Bug 696819 - ipa-server-install fails on F-15 with enforcing SELinux
ipa-server-install fails on F-15 with enforcing SELinux
Product: freeIPA
Classification: Community
Component: SELinux (Show other bugs)
Unspecified Unspecified
unspecified Severity high
: ---
: ---
Assigned To: Rob Crittenden
Chandrasekar Kannan
Depends On:
  Show dependency treegraph
Reported: 2011-04-14 18:26 EDT by Tim Niemueller
Modified: 2015-01-04 18:47 EST (History)
5 users (show)

See Also:
Fixed In Version: freeipa-2.1.3-5.fc16
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2012-03-28 05:27:49 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
IPA server installation output (1.86 KB, application/octet-stream)
2011-04-19 10:27 EDT, Martin Kosek
no flags Details
IPA server installation log (13.10 KB, text/x-log)
2011-04-19 10:28 EDT, Martin Kosek
no flags Details
Relevant AVCs from audit.log (1.49 KB, text/plain)
2011-04-19 10:29 EDT, Martin Kosek
no flags Details

  None (edit)
Description Tim Niemueller 2011-04-14 18:26:12 EDT
Description of problem:
When running ipa-server-install it hang when setting up the directory server.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Minimal install of devel F-15
2. Install freeipa-server
3. Call ipa-server-install
Actual results:
Installation hangs.

Expected results:
Installation succeeds.

Additional info:
Unfortunately I do not have the debug install logs anymore, it hang in setup-dl.pl or similar. audit2allow -a outputs:

#============= dirsrv_t ==============
allow dirsrv_t var_t:lnk_file read;
Comment 1 Dmitri Pal 2011-04-15 10:45:24 EDT
How long did you wait?
There are some very strange delays that we have observed in systemd trying to restart different services. It might be that it looked like it hanged but was in the long timeout.
Why do you think it is a SELinux problem?
Comment 2 Daniel Walsh 2011-04-15 11:22:07 EDT
You need a newer SELinux policy.

selinux-policy-3.9.16-15.fc15 is the latest.
Comment 3 Martin Kosek 2011-04-19 10:26:16 EDT
I run into the same problem, just the AVC was different. Attaching IPA installation output, ipa server installation logfile and relevant AVCs.

I was informed that a fixed was checked in to F-16 and will be backported to relevant repos.
Comment 4 Martin Kosek 2011-04-19 10:27:06 EDT
Created attachment 493206 [details]
IPA server installation output
Comment 5 Martin Kosek 2011-04-19 10:28:43 EDT
Created attachment 493207 [details]
IPA server installation log

setup-ds.pl complains here that it could not create a directory.
Comment 6 Martin Kosek 2011-04-19 10:29:20 EDT
Created attachment 493208 [details]
Relevant AVCs from audit.log
Comment 7 Daniel Walsh 2011-04-19 11:07:35 EDT
Not sure why dirsrv_t would be changing the permissions on a var_lock directory but we are adding this to the next policy.
Comment 8 Martin Kosek 2011-04-20 05:17:16 EDT
I can confirm, that when I loaded a custom SELinux module allowing a rule mentioned in the reported AVC the reported hang no longer occured.

My selinux-policy version:
Comment 9 Martin Kosek 2011-04-21 09:27:28 EDT
Tracking upstream ticket:

Comment 10 Martin Kosek 2011-04-29 04:38:47 EDT
selinux-policy-3.9.16-18.fc15 fixes the issue. Closing the upstream ticket.
Comment 11 Martin Kosek 2011-06-08 09:30:33 EDT
The selinux problem was not solved completely, originally reported AVC reoccurred. ipa-replica-install will fail again.

selinux-policy version:

type=AVC msg=audit(1307533596.416:1211): avc:  denied  { read } for
pid=17544 comm="ns-slapd" name="lock" dev=dm-0 ino=1681

# cat /var/log/audit/audit.log | audit2allow

#============= dirsrv_t ==============
allow dirsrv_t var_t:lnk_file read;
Comment 12 Martin Kosek 2011-06-08 09:31:38 EDT
Opening a new upstream ticket:
Comment 13 Miroslav Grepl 2011-06-08 09:38:59 EDT
well, the problem is /var/lock is mislabeled.

# restorecon -R -v /var
Comment 14 Martin Kosek 2011-06-09 06:51:12 EDT
Yes, you are right, I see it now. Thanks for reply.

Note You need to log in before you can comment on or make changes to this bug.