Bug 729073 - SELinux prevents openvpn to set its process priority
Summary: SELinux prevents openvpn to set its process priority
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy
Version: 6.0
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Miroslav Grepl
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-08-08 16:40 UTC by Simon Matter
Modified: 2012-01-16 13:56 UTC (History)
2 users (show)

Fixed In Version: selinux-policy-3.7.19-107.el6
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-12-06 10:10:30 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2011:1511 normal SHIPPED_LIVE selinux-policy bug fix and enhancement update 2011-12-06 00:39:17 UTC

Description Simon Matter 2011-08-08 16:40:52 UTC
Description of problem:
SELinux prevents openvpn to set its process priority when the nice parameter is used.

Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.7.19-54.el6_0.5

How reproducible:

Steps to Reproduce:
1. add 'nice -7' to the openvpn server config
2. start openvpn
3.
  
Actual results:
WARNING: nice -7 failed: Operation not permitted

Expected results:
nice -7 succeeded

Additional info:
allow2audit tells me the following is required (and in fact makes things work):

----------------
module invocaopenvpn 1.0;

require {
        type openvpn_t;
        class capability sys_nice;
        class process setsched;
}

#============= openvpn_t ==============
allow openvpn_t self:capability sys_nice;
allow openvpn_t self:process setsched;
----------------

Thanks,
Simon

Comment 2 Miroslav Grepl 2011-08-10 07:05:07 UTC
Fixed in selinux-policy-3.7.19-107.el6

Comment 5 errata-xmlrpc 2011-12-06 10:10:30 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2011-1511.html


Note You need to log in before you can comment on or make changes to this bug.