Bug 689564 - avc denied: mrtg_t var_lock_t : dir { write } ;
Summary: avc denied: mrtg_t var_lock_t : dir { write } ;
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: rawhide
Hardware: Unspecified
OS: Unspecified
low
medium
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On: 648653
Blocks: removesuid16
TreeView+ depends on / blocked
 
Reported: 2011-03-21 19:25 UTC by Eric Paris
Modified: 2012-02-10 08:32 UTC (History)
20 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of: 648653
Environment:
Last Closed: 2012-02-10 08:32:25 UTC
Type: ---


Attachments (Terms of Use)

Description Eric Paris 2011-03-21 19:25:22 UTC
+++ This bug was initially created as a clone of Bug #648653 +++

--- Additional comment from davej@redhat.com on 2011-03-18 20:16:55 EDT ---

I just realized that /var/lock is now on tmpfs in f16.  This is causing things like mrtg to fail..


type=AVC msg=audit(1300493461.829:2068): avc:  denied  { write } for  pid=5105 comm="mrtg" name="/" dev=tmpfs ino=7673 scontext=system_u:system_r:mrtg_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_lock_t:s0 tclass=dir

--- Additional comment from eparis@redhat.com on 2011-03-21 14:59:42 EDT ---

Comment #14 doesn't look related to tmpfs.  I also see what appear to be proper rules for this in selinux-policy-targeted-3.9.16-3.fc16.noarch.  What policy do you have?  If you are still having trouble what do you get from

sesearch --type --allow --source mrtg_t --target var_log_t --class dir

--- Additional comment from davej@redhat.com on 2011-03-21 15:11:04 EDT ---

selinux-policy-targeted-3.9.16-5.fc16.noarch

Found 2 semantic av rules:
   allow domain var_log_t : dir { getattr search open } ; 
   allow mrtg_t var_log_t : dir { ioctl read write getattr lock add_name remove_name search open } ; 

Found 1 semantic te rules:
   type_transition mrtg_t var_log_t : dir mrtg_log_t; 


wait, did you mean var_lock_t maybe  ?

because that shows..

Found 1 semantic av rules:
   allow mrtg_t var_lock_t : dir { getattr search open } ; 

which doesn't have a 'write', which would explain the denial.

-------------------------------------------------------------------------

Looks like mrtg_t needs both a te rule and a type transition rule to fix this....

Comment 1 Daniel Walsh 2011-03-21 21:40:40 UTC
Fixed in selinux-policy-3.9.16-6.fc15


Note You need to log in before you can comment on or make changes to this bug.