Bug 743440

Created attachment 526344 [details]
dhcpd.conf example

Description of problem:
After creating an /etc/dhcp/dhcpd.conf file, the service appeared to start, but it silently failed:

[root@termite ~]# service dhcpd start
Starting dhcpd:                                            [  OK  ]
[root@termite ~]# service dhcpd status
dhcpd dead but pid file exists

/var/log/messages contained:
Oct  4 18:00:18 termite setroubleshoot: SELinux is preventing /usr/sbin/dhcpd "setgid" access . For complete SELinux messages. run sealert -l a7a5bbce-91e6-4f74-bfc5-6684adb8ecef

The full sealert text is below.

I created a permissive domain for dhcpd_t and I was able to start the service.

[root@termite ~]# semanage permissive -a dhcpd_t
[root@termite ~]# service dhcpd start
Starting dhcpd:                                            [  OK  ]
[root@termite ~]# service dhcpd status
dhcpd (pid  7658) is running...


Version-Release number of selected component (if applicable):
dhcp-4.1.1-24.P1.el6.x86_64
selinux-policy-3.7.19-93.el6_1.7.noarch

How reproducible:
every time (?)

Steps to Reproduce:
1. create /etc/dhcp/dhcpd.conf (see attached example)
2. service dhcpd start
3. service dhcpd status
4. tail /var/log/messages
  
Actual results:
selinux blocked dhcpd from starting

Expected results:
dhcpd starts and runs

Additional info:
Summary:

SELinux is preventing /usr/sbin/dhcpd "setgid" access .

Detailed Description:

SELinux denied access requested by dhcpd. It is not expected that this access is
required by dhcpd and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug
report.

Additional Information:

Source Context                unconfined_u:system_r:dhcpd_t:s0
Target Context                unconfined_u:system_r:dhcpd_t:s0
Target Objects                None [ capability ]
Source                        dhcpd
Source Path                   /usr/sbin/dhcpd
Port                          <Unknown>
Host                          termite.dfw.redhat.com
Source RPM Packages           dhcp-4.1.1-24.P1.el6
Target RPM Packages           
Policy RPM                    selinux-policy-3.7.19-93.el6_1.7
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     termite.dfw.redhat.com
Platform                      Linux termite.dfw.redhat.com
                              2.6.32-131.6.1.el6.x86_64 #1 SMP Mon Jun 20
                              14:15:38 EDT 2011 x86_64 x86_64
Alert Count                   5
First Seen                    Tue Oct  4 17:36:04 2011
Last Seen                     Tue Oct  4 18:00:13 2011
Local ID                      a7a5bbce-91e6-4f74-bfc5-6684adb8ecef
Line Numbers                  

Raw Audit Messages            

node=termite.dfw.redhat.com type=AVC msg=audit(1317769213.353:220298): avc:  denied  { setgid } for  pid=7446 comm="dhcpd" capability=6  scontext=unconfined_u:system_r:dhcpd_t:s0 tcontext=unconfined_u:system_r:dhcpd_t:s0 tclass=capability

node=termite.dfw.redhat.com type=SYSCALL msg=audit(1317769213.353:220298): arch=c000003e syscall=116 success=no exit=-1 a0=0 a1=0 a2=5 a3=7f7b86c9c240 items=0 ppid=1 pid=7446 auid=12257 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts5 ses=28411 comm="dhcpd" exe="/usr/sbin/dhcpd" subj=unconfined_u:system_r:dhcpd_t:s0 key=(null)