Bug 694985 - SELinux is preventing /usr/bin/perl from 'ioctl' accesses on the file /etc/sysctl.conf.
Summary: SELinux is preventing /usr/bin/perl from 'ioctl' accesses on the file /etc/sy...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 14
Hardware: i386
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: setroubleshoot_trace_hash:aacb88c45f1...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-04-09 13:21 UTC by Robert Hinson
Modified: 2011-04-25 00:00 UTC (History)
2 users (show)

Fixed In Version: selinux-policy-3.9.7-40.fc14
Clone Of:
Environment:
Last Closed: 2011-04-25 00:00:16 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Robert Hinson 2011-04-09 13:21:33 UTC
SELinux is preventing /usr/bin/perl from 'ioctl' accesses on the file /etc/sysctl.conf.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that perl should be allowed ioctl access on the sysctl.conf file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep perl /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:logwatch_t:s0-s0:c0.c1023
Target Context                system_u:object_r:system_conf_t:s0
Target Objects                /etc/sysctl.conf [ file ]
Source                        perl
Source Path                   /usr/bin/perl
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           perl-5.12.3-142.fc14
Target RPM Packages           initscripts-9.20.2-1.fc14.1
Policy RPM                    selinux-policy-3.9.7-37.fc14
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     (removed)
Platform                      Linux (removed)
                              2.6.35.11-83.fc14.i686 #1 SMP Mon Feb 7 07:04:18
                              UTC 2011 i686 i686
Alert Count                   7
First Seen                    Sat 26 Mar 2011 03:12:12 AM CDT
Last Seen                     Sat 09 Apr 2011 07:40:24 AM CDT
Local ID                      b44c61fe-adbd-44b2-bb9c-aab20eeb272a

Raw Audit Messages
type=AVC msg=audit(1302352824.572:54): avc:  denied  { ioctl } for  pid=3311 comm="perl" path="/etc/sysctl.conf" dev=dm-0 ino=19996 scontext=system_u:system_r:logwatch_t:s0-s0:c0.c1023 tcontext=system_u:object_r:system_conf_t:s0 tclass=file


type=SYSCALL msg=audit(1302352824.572:54): arch=i386 syscall=ioctl success=no exit=ENOTTY a0=3 a1=5401 a2=bfb9f998 a3=bfb9f9d8 items=0 ppid=2966 pid=3311 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4 comm=perl exe=/usr/bin/perl subj=system_u:system_r:logwatch_t:s0-s0:c0.c1023 key=(null)

Hash: perl,logwatch_t,system_conf_t,file,ioctl

audit2allow

#============= logwatch_t ==============
allow logwatch_t system_conf_t:file ioctl;

audit2allow -R

#============= logwatch_t ==============
allow logwatch_t system_conf_t:file ioctl;

Comment 1 Miroslav Grepl 2011-04-11 06:15:52 UTC
Fixed in selinux-policy-3.9.7-39.fc14

Comment 2 Fedora Update System 2011-04-21 14:50:21 UTC
selinux-policy-3.9.7-40.fc14 has been submitted as an update for Fedora 14.
https://admin.fedoraproject.org/updates/selinux-policy-3.9.7-40.fc14

Comment 3 Fedora Update System 2011-04-21 22:25:55 UTC
Package selinux-policy-3.9.7-40.fc14:
* should fix your issue,
* was pushed to the Fedora 14 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.9.7-40.fc14'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/selinux-policy-3.9.7-40.fc14
then log in and leave karma (feedback).

Comment 4 Fedora Update System 2011-04-24 23:59:07 UTC
selinux-policy-3.9.7-40.fc14 has been pushed to the Fedora 14 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.