Description of problem: When running the test /CoreOS/freeradius/Regression/bz658508-etc-pam-d-radiusd-uses-non-existent-password-auth the following AVC appear when a radius request is sent to radiusd which suppose to authenticate the user via PAM and shadow password. The radiusd is running as user root and is started via services. type=SYSCALL msg=audit(1345707162.451:5302): arch=c000003e syscall=89 success=no exit=-13 a0=2aae74bc918e a1=433447c0 a2=1000 a3=44d items=0 ppid=1 pid=18258 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=541 comm="radiusd" exe="/usr/sbin/radiusd" subj=root:system_r:radiusd_t:s0 key=(null) type=AVC msg=audit(1345707162.451:5302): avc: denied { ptrace } for pid=18258 comm="radiusd" scontext=root:system_r:radiusd_t:s0 tcontext=root:system_r:radiusd_t:s0 tclass=process Switching the boolean "allow_ptrace" on does not have any effect, the same AVC appear. Version-Release number of selected component (if applicable): selinux-policy-2.4.6-331.el5 selinux-policy-devel-2.4.6-331.el5 selinux-policy-targeted-2.4.6-331.el5 freeradius2-2.1.12-4.el5 freeradius2-utils-2.1.12-4.el5 There are the same result also with older version on selinux-policy. On RHEL6 the same test does work out of the box. How reproducible: always Steps to Reproduce: 1. Run test /CoreOS/freeradius/Regression/bz658508-etc-pam-d-radiusd-uses-non-existent-password-auth 2. Check the AVCs Actual results: denial Expected results: allow
This request was evaluated by Red Hat Product Management for inclusion in a Red Hat Enterprise Linux release. Product Management has requested further review of this request by Red Hat Engineering, for potential inclusion in a Red Hat Enterprise Linux release for currently deployed products. This request is not yet committed for inclusion in a release.
This is the only AVC that appears in permissive mode: ---- time->Thu Aug 23 11:03:35 2012 type=PATH msg=audit(1345712615.872:290): item=0 name="/proc/self/exe" inode=417529864 dev=00:03 mode=0120777 ouid=0 ogid=0 rdev=00:00 obj=root:system_r:radiusd_t:s0 type=CWD msg=audit(1345712615.872:290): cwd="/" type=SYSCALL msg=audit(1345712615.872:290): arch=40000003 syscall=85 success=yes exit=17 a0=a6deae a1=b571dbe7 a2=1000 a3=0 items=1 ppid=1 pid=6376 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=21 comm="radiusd" exe="/usr/sbin/radiusd" subj=root:system_r:radiusd_t:s0 key=(null) type=AVC msg=audit(1345712615.872:290): avc: denied { ptrace } for pid=6376 comm="radiusd" scontext=root:system_r:radiusd_t:s0 tcontext=root:system_r:radiusd_t:s0 tclass=process ----
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2013-0060.html