Bug 712363 - pulse: cannot create heartbeat socket
pulse: cannot create heartbeat socket
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: selinux-policy (Show other bugs)
5.7
All Linux
medium Severity medium
: rc
: ---
Assigned To: Miroslav Grepl
Milos Malik
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2011-06-10 08:40 EDT by Milos Malik
Modified: 2012-09-21 04:32 EDT (History)
1 user (show)

See Also:
Fixed In Version: selinux-policy-2.4.6-312.el5
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2011-07-21 05:20:53 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)
simple configuration file (451 bytes, text/plain)
2011-06-10 08:41 EDT, Milos Malik
no flags Details
another simple configuration file (450 bytes, text/plain)
2011-06-10 11:06 EDT, Milos Malik
no flags Details

  None (edit)
Description Milos Malik 2011-06-10 08:40:41 EDT
Description of problem:
If /etc/sysconfig/ha/lvs.cf contains following lines (as suggested in /usr/share/doc/piranha-0.8.4/sample.cf) then the pulse service will not run because of SELinux.

heartbeat = 1
heartbeat_port = 1050

Version-Release number of selected component (if applicable):
selinux-policy-devel-2.4.6-311.el5
selinux-policy-strict-2.4.6-311.el5
selinux-policy-2.4.6-311.el5
selinux-policy-mls-2.4.6-311.el5
selinux-policy-targeted-2.4.6-311.el5
selinux-policy-minimum-2.4.6-311.el5
piranha-0.8.4-22.el5
ipvsadm-1.24-13.el5

How reproducible:
always

Steps to Reproduce:
# setenforce 1
# service pulse start
Starting pulse: pulse: cannot create heartbeat socket. running as root?
[FAILED]

  
Actual results:
* pulse service is not running
* following AVC appeared
----
time->Fri Jun 10 08:28:06 2011
type=SYSCALL msg=audit(1307708886.913:112): arch=40000003 syscall=102 success=no exit=-13 a0=2 a1=bfa48ff0 a2=3 a3=41a items=0 ppid=19029 pid=19030 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="pulse" exe="/usr/sbin/pulse" subj=root:system_r:piranha_pulse_t:s0 key=(null)
type=AVC msg=audit(1307708886.913:112): avc:  denied  { name_bind } for  pid=19030 comm="pulse" src=1050 scontext=root:system_r:piranha_pulse_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=udp_socket
----

Expected results:
* no AVCs
* pulse service is running
Comment 1 Milos Malik 2011-06-10 08:41:51 EDT
Created attachment 504095 [details]
simple configuration file
Comment 2 Milos Malik 2011-06-10 08:50:45 EDT
It does not help. The AVC still appears.

piranha_lvs_can_network_connect --> on
Comment 3 Milos Malik 2011-06-10 11:05:31 EDT
When I use another configuration file following AVCs appear:
----
time->Fri Jun 10 11:03:23 2011
type=SYSCALL msg=audit(1307718203.347:688): arch=14 syscall=37 success=no exit=
-13 a0=7e09 a1=f a2=ffffffff a3=4000 items=0 ppid=1 pid=28008 auid=0 uid=0 gid=
0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="pulse" exe
="/usr/sbin/pulse" subj=root:system_r:piranha_pulse_t:s0 key=(null)
type=AVC msg=audit(1307718203.347:688): avc:  denied  { signal } for  pid=28008 comm="pulse" scontext=root:system_r:piranha_pulse_t:s0 tcontext=root:system_r:piranha_pulse_t:s0 tclass=process
----
time->Fri Jun 10 11:03:21 2011
type=SYSCALL msg=audit(1307718201.000:207): arch=14 syscall=11 success=no exit=-13 a0=1000ed4c a1=ff8bf160 a2=ff8bfeac a3=ffa0a18 items=0 ppid=28008 pid=28499 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="pulse" exe="/usr/sbin/pulse" subj=root:system_r:piranha_pulse_t:s0 key=(null)
type=AVC msg=audit(1307718201.000:207): avc:  denied  { execute } for  pid=28499 comm="pulse" name="fos" dev=dm-0 ino=4410270 scontext=root:system_r:piranha_pulse_t:s0 tcontext=system_u:object_r:piranha_fos_exec_t:s0 tclass=file
----
Comment 4 Milos Malik 2011-06-10 11:06:42 EDT
Created attachment 504142 [details]
another simple configuration file
Comment 5 Daniel Walsh 2011-06-10 12:14:27 EDT
Fixed in rawhide.

b5350cd2ad1d30366e26790e302290f8a17fa6e4

There is a type causing the second avc, and we should allow all signals within a single domain.
Comment 6 Miroslav Grepl 2011-06-20 08:34:59 EDT
Fixed in selinux-policy-2.4.6-312.el5
Comment 9 errata-xmlrpc 2011-07-21 05:20:53 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-1069.html
Comment 10 errata-xmlrpc 2011-07-21 07:57:21 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-1069.html

Note You need to log in before you can comment on or make changes to this bug.