Hide Forgot
Description of problem: Adding a puppet node by running "puppetd --server <puppetmaster> --waitforcert 60 --test" on the client side results into: type=AVC msg=audit(1301648392.239:15466): avc: denied { read } for pid=5732 comm="python" name="pyconfig-64.h" dev=dm-2 ino=1706329 scontext=system_u:system_r:nrpe_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file type=AVC msg=audit(1301648395.006:15467): avc: denied { node_bind } for pid=2788 comm="puppetmasterd" src=51293 scontext=unconfined_u:system_r:puppetmaster_t:s0 tcontext=system_u:object_r:node_t:s0 tclass=udp_socket type=AVC msg=audit(1301648443.036:15468): avc: denied { name_bind } for pid=2788 comm="puppetmasterd" src=64287 scontext=unconfined_u:system_r:puppetmaster_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=udp_socket type=AVC msg=audit(1301648447.338:15469): avc: denied { read } for pid=5758 comm="python" name="pyconfig-64.h" dev=dm-2 ino=1706329 scontext=system_u:system_r:nrpe_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file type=AVC msg=audit(1301648455.725:15470): avc: denied { node_bind } for pid=2788 comm="puppetmasterd" src=57914 scontext=unconfined_u:system_r:puppetmaster_t:s0 tcontext=system_u:object_r:node_t:s0 tclass=udp_socket type=AVC msg=audit(1301648503.675:15477): avc: denied { name_bind } for pid=2788 comm="puppetmasterd" src=4724 scontext=unconfined_u:system_r:puppetmaster_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=udp_socket type=AVC msg=audit(1301648516.503:15478): avc: denied { name_bind } for pid=2788 comm="puppetmasterd" src=26296 scontext=unconfined_u:system_r:puppetmaster_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=udp_socket type=AVC msg=audit(1301648564.313:15479): avc: denied { name_bind } for pid=2788 comm="puppetmasterd" src=21356 scontext=unconfined_u:system_r:puppetmaster_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=udp_socket type=AVC msg=audit(1301648577.258:15480): avc: denied { name_bind } for pid=2788 comm="puppetmasterd" src=9240 scontext=unconfined_u:system_r:puppetmaster_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=udp_socket type=AVC msg=audit(1301648625.151:15481): avc: denied { node_bind } for pid=2788 comm="puppetmasterd" src=45857 scontext=unconfined_u:system_r:puppetmaster_t:s0 tcontext=system_u:object_r:node_t:s0 tclass=udp_socket Version-Release number of selected component (if applicable): selinux-policy-3.9.7-37.fc14.noarch
CC'ing puppet maintainer
This looks like puppetmasterd is picking out random udp ports to listen on? Any idea what it is doing? Does puppetmasterd resolve user passwd entries?
This isn't the only problem with selinux and the puppet master, though it is one of them. For the record, I use the following add-on module to make puppet 2.6.8 work right on RHEL6 with selinux-policy-3.7.19-93 (which includes puppet module 1.0.0). # Fix selinux policy problems that interfere with the puppetmaster as of # selinux policy version 3.7.19-93 module puppetfix 1.1; require { type sysfs_t; type puppetmaster_t; type puppet_etc_t; type puppet_var_lib_t; type passwd_exec_t; type node_t; type port_t; class dir search; class file { relabelfrom relabelto getattr execute }; class udp_socket { name_bind node_bind }; } #============= puppetmaster_t ============== # Needed for normal operation allow puppetmaster_t passwd_exec_t:file { getattr execute }; allow puppetmaster_t puppet_etc_t:file { relabelfrom relabelto }; allow puppetmaster_t puppet_var_lib_t:file { relabelfrom relabelto }; allow puppetmaster_t sysfs_t:dir search; # Needed for receiving certificate signing requests from agents allow puppetmaster_t node_t:udp_socket node_bind; allow puppetmaster_t port_t:udp_socket name_bind;
We have fixes in F15, F16 which I need to backport.
Fixed in selinux-policy-3.9.7-46.fc14
selinux-policy-3.9.7-46.fc14 has been submitted as an update for Fedora 14. https://admin.fedoraproject.org/updates/selinux-policy-3.9.7-46.fc14
Package selinux-policy-3.9.7-46.fc14: * should fix your issue, * was pushed to the Fedora 14 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.9.7-46.fc14' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2011-14734 then log in and leave karma (feedback).
selinux-policy-3.9.7-46.fc14 has been pushed to the Fedora 14 stable repository. If problems still persist, please make note of it in this bug report.