Hide Forgot
Created attachment 526344 [details] dhcpd.conf example Description of problem: After creating an /etc/dhcp/dhcpd.conf file, the service appeared to start, but it silently failed: [root@termite ~]# service dhcpd start Starting dhcpd: [ OK ] [root@termite ~]# service dhcpd status dhcpd dead but pid file exists /var/log/messages contained: Oct 4 18:00:18 termite setroubleshoot: SELinux is preventing /usr/sbin/dhcpd "setgid" access . For complete SELinux messages. run sealert -l a7a5bbce-91e6-4f74-bfc5-6684adb8ecef The full sealert text is below. I created a permissive domain for dhcpd_t and I was able to start the service. [root@termite ~]# semanage permissive -a dhcpd_t [root@termite ~]# service dhcpd start Starting dhcpd: [ OK ] [root@termite ~]# service dhcpd status dhcpd (pid 7658) is running... Version-Release number of selected component (if applicable): dhcp-4.1.1-24.P1.el6.x86_64 selinux-policy-3.7.19-93.el6_1.7.noarch How reproducible: every time (?) Steps to Reproduce: 1. create /etc/dhcp/dhcpd.conf (see attached example) 2. service dhcpd start 3. service dhcpd status 4. tail /var/log/messages Actual results: selinux blocked dhcpd from starting Expected results: dhcpd starts and runs Additional info: Summary: SELinux is preventing /usr/sbin/dhcpd "setgid" access . Detailed Description: SELinux denied access requested by dhcpd. It is not expected that this access is required by dhcpd and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug report. Additional Information: Source Context unconfined_u:system_r:dhcpd_t:s0 Target Context unconfined_u:system_r:dhcpd_t:s0 Target Objects None [ capability ] Source dhcpd Source Path /usr/sbin/dhcpd Port <Unknown> Host termite.dfw.redhat.com Source RPM Packages dhcp-4.1.1-24.P1.el6 Target RPM Packages Policy RPM selinux-policy-3.7.19-93.el6_1.7 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name catchall Host Name termite.dfw.redhat.com Platform Linux termite.dfw.redhat.com 2.6.32-131.6.1.el6.x86_64 #1 SMP Mon Jun 20 14:15:38 EDT 2011 x86_64 x86_64 Alert Count 5 First Seen Tue Oct 4 17:36:04 2011 Last Seen Tue Oct 4 18:00:13 2011 Local ID a7a5bbce-91e6-4f74-bfc5-6684adb8ecef Line Numbers Raw Audit Messages node=termite.dfw.redhat.com type=AVC msg=audit(1317769213.353:220298): avc: denied { setgid } for pid=7446 comm="dhcpd" capability=6 scontext=unconfined_u:system_r:dhcpd_t:s0 tcontext=unconfined_u:system_r:dhcpd_t:s0 tclass=capability node=termite.dfw.redhat.com type=SYSCALL msg=audit(1317769213.353:220298): arch=c000003e syscall=116 success=no exit=-1 a0=0 a1=0 a2=5 a3=7f7b86c9c240 items=0 ppid=1 pid=7446 auid=12257 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts5 ses=28411 comm="dhcpd" exe="/usr/sbin/dhcpd" subj=unconfined_u:system_r:dhcpd_t:s0 key=(null)
Hmmm, I rebooted the system and now I cannot reproduce the problem. It's very strange. I'll close this for now and re-open it if I ever hit the problem again.
This is fixed in the latest RHEL6.2 policies.
Since RHEL 6.2 External Beta has begun, and this bug remains unresolved, it has been rejected as it is not proposed as exception or blocker. Red Hat invites you to ask your support representative to propose this request, if appropriate and relevant, in the next release of Red Hat Enterprise Linux.
*** This bug has been marked as a duplicate of bug 737571 ***