Red Hat Bugzilla – Bug 801909
SELinux is preventing sssd_pam from using the 'sys_resource' capabilities.
Last modified: 2012-07-13 12:34:38 EDT
libreport version: 2.0.8 executable: /usr/bin/python hashmarkername: setroubleshoot kernel: 3.2.9-1.fc16.x86_64 reason: SELinux is preventing sssd_pam from using the 'sys_resource' capabilities. time: Fri 09 Mar 2012 02:46:32 PM EST description: :SELinux is preventing sssd_pam from using the 'sys_resource' capabilities. : :***** Plugin sys_resource (91.4 confidence) suggests *********************** : :If you do not want to get this AVC any longer. These AVC's are caused by running out of resources, usually disk space on your / partition. :Then you must cleanup diskspace or make sure you are not running too many processes. :Do :clear up your disk. : :***** Plugin catchall (9.59 confidence) suggests *************************** : :If you believe that sssd_pam should have the sys_resource capability by default. :Then you should report this as a bug. :You can generate a local policy module to allow this access. :Do :allow this access for now by executing: :# grep sssd_pam /var/log/audit/audit.log | audit2allow -M mypol :# semodule -i mypol.pp : :Additional Information: :Source Context system_u:system_r:sssd_t:s0 :Target Context system_u:system_r:sssd_t:s0 :Target Objects [ capability ] :Source sssd_pam :Source Path sssd_pam :Port <Unknown> :Host (removed) :Source RPM Packages :Target RPM Packages :Policy RPM selinux-policy-3.10.0-75.fc16.noarch :Selinux Enabled True :Policy Type targeted :Enforcing Mode Permissive :Host Name (removed) :Platform Linux (removed) : 3.2.9-1.fc16.x86_64 #1 SMP Thu Mar 1 01:41:10 UTC : 2012 x86_64 x86_64 :Alert Count 30 :First Seen Thu 08 Mar 2012 10:54:59 AM EST :Last Seen Fri 09 Mar 2012 02:02:46 PM EST :Local ID dbb8a682-21b7-4d67-ba31-286e9ff7db54 : :Raw Audit Messages :type=AVC msg=audit(1331319766.414:443): avc: denied { sys_resource } for pid=8971 comm="sssd_pam" capability=24 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:system_r:sssd_t:s0 tclass=capability : : :type=AVC msg=audit(1331319766.414:443): avc: denied { setrlimit } for pid=8971 comm="sssd_pam" scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:system_r:sssd_t:s0 tclass=process : : :Hash: sssd_pam,sssd_t,sssd_t,capability,sys_resource : :audit2allow : :#============= sssd_t ============== :allow sssd_t self:capability sys_resource; :allow sssd_t self:process setrlimit; : :audit2allow -R : :#============= sssd_t ============== :allow sssd_t self:capability sys_resource; :allow sssd_t self:process setrlimit; :
Fixed in selinux-policy-3.10.0-79.fc16 yum -y update.
Yes, it has been fixed in this release. But I have an update for -78.fc16 release. I am going to pull -80.fc16 instead of -78.fc16.
selinux-policy-3.10.0-80.fc16 has been submitted as an update for Fedora 16. https://admin.fedoraproject.org/updates/FEDORA-2012-2733/selinux-policy-3.10.0-80.fc16
Package selinux-policy-3.10.0-80.fc16: * should fix your issue, * was pushed to the Fedora 16 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-80.fc16' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2012-2733/selinux-policy-3.10.0-80.fc16 then log in and leave karma (feedback).
selinux-policy-3.10.0-80.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report.
Ah, you are right. We have it. allow sssd_t sssd_t : process { fork sigchld sigkill signal getsched setsched getcap setfscreate setrlimit } ; So we need to backport it.