Hide Forgot
This bug has been copied from bug #715038 and has been proposed to be backported to 6.1 z-stream (EUS).
Fixed in selinux-policy-3.7.19-93.el6_1.4.
May I kindly ask to retest this bug on RHEL6.1 with selinux-policy-3.7.19-93.el6_1.4? Thank you in advance.
This is failing still on RHEL 6.1 i386 with selinux-policy-3.7.19-93.el6_1.4. The problem is that the DS CGI scripts are not labelled right. Everything in /usr/lib/dirsrv/cgi-bin is labelled as lib_t, which is incorrect. Using semanage, I can see that the policy is referring to the 64-bit libdir, even on a 32-bit system: ------------------------------------------------------------------- /usr/lib64/dirsrv/cgi-bin(/.*)? all files system_u:object_r:httpd_dirsrvadmin_script_exec_t:s0 /usr/lib64/dirsrv/cgi-bin/ds_create regular file system_u:object_r:dirsrvadmin_unconfined_script_exec_t:s0 /usr/lib64/dirsrv/cgi-bin/ds_remove regular file system_u:object_r:dirsrvadmin_unconfined_script_exec_t:s0 /usr/lib64/dirsrv/dsgw-cgi-bin(/.*)? all files system_u:object_r:httpd_dirsrvadmin_script_exec_t:s0 ------------------------------------------------------------------- These rules need to use "/usr/lib/dirsrv" on an i386 system, and "/usr/lib64/dirsrv" on an x86_64 system.
I also tested selinux-policy-3.7.19-93.el6_1.4 on a RHEL 6.1 x86_64 system, but encountered a number of AVC messages there as well when creating a new DS instance via redhat-idm-console. I will attach the audit log and audit2allow messages from that system.
Created attachment 516920 [details] audit log
Created attachment 516921 [details] audit2allow messages
I am fixing labels and adding missing rules dirsrvadmin_domtrans_unconfined_script_t(httpd_t) which causes these AVC msgs.
Fixed in selinux-policy-3.7.19-93.el6_1.5
(In reply to comment #12) > Fixed in selinux-policy-3.7.19-93.el6_1.5 This new package passes my instance creation tests on both i386 and x86_64 architectures.
Tested with selinux-policy-3.7.19-93.el6_1.7 on i386 platform. I have successfuly performed following actions: -service dirsrv-admin restart -service dirsrv restart Using redhat-idm-console" - create directory server instance - stop/start/restart directory server instance - remove directory server instance No AVC nor crashes/freeze. Anyway I would like to restest it with the new 389 build on x86_64 before switching this bug to VERIFIED.
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2011-1193.html