A few nagging issues with Aeolus (cloudforms) on Fedora 17... /usr/share/aeolus-conductor/dbomatic/dbomatic is presently mongod_exec_t (no clue why) but should probably just be usr_t. Without this, the following denial is encountered when trying to start the conductor-dbomatic service: type=AVC msg=audit(1340823447.319:83315): avc: denied { read } for pid=27043 comm="dbomatic" path="/usr/bin/ruby" dev="dm-1" ino=406770 scontext=system_u:system_r:mongod_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file /var/log/aeolus-conductor(/.*)? is presently var_log_t but should be thin_log_t instead. Without this, the following denials are encountered when trying to start the aeolus-conductor service: type=AVC msg=audit(1340823574.522:83326): avc: denied { open } for pid=27123 comm="thin" name="thin.log" dev="dm-1" ino=146446 scontext=system_u:system_r:thin_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file type=AVC msg=audit(1340823576.936:83330): avc: denied { open } for pid=27123 comm="thin" name="rails.log" dev="dm-1" ino=146445 scontext=system_u:system_r:thin_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file
I am fixing type=AVC msg=audit(1340823447.319:83315): avc: denied { read } for pid=27043 comm="dbomatic" path="/usr/bin/ruby" dev="dm-1" ino=406770 scontext=system_u:system_r:mongod_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file We added fixes for thin and aeolus-conductor to the latest policy package. Also new changes have been added to aeolus-conductor paclage. Could you install these latest packages and test it. Thank you.
selinux-policy-3.10.0-137.fc17 has been submitted as an update for Fedora 17. https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-137.fc17
Package selinux-policy-3.10.0-137.fc17: * should fix your issue, * was pushed to the Fedora 17 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-137.fc17' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2012-10279/selinux-policy-3.10.0-137.fc17 then log in and leave karma (feedback).
This looks much better than before. There's still one lingering denial (it was being masked before due to dbomatic being unable to exec /usr/bin/ruby). dbomatic can't access /var/log/aeolus-conductor/dbomatic.log: type=AVC msg=audit(1341947534.609:253): avc: denied { open } for pid=4101 comm="dbomatic" name="dbomatic.log" dev="vda2" ino=9318 scontext=system_u:system_r:mongod_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file Should dbomatic run with a separate type from mongod_t? Something like aeolus_dbomatic_t? Then we can label /var/log/aeolus-conductor/dbomatic.log as aeolus_dbomatic_log_t and grant the appropriate access.
chcon -Rt mongod_log_t /var/log/aeolus-conductor
I just checked this fix into F18 policy, Miroslav please back port.
We have /usr/share/aeolus-conductor/dbomatic/dbomatic -- gen_context(system_u:object_r:mongod_exec_t,s0) so i will label it as Dan fixed it in rawhide.
Actually /var/log/aeolus* can not be labeled as mongodb_log_t. We want to have different labeling for /var/log/aeolus-configserver for example.
Fixed in selinux-policy-3.10.0-138.fc17
selinux-policy-3.10.0-137.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.