Description of problem: If /etc/sysconfig/ha/lvs.cf contains following lines (as suggested in /usr/share/doc/piranha-0.8.4/sample.cf) then the pulse service will not run because of SELinux. heartbeat = 1 heartbeat_port = 1050 Version-Release number of selected component (if applicable): selinux-policy-devel-2.4.6-311.el5 selinux-policy-strict-2.4.6-311.el5 selinux-policy-2.4.6-311.el5 selinux-policy-mls-2.4.6-311.el5 selinux-policy-targeted-2.4.6-311.el5 selinux-policy-minimum-2.4.6-311.el5 piranha-0.8.4-22.el5 ipvsadm-1.24-13.el5 How reproducible: always Steps to Reproduce: # setenforce 1 # service pulse start Starting pulse: pulse: cannot create heartbeat socket. running as root? [FAILED] Actual results: * pulse service is not running * following AVC appeared ---- time->Fri Jun 10 08:28:06 2011 type=SYSCALL msg=audit(1307708886.913:112): arch=40000003 syscall=102 success=no exit=-13 a0=2 a1=bfa48ff0 a2=3 a3=41a items=0 ppid=19029 pid=19030 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="pulse" exe="/usr/sbin/pulse" subj=root:system_r:piranha_pulse_t:s0 key=(null) type=AVC msg=audit(1307708886.913:112): avc: denied { name_bind } for pid=19030 comm="pulse" src=1050 scontext=root:system_r:piranha_pulse_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=udp_socket ---- Expected results: * no AVCs * pulse service is running
Created attachment 504095 [details] simple configuration file
It does not help. The AVC still appears. piranha_lvs_can_network_connect --> on
When I use another configuration file following AVCs appear: ---- time->Fri Jun 10 11:03:23 2011 type=SYSCALL msg=audit(1307718203.347:688): arch=14 syscall=37 success=no exit= -13 a0=7e09 a1=f a2=ffffffff a3=4000 items=0 ppid=1 pid=28008 auid=0 uid=0 gid= 0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="pulse" exe ="/usr/sbin/pulse" subj=root:system_r:piranha_pulse_t:s0 key=(null) type=AVC msg=audit(1307718203.347:688): avc: denied { signal } for pid=28008 comm="pulse" scontext=root:system_r:piranha_pulse_t:s0 tcontext=root:system_r:piranha_pulse_t:s0 tclass=process ---- time->Fri Jun 10 11:03:21 2011 type=SYSCALL msg=audit(1307718201.000:207): arch=14 syscall=11 success=no exit=-13 a0=1000ed4c a1=ff8bf160 a2=ff8bfeac a3=ffa0a18 items=0 ppid=28008 pid=28499 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="pulse" exe="/usr/sbin/pulse" subj=root:system_r:piranha_pulse_t:s0 key=(null) type=AVC msg=audit(1307718201.000:207): avc: denied { execute } for pid=28499 comm="pulse" name="fos" dev=dm-0 ino=4410270 scontext=root:system_r:piranha_pulse_t:s0 tcontext=system_u:object_r:piranha_fos_exec_t:s0 tclass=file ----
Created attachment 504142 [details] another simple configuration file
Fixed in rawhide. b5350cd2ad1d30366e26790e302290f8a17fa6e4 There is a type causing the second avc, and we should allow all signals within a single domain.
Fixed in selinux-policy-2.4.6-312.el5
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2011-1069.html