Created attachment 593038 [details] selinux-policy-l2tpd-module.patch +++ This bug was initially created as a clone of Bug #748724 +++ Description of problem: When SELinux is enabled, xl2tpd fails to run due to insufficient privileges. It appears there is no SELinux policy shipped with xl2tpd. Version-Release number of selected component (if applicable): xl2tpd-1.3.1-1.fc16.x86_64 How reproducible: Always Steps to Reproduce: 1. Start xl2tpd 2. Try to set up a tunnel Actual results: Fails (initially even fails to start up daemon), logs in /var/log/audit/audit.log and /var/log/messages about SELinux blockage. Expected results: A ppp0 interface. Additional info: --- Additional comment from sb on 2011-10-26 02:34:32 EDT --- The following policy seems to get xl2tpd into something like a working state (it then fails to start pppd due to lack of legacy PTYs in the kernel): -- module mypol 1.0; require { type l2tpd_t; type ptmx_t; type unreserved_port_t; type var_run_t; class file { read unlink }; class chr_file { read write ioctl open }; class udp_socket name_bind; } #============= l2tpd_t ============== allow l2tpd_t ptmx_t:chr_file { read write ioctl open }; allow l2tpd_t unreserved_port_t:udp_socket name_bind; allow l2tpd_t var_run_t:file { read unlink }; -- --- Additional comment from sb on 2011-10-31 11:36:44 EDT --- Scratch that last bit about the kernel. It complains about the legacy PTYs because it is falling back to them. In other words, it cannot open a PTY through the regular interface. Definitely SELinux-related, since it works fine if I turn off SELinux completely. No idea what policy lines are needed here, though. --- Additional comment from paullee0 on 2012-01-24 11:15:24 EST --- (In reply to comment #0) I have almost exactly the same problem - xl2tpd-1.3.1-1.fc16.i686 Similar setup in Fedora 8 works without problem. Jan 24 20:20:35 p320g--f16 xl2tpd[7002]: Connection established to 192.168.0.98, 1701. Local: 32045, Remote: 1 (ref=0/0). LNS session is 'default' Jan 24 20:20:35 p320g--f16 xl2tpd[7002]: getPtyMaster_ptmx: unable to open /dev/ptmx to allocate pty Jan 24 20:20:35 p320g--f16 xl2tpd[7002]: getPtyMaster: failed to use pts -- using legacy ptys Jan 24 20:20:35 p320g--f16 xl2tpd[7002]: getPtyMaster_pty: No more free pseudo-tty's Jan 24 20:20:35 p320g--f16 xl2tpd[7002]: start_pppd: unable to allocate pty, abandoning! > Description of problem: > > When SELinux is enabled, xl2tpd fails to run due to insufficient privileges. It > appears there is no SELinux policy shipped with xl2tpd. > > Version-Release number of selected component (if applicable): > > xl2tpd-1.3.1-1.fc16.x86_64 > > How reproducible: > > Always > > Steps to Reproduce: > 1. Start xl2tpd > 2. Try to set up a tunnel > > Actual results: > > Fails (initially even fails to start up daemon), logs in > /var/log/audit/audit.log and /var/log/messages about SELinux blockage. > > Expected results: > > A ppp0 interface. > > Additional info: --- Additional comment from pwouters on 2012-04-26 16:21:49 EDT --- note there is a policy in fedora, but not in rhel6 --- Additional comment from mgrepl on 2012-04-27 05:58:25 EDT --- Then please open a new bug for RHEL6. --- Additional comment from pwouters on 2012-06-15 18:33:29 EDT --- dwalsh: has the xl2tpd policy update made it to rhel/epel yet? --- Additional comment from dwalsh on 2012-06-18 16:46:01 EDT --- Not in RHEL, did you open a bug requesting it?
Created attachment 593039 [details] selinux-policy-l2tpd-module.patch selinux-policy-l2tpd-module.patch
Created attachment 593040 [details] selinux-policy-l2tpd-support.patch (fixed) selinux-policy-l2tpd-support.patch
I see it running as initrc_t.
This request was not resolved in time for the current release. Red Hat invites you to ask your support representative to propose this request, if still desired, for consideration in the next release of Red Hat Enterprise Linux.
This request was erroneously removed from consideration in Red Hat Enterprise Linux 6.4, which is currently under development. This request will be evaluated for inclusion in Red Hat Enterprise Linux 6.4.
Fixed in selinux-policy-3.7.19-160.el6
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2013-0314.html