Bug 863407 - SELinux policy doesn't allow freshclam to update through http proxy
SELinux policy doesn't allow freshclam to update through http proxy
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy (Show other bugs)
All Linux
unspecified Severity medium
: rc
: ---
Assigned To: Miroslav Grepl
Michal Trunecka
Depends On: 839191
  Show dependency treegraph
Reported: 2012-10-05 08:08 EDT by Miroslav Grepl
Modified: 2014-09-30 19:33 EDT (History)
6 users (show)

See Also:
Fixed In Version: selinux-policy-3.7.19-168.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 839191
Last Closed: 2013-02-21 03:31:04 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Miroslav Grepl 2012-10-05 08:08:55 EDT
+++ This bug was initially created as a clone of Bug #839191 +++

Created attachment 597483 [details]
Syslog messages

Description of problem:
SELinux policy does not allow freeshclam to update databases through HTTP proxy when run by cron. When it is run manual by an unconfined user, everything is all right. HTTP proxy is set via profile.d shell script.

Version-Release number of selected component (if applicable):

How reproducible:
Install clamav-update, turn on selinux targeted mode, set up proxy and cron clamav updates. Wait for syslog and selinux messages.

Steps to Reproduce:
1. Install clamav-update.
2. Turn on selinux targeted mode.
3. Set up proxy.
4. Set up cron clamav updates.

Actual results:
ClamAV databases update fails

Expected results:
ClamAV databases update completes

Additional info:

--- Additional comment from metanoite@rambler.ru on 2012-07-11 03:47:42 EDT ---

Created attachment 597484 [details]
Sealert message

--- Additional comment from metanoite@rambler.ru on 2012-07-11 03:48:32 EDT ---

Created attachment 597485 [details]
Freshclam configuration

--- Additional comment from metanoite@rambler.ru on 2012-07-11 03:50:25 EDT ---

Created attachment 597486 [details]
SELinux module that allows freshclam proxy connection

--- Additional comment from metanoite@rambler.ru on 2012-07-11 03:57:40 EDT ---

I'm sorry, the version of components are from another computer with Fedora 17.
The actual versions are:

--- Additional comment from mgrepl@redhat.com on 2012-07-11 08:38:48 EDT ---


--- Additional comment from williama_lovaton@coomeva.com.co on 2012-10-03 10:53:15 EDT ---

Hello there,  I have the very same problem with clamav-0.97.5-1.el6.x86_64 in RHEL 6.3 but in my case I setted the proxy parameters in /etc/freshclam.conf using the HTTPProxy* directives.

I got the following entries in audit.log:
type=AVC msg=audit(1349251647.435:43404): avc:  denied  { name_connect } for  pid=6865 comm="freshclam" dest=8080 scontext=system_u:system_r:freshclam_t:s0-s0:c0.c1023 tcontext=system_u:object_r:http_cache_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1349251647.435:43404): arch=c000003e syscall=42 success=no exit=-13 a0=5 a1=17253f0 a2=10 a3=0 items=0 ppid=6863 pid=6865 auid=0 uid=496 gid=492 euid=496 suid=496 fsuid=496 egid=492 sgid=492 fsgid=492 tty=(none) ses=2999 comm="freshclam" exe="/usr/bin/freshclam" subj=system_u:system_r:freshclam_t:s0-s0:c0.c1023 key=(null)

And using the audit2allow tool it generated the following policy:
module freshclam-mypol 1.0;

require {
	type freshclam_t;
	type http_cache_port_t;
	class tcp_socket name_connect;

#============= freshclam_t ==============
allow freshclam_t http_cache_port_t:tcp_socket name_connect;

I still have to wait until tomorrow to confirm if this actually solves the problem.

The affected packages are:

I really hope this gets fixed in RHEL.

Comment 4 errata-xmlrpc 2013-02-21 03:31:04 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.