.ini
Ok, I am also seeing this issue and luci.ini is created on the fly during starting luci service. Ryan, is this something new? # rpm -ql luci |grep -E "luci\.ini" /var/lib/luci/etc/luci.ini
Fixed in selinux-policy-3.7.19-79.el6
Fixed in selinux-policy-3.7.19-81.el6
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2011-0526.html