Bug 731181 - Selinux prevents munin cron correct execution
Summary: Selinux prevents munin cron correct execution
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: munin
Version: 15
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Kevin Fenzi
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-08-16 20:36 UTC by Johan Cwiklinski
Modified: 2011-09-13 05:53 UTC (History)
3 users (show)

Fixed In Version: munin-1.4.6-4.fc15.1
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-08-18 21:27:24 UTC


Attachments (Terms of Use)
ausearch results (599.92 KB, text/plain)
2011-08-18 16:19 UTC, Johan Cwiklinski
no flags Details

Description Johan Cwiklinski 2011-08-16 20:36:24 UTC
Description of problem:
Munin's cron job (running every 5 minutes) causes SELinux denials. I do not know if it's munin or selinux policy related.

Version-Release number of selected component (if applicable):
munin-1.4.6-1.fc15.noarch
selinux-policy-targeted-3.9.16-35.fc15.noarch
selinux-policy-3.9.16-35.fc15.noarch


How reproducible:
Just install munin

  
Actual results:
SELinux denials, munin not updated


Expected results:
Works :)


Additional info:
Running SELinux in permissive mode give the following messages :
Aug 16 22:25:04 trinity setroubleshoot: SELinux is preventing /usr/bin/perl from create access on the sock_file munin-master-processmanager-23659.sock. For complete SELinux messages. run sealert -l 76eb03da-403a-4c40-b049-5667bb5858e1
Aug 16 22:25:04 trinity setroubleshoot: SELinux is preventing /usr/bin/perl from setattr access on the sock_file munin-master-processmanager-23659.sock. For complete SELinux messages. run sealert -l a8e285b0-b261-4803-bb20-a870de18d140
Aug 16 22:25:05 trinity setroubleshoot: SELinux is preventing /usr/bin/perl from write access on the sock_file munin-master-processmanager-23659.sock. For complete SELinux messages. run sealert -l 620c8b6a-43ab-477d-b4e1-9ff80df93161
Aug 16 22:25:11 trinity setroubleshoot: SELinux is preventing /usr/bin/perl from unlink access on the sock_file munin-master-processmanager-23659.sock. For complete SELinux messages. run sealert -l 2a131c43-8eaf-4ce4-8e7e-da311c2f0846

Comment 1 d. johnson 2011-08-17 00:50:54 UTC
Could you attach the output of the following?

su -c 'ausearch -m avc -ts today > /tmp/munin-master-processmanager.txt'

Thank you in advance.




-- 
Fedora Bugzappers volunteer triage team
https://fedoraproject.org/wiki/BugZappers

Comment 2 Johan Cwiklinski 2011-08-18 16:19:53 UTC
Created attachment 518903 [details]
ausearch results

Comment 3 d. johnson 2011-08-18 20:28:20 UTC
Thank you for the update.  Can you run this next?

su -c 'restorecon -Rv /var /run'

It looks like you may have some mislabeled files in there that are affecting httpd and munin.  After that completes, do you still get AVC's?


Did you move any of the locations for where munin or httpd access files?

If so, this may help:

https://docs.fedoraproject.org/en-US/Fedora/13/html/Managing_Confined_Services/chap-Managing_Confined_Services-The_Apache_HTTP_Server.html


#============= httpd_t ==============
allow httpd_t httpd_log_t:file write;

#============= munin_t ==============
allow munin_t var_run_t:sock_file { write create unlink setattr };




-- 
Fedora Bugzappers volunteer triage team
https://fedoraproject.org/wiki/BugZappers

Comment 4 Johan Cwiklinski 2011-08-18 21:27:24 UTC
Hello,

Restorecon seems to solve the problem:
restorecon reset /var/run/munin context system_u:object_r:var_run_t:s0->system_u:object_r:munin_var_run_t:s0

I did not change anything; just did a 'yum install munin' on a fresh F-15 install.

Well, problem is solved, thanks you for the help :)

Comment 5 Fedora Update System 2011-08-21 01:16:51 UTC
munin-1.4.6-4.fc16 has been submitted as an update for Fedora 16.
https://admin.fedoraproject.org/updates/munin-1.4.6-4.fc16

Comment 6 Fedora Update System 2011-08-21 01:51:00 UTC
munin-1.4.6-4.fc15 has been submitted as an update for Fedora 15.
https://admin.fedoraproject.org/updates/munin-1.4.6-4.fc15

Comment 7 Fedora Update System 2011-08-27 23:54:15 UTC
munin-1.4.6-4.fc15.1 has been submitted as an update for Fedora 15.
https://admin.fedoraproject.org/updates/munin-1.4.6-4.fc15.1

Comment 8 Fedora Update System 2011-08-30 20:48:28 UTC
munin-1.4.6-4.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2011-09-13 05:53:24 UTC
munin-1.4.6-4.fc15.1 has been pushed to the Fedora 15 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.