Bug 712363 - pulse: cannot create heartbeat socket
Summary: pulse: cannot create heartbeat socket
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: selinux-policy
Version: 5.7
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Miroslav Grepl
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-06-10 12:40 UTC by Milos Malik
Modified: 2012-09-21 08:32 UTC (History)
1 user (show)

Fixed In Version: selinux-policy-2.4.6-312.el5
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-07-21 09:20:53 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)
simple configuration file (451 bytes, text/plain)
2011-06-10 12:41 UTC, Milos Malik
no flags Details
another simple configuration file (450 bytes, text/plain)
2011-06-10 15:06 UTC, Milos Malik
no flags Details


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2011:1069 0 normal SHIPPED_LIVE selinux-policy bug fix and enhancement update 2011-07-21 09:18:27 UTC

Description Milos Malik 2011-06-10 12:40:41 UTC
Description of problem:
If /etc/sysconfig/ha/lvs.cf contains following lines (as suggested in /usr/share/doc/piranha-0.8.4/sample.cf) then the pulse service will not run because of SELinux.

heartbeat = 1
heartbeat_port = 1050

Version-Release number of selected component (if applicable):
selinux-policy-devel-2.4.6-311.el5
selinux-policy-strict-2.4.6-311.el5
selinux-policy-2.4.6-311.el5
selinux-policy-mls-2.4.6-311.el5
selinux-policy-targeted-2.4.6-311.el5
selinux-policy-minimum-2.4.6-311.el5
piranha-0.8.4-22.el5
ipvsadm-1.24-13.el5

How reproducible:
always

Steps to Reproduce:
# setenforce 1
# service pulse start
Starting pulse: pulse: cannot create heartbeat socket. running as root?
[FAILED]

  
Actual results:
* pulse service is not running
* following AVC appeared
----
time->Fri Jun 10 08:28:06 2011
type=SYSCALL msg=audit(1307708886.913:112): arch=40000003 syscall=102 success=no exit=-13 a0=2 a1=bfa48ff0 a2=3 a3=41a items=0 ppid=19029 pid=19030 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="pulse" exe="/usr/sbin/pulse" subj=root:system_r:piranha_pulse_t:s0 key=(null)
type=AVC msg=audit(1307708886.913:112): avc:  denied  { name_bind } for  pid=19030 comm="pulse" src=1050 scontext=root:system_r:piranha_pulse_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=udp_socket
----

Expected results:
* no AVCs
* pulse service is running

Comment 1 Milos Malik 2011-06-10 12:41:51 UTC
Created attachment 504095 [details]
simple configuration file

Comment 2 Milos Malik 2011-06-10 12:50:45 UTC
It does not help. The AVC still appears.

piranha_lvs_can_network_connect --> on

Comment 3 Milos Malik 2011-06-10 15:05:31 UTC
When I use another configuration file following AVCs appear:
----
time->Fri Jun 10 11:03:23 2011
type=SYSCALL msg=audit(1307718203.347:688): arch=14 syscall=37 success=no exit=
-13 a0=7e09 a1=f a2=ffffffff a3=4000 items=0 ppid=1 pid=28008 auid=0 uid=0 gid=
0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="pulse" exe
="/usr/sbin/pulse" subj=root:system_r:piranha_pulse_t:s0 key=(null)
type=AVC msg=audit(1307718203.347:688): avc:  denied  { signal } for  pid=28008 comm="pulse" scontext=root:system_r:piranha_pulse_t:s0 tcontext=root:system_r:piranha_pulse_t:s0 tclass=process
----
time->Fri Jun 10 11:03:21 2011
type=SYSCALL msg=audit(1307718201.000:207): arch=14 syscall=11 success=no exit=-13 a0=1000ed4c a1=ff8bf160 a2=ff8bfeac a3=ffa0a18 items=0 ppid=28008 pid=28499 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="pulse" exe="/usr/sbin/pulse" subj=root:system_r:piranha_pulse_t:s0 key=(null)
type=AVC msg=audit(1307718201.000:207): avc:  denied  { execute } for  pid=28499 comm="pulse" name="fos" dev=dm-0 ino=4410270 scontext=root:system_r:piranha_pulse_t:s0 tcontext=system_u:object_r:piranha_fos_exec_t:s0 tclass=file
----

Comment 4 Milos Malik 2011-06-10 15:06:42 UTC
Created attachment 504142 [details]
another simple configuration file

Comment 5 Daniel Walsh 2011-06-10 16:14:27 UTC
Fixed in rawhide.

b5350cd2ad1d30366e26790e302290f8a17fa6e4

There is a type causing the second avc, and we should allow all signals within a single domain.

Comment 6 Miroslav Grepl 2011-06-20 12:34:59 UTC
Fixed in selinux-policy-2.4.6-312.el5

Comment 9 errata-xmlrpc 2011-07-21 09:20:53 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-1069.html

Comment 10 errata-xmlrpc 2011-07-21 11:57:21 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-1069.html


Note You need to log in before you can comment on or make changes to this bug.