Bug 833557

Created attachment 593038 [details]
selinux-policy-l2tpd-module.patch

+++ This bug was initially created as a clone of Bug #748724 +++

Description of problem:

When SELinux is enabled, xl2tpd fails to run due to insufficient privileges. It appears there is no SELinux policy shipped with xl2tpd.

Version-Release number of selected component (if applicable):

xl2tpd-1.3.1-1.fc16.x86_64

How reproducible:

Always

Steps to Reproduce:
1. Start xl2tpd
2. Try to set up a tunnel
  
Actual results:

Fails (initially even fails to start up daemon), logs in /var/log/audit/audit.log and /var/log/messages about SELinux blockage.

Expected results:

A ppp0 interface.

Additional info:

--- Additional comment from sb on 2011-10-26 02:34:32 EDT ---

The following policy seems to get xl2tpd into something like a working state (it then fails to start pppd due to lack of legacy PTYs in the kernel):

--
module mypol 1.0;

require {
	type l2tpd_t;
	type ptmx_t;
	type unreserved_port_t;
	type var_run_t;
	class file { read unlink };
	class chr_file { read write ioctl open };
	class udp_socket name_bind;
}

#============= l2tpd_t ==============
allow l2tpd_t ptmx_t:chr_file { read write ioctl open };
allow l2tpd_t unreserved_port_t:udp_socket name_bind;
allow l2tpd_t var_run_t:file { read unlink };
--

--- Additional comment from sb on 2011-10-31 11:36:44 EDT ---

Scratch that last bit about the kernel. It complains about the legacy PTYs because it is falling back to them. In other words, it cannot open a PTY through the regular interface. Definitely SELinux-related, since it works fine if I turn off SELinux completely. No idea what policy lines are needed here, though.

--- Additional comment from paullee0 on 2012-01-24 11:15:24 EST ---

(In reply to comment #0)

I have almost exactly the same problem - xl2tpd-1.3.1-1.fc16.i686

Similar setup in Fedora 8 works without problem.

Jan 24 20:20:35 p320g--f16 xl2tpd[7002]: Connection established to 192.168.0.98, 1701.  Local: 32045, Remote: 1 (ref=0/0).  LNS session is 'default'
Jan 24 20:20:35 p320g--f16 xl2tpd[7002]: getPtyMaster_ptmx: unable to open /dev/ptmx to allocate pty
Jan 24 20:20:35 p320g--f16 xl2tpd[7002]: getPtyMaster: failed to use pts -- using legacy ptys
Jan 24 20:20:35 p320g--f16 xl2tpd[7002]: getPtyMaster_pty: No more free pseudo-tty's
Jan 24 20:20:35 p320g--f16 xl2tpd[7002]: start_pppd: unable to allocate pty, abandoning!    


> Description of problem:
> 
> When SELinux is enabled, xl2tpd fails to run due to insufficient privileges. It
> appears there is no SELinux policy shipped with xl2tpd.
> 
> Version-Release number of selected component (if applicable):
> 
> xl2tpd-1.3.1-1.fc16.x86_64
> 
> How reproducible:
> 
> Always
> 
> Steps to Reproduce:
> 1. Start xl2tpd
> 2. Try to set up a tunnel
> 
> Actual results:
> 
> Fails (initially even fails to start up daemon), logs in
> /var/log/audit/audit.log and /var/log/messages about SELinux blockage.
> 
> Expected results:
> 
> A ppp0 interface.
> 
> Additional info:

--- Additional comment from pwouters on 2012-04-26 16:21:49 EDT ---

note there is a policy in fedora, but not in rhel6

--- Additional comment from mgrepl on 2012-04-27 05:58:25 EDT ---

Then please open a new bug for RHEL6.

--- Additional comment from pwouters on 2012-06-15 18:33:29 EDT ---

dwalsh: has the xl2tpd policy update made it to rhel/epel yet?

--- Additional comment from dwalsh on 2012-06-18 16:46:01 EDT ---

Not in RHEL, did you open a bug requesting it?