Description of problem: Munin's cron job (running every 5 minutes) causes SELinux denials. I do not know if it's munin or selinux policy related. Version-Release number of selected component (if applicable): munin-1.4.6-1.fc15.noarch selinux-policy-targeted-3.9.16-35.fc15.noarch selinux-policy-3.9.16-35.fc15.noarch How reproducible: Just install munin Actual results: SELinux denials, munin not updated Expected results: Works :) Additional info: Running SELinux in permissive mode give the following messages : Aug 16 22:25:04 trinity setroubleshoot: SELinux is preventing /usr/bin/perl from create access on the sock_file munin-master-processmanager-23659.sock. For complete SELinux messages. run sealert -l 76eb03da-403a-4c40-b049-5667bb5858e1 Aug 16 22:25:04 trinity setroubleshoot: SELinux is preventing /usr/bin/perl from setattr access on the sock_file munin-master-processmanager-23659.sock. For complete SELinux messages. run sealert -l a8e285b0-b261-4803-bb20-a870de18d140 Aug 16 22:25:05 trinity setroubleshoot: SELinux is preventing /usr/bin/perl from write access on the sock_file munin-master-processmanager-23659.sock. For complete SELinux messages. run sealert -l 620c8b6a-43ab-477d-b4e1-9ff80df93161 Aug 16 22:25:11 trinity setroubleshoot: SELinux is preventing /usr/bin/perl from unlink access on the sock_file munin-master-processmanager-23659.sock. For complete SELinux messages. run sealert -l 2a131c43-8eaf-4ce4-8e7e-da311c2f0846
Could you attach the output of the following? su -c 'ausearch -m avc -ts today > /tmp/munin-master-processmanager.txt' Thank you in advance. -- Fedora Bugzappers volunteer triage team https://fedoraproject.org/wiki/BugZappers
Created attachment 518903 [details] ausearch results
Thank you for the update. Can you run this next? su -c 'restorecon -Rv /var /run' It looks like you may have some mislabeled files in there that are affecting httpd and munin. After that completes, do you still get AVC's? Did you move any of the locations for where munin or httpd access files? If so, this may help: https://docs.fedoraproject.org/en-US/Fedora/13/html/Managing_Confined_Services/chap-Managing_Confined_Services-The_Apache_HTTP_Server.html #============= httpd_t ============== allow httpd_t httpd_log_t:file write; #============= munin_t ============== allow munin_t var_run_t:sock_file { write create unlink setattr }; -- Fedora Bugzappers volunteer triage team https://fedoraproject.org/wiki/BugZappers
Hello, Restorecon seems to solve the problem: restorecon reset /var/run/munin context system_u:object_r:var_run_t:s0->system_u:object_r:munin_var_run_t:s0 I did not change anything; just did a 'yum install munin' on a fresh F-15 install. Well, problem is solved, thanks you for the help :)
munin-1.4.6-4.fc16 has been submitted as an update for Fedora 16. https://admin.fedoraproject.org/updates/munin-1.4.6-4.fc16
munin-1.4.6-4.fc15 has been submitted as an update for Fedora 15. https://admin.fedoraproject.org/updates/munin-1.4.6-4.fc15
munin-1.4.6-4.fc15.1 has been submitted as an update for Fedora 15. https://admin.fedoraproject.org/updates/munin-1.4.6-4.fc15.1
munin-1.4.6-4.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report.
munin-1.4.6-4.fc15.1 has been pushed to the Fedora 15 stable repository. If problems still persist, please make note of it in this bug report.