Hide Forgot
Created attachment 522720 [details] SELinux alert Hi, I'm de-rooting dhcpd (bug #693381). The fix is in changing effective user/group ID in the code. When I then run dhcpd from command line everything is fine but when running as service (service dhcpd start) SELinux prevents dhcpd from setgid/setuid. Version-Release number of selected component (if applicable): selinux-policy-3.7.19-93.el6.noarch
We have this in F16 so I think we should back port.
Created attachment 522918 [details] SELinux is preventing /usr/sbin/dhcpd "read"/"write" access on dhcpd.pid. During testing I've discovered some other alerts I haven't seen before.
Created attachment 522919 [details] SELinux is preventing /usr/sbin/dhcpd "name_bind" access on <Unknown>. And this one. Not sure what does it mean. I see it when running two dhcpd servers in failover pair.
(In reply to comment #2) > Created attachment 522918 [details] > SELinux is preventing /usr/sbin/dhcpd "read"/"write" access on dhcpd.pid. > > During testing I've discovered some other alerts I haven't seen before. Have you ever started dhcpd by hand? /var/run/dhcpd.pid is mislabeled.
(In reply to comment #4) > (In reply to comment #2) > > Created attachment 522918 [details] > > SELinux is preventing /usr/sbin/dhcpd "read"/"write" access on dhcpd.pid. > > > > During testing I've discovered some other alerts I haven't seen before. > > Have you ever started dhcpd by hand? > > /var/run/dhcpd.pid is mislabeled. Yes, that's the problem. So this one is out. Thanks.
(In reply to comment #3) > Created attachment 522919 [details] > SELinux is preventing /usr/sbin/dhcpd "name_bind" access on <Unknown>. > > And this one. Not sure what does it mean. I see it when running two dhcpd > servers in failover pair. And this one has turned out to be a user error. I was using wrong ports for the failover protocol.
*** Bug 743440 has been marked as a duplicate of this bug. ***
There's one more serious problem. See bug #693381, comment #17. When dhcpd starts it writes /var/lib/dhcpd/dhcpd.leases as root:root, then de-roots itself and runs as dhcpd:dhcpd. I changed the ownership of /var/lib/dhcpd/ to dhcpd:dhcpd so dhcpd is able to write leases there as dhcpd:dhcpd. Problem is that SELinux doesn't allow dhcpd to make the initial record as root:root.
Yes, since dac_override is needed in this case.
Added to selinux-policy-3.7.19-120.el6
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2011-1511.html