Bug 765967 - failover socket not created if in reserved port range
failover socket not created if in reserved port range
Product: Fedora
Classification: Fedora
Component: dhcp (Show other bugs)
Unspecified Unspecified
unspecified Severity medium
: ---
: ---
Assigned To: Jiri Popelka
Fedora Extras Quality Assurance
Depends On: 769551
  Show dependency treegraph
Reported: 2011-12-09 14:28 EST by Jeff Bailey
Modified: 2012-01-27 22:31 EST (History)
1 user (show)

See Also:
Fixed In Version: dhcp-4.2.3-6.P2.fc16
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2012-01-27 22:31:54 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Jeff Bailey 2011-12-09 14:28:16 EST
Description of problem:
When configured for failover with the default ports a "netstat -a" doesn't show a socket for the failover port and there is no error logged.  When the failover port is set above 1024, selinux prevents the address binding but with selinux disabled everything is fine.  I'm assuming the failover socket is being created/bound after the capabilities are being dropped but I haven't looked at the code so I can't be sure.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Configure a failover peer
2. Start dhcpd normally using systemd
Actual results:
No listening socket on the failover port

Expected results:
Netstat shows a tcp socket listening on the failover port

Additional info:
Comment 1 Jiri Popelka 2011-12-20 13:02:05 EST
Thanks for the investigation. You are completely right.

In 4.2.3-2 I made a change to write lease file after changing effective user/group ID (so the lease file is owned by dhcpd:dhcpd)
because SELinux doesn't allow dhcpd to change ownership of lease file.
Unfortunately the lease file initialization is followed by the failover protocol initialization which needs root privileges.
So the only solution I can think of is to revert the 4.2.3-2 change and change the SELinux policy, i.e. the same as in bug #737571, comment #12.

Jeff, could you try this scratch-build ? Thanks
(You'll need to temporarily disable SELinux)
Comment 2 Jeff Bailey 2011-12-20 19:27:09 EST
Yes, that seems to fix it.  I get a socket on 647 now and my leases file is root:root instead of dhcpd:dhcpd.
Comment 3 Fedora Update System 2012-01-23 10:28:13 EST
dhcp-4.2.3-6.P2.fc16 has been submitted as an update for Fedora 16.
Comment 4 Fedora Update System 2012-01-23 16:54:31 EST
Package dhcp-4.2.3-6.P2.fc16:
* should fix your issue,
* was pushed to the Fedora 16 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing dhcp-4.2.3-6.P2.fc16'
as soon as you are able to.
Please go to the following url:
then log in and leave karma (feedback).
Comment 5 Fedora Update System 2012-01-27 22:31:54 EST
dhcp-4.2.3-6.P2.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.