RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 879805 - selinux prevents heartbeat/corosync from starting up
Summary: selinux prevents heartbeat/corosync from starting up
Keywords:
Status: CLOSED DUPLICATE of bug 836311
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy
Version: 6.3
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: rc
: ---
Assignee: Miroslav Grepl
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-11-24 15:26 UTC by Christoph Galuschka
Modified: 2012-12-20 14:54 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-11-26 11:06:00 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)

Description Christoph Galuschka 2012-11-24 15:26:11 UTC 
Description of problem:
When running 'service heartbeat start' with SElinux in enforcing mode, the service won't start up. This is independent of the unicast UDP port used in the configuration (either high or low port configuration is affected).
The following entrys are logged in /var/log/audit/audit.log:
>>
type=AVC msg=audit(1353769871.168:27202): avc:  denied  { name_bind } for  pid=3135 comm="heartbeat" src=10333 scontext=unconfined_u:system_r:corosync_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=udp_socket
type=SYSCALL msg=audit(1353769871.168:27202): arch=c000003e syscall=49 success=no exit=-13 a0=7 a1=7fff22015640 a2=10 a3=7fff22015340 items=0 ppid=1 pid=3135 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="heartbeat" exe="/usr/lib64/heartbeat/heartbeat" subj=unconfined_u:system_r:corosync_t:s0 key=(null)
>>

The following entrys are logged in the heartbeat-logfile:
>>
Nov 24 16:12:28 host heartbeat: [3233]: ERROR: glib: ucast: error binding socket. Retrying: Permission denied
Nov 24 16:12:29 host heartbeat: [3233]: ERROR: glib: ucast: unable to bind socket. Giving up: Permission denied
Nov 24 16:12:29 host heartbeat: [3233]: ERROR: make_io_childpair: cannot open ucast eth0
>>

After switching SElinux into permissive, the service starts and adds HA-IPs successfully. The following logs are written to audit.log when activating the HA-IP through heartbeat:
>>
type=AVC msg=audit(1353770144.519:27234): avc:  denied  { net_admin } for  pid=4566 comm="ifconfig" capability=12  scontext=unconfined_u:system_r:corosync_t:s0 tcontext=unconfined_u:system_r:corosync_t:s0 tclass=capability
type=SYSCALL msg=audit(1353770144.519:27234): arch=c000003e syscall=16 success=yes exit=0 a0=8 a1=8916 a2=7fff751f5170 a3=1999999999999999 items=0 ppid=4496 pid=4566 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="ifconfig" exe="/sbin/ifconfig" subj=unconfined_u:system_r:corosync_t:s0 key=(null)
type=AVC msg=audit(1353770144.553:27235): avc:  denied  { create } for  pid=4573 comm="send_arp" scontext=unconfined_u:system_r:corosync_t:s0 tcontext=unconfined_u:system_r:corosync_t:s0 tclass=packet_socket
type=SYSCALL msg=audit(1353770144.553:27235): arch=c000003e syscall=41 success=yes exit=3 a0=11 a1=2 a2=0 a3=7fff869cf9e0 items=0 ppid=4571 pid=4573 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="send_arp" exe="/usr/lib64/heartbeat/send_arp" subj=unconfined_u:system_r:corosync_t:s0 key=(null)
type=AVC msg=audit(1353770144.553:27236): avc:  denied  { ioctl } for  pid=4573 comm="send_arp" path="socket:[23012]" dev=sockfs ino=23012 scontext=unconfined_u:system_r:corosync_t:s0 tcontext=unconfined_u:system_r:corosync_t:s0 tclass=packet_socket
type=SYSCALL msg=audit(1353770144.553:27236): arch=c000003e syscall=16 success=yes exit=0 a0=3 a1=8933 a2=7fff869cfda0 a3=7fff869cf9e0 items=0 ppid=4571 pid=4573 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="send_arp" exe="/usr/lib64/heartbeat/send_arp" subj=unconfined_u:system_r:corosync_t:s0 key=(null)
type=AVC msg=audit(1353770144.554:27237): avc:  denied  { bind } for  pid=4573 comm="send_arp" scontext=unconfined_u:system_r:corosync_t:s0 tcontext=unconfined_u:system_r:corosync_t:s0 tclass=packet_socket
type=SYSCALL msg=audit(1353770144.554:27237): arch=c000003e syscall=49 success=yes exit=0 a0=3 a1=6033c0 a2=14 a3=7fff869cf9e0 items=0 ppid=4571 pid=4573 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="send_arp" exe="/usr/lib64/heartbeat/send_arp" subj=unconfined_u:system_r:corosync_t:s0 key=(null)
type=AVC msg=audit(1353770144.555:27238): avc:  denied  { getattr } for  pid=4573 comm="send_arp" scontext=unconfined_u:system_r:corosync_t:s0 tcontext=unconfined_u:system_r:corosync_t:s0 tclass=packet_socket
type=SYSCALL msg=audit(1353770144.555:27238): arch=c000003e syscall=51 success=yes exit=0 a0=3 a1=6033c0 a2=7fff869cfc98 a3=7fff869cf9e0 items=0 ppid=4571 pid=4573 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="send_arp" exe="/usr/lib64/heartbeat/send_arp" subj=unconfined_u:system_r:corosync_t:s0 key=(null)
>>

Version-Release number of selected component (if applicable):
heartbeat-libs-3.0.4-1.el6.x86_64
heartbeat-3.0.4-1.el6.x86_64
cluster-glue-1.0.5-6.el6.x86_64
cluster-glue-libs-1.0.5-6.el6.x86_64
selinux-policy-3.7.19-155.el6_3.8.noarch
libselinux-python-2.0.94-5.3.el6.x86_64
selinux-policy-targeted-3.7.19-155.el6_3.8.noarch
libselinux-utils-2.0.94-5.3.el6.x86_64
libselinux-2.0.94-5.3.el6.x86_64


How reproducible:
always

Steps to Reproduce:
1. install heartbeat incl. dependencies
2. create configurations from /usr/share/docs/heartbeat-3.0.4/ to /etc/ha.d
3. in ha.cf change communication between nodes to unicast, add nodes/IPs and leave port to default or change to high port
4. try to run 'service heartbeat start'
  
Actual results:
startup of service failes

Expected results:
startup of service succeeds

Additional info:
Comment 2 Christoph Galuschka 2012-11-24 15:49:13 UTC 
sorry, something went wrong while posting this bug
Comment 3 Christoph Galuschka 2012-11-24 15:53:19 UTC 
please mark as duplicate of 879806 and close
Comment 4 Miroslav Grepl 2012-11-26 11:06:00 UTC 

*** This bug has been marked as a duplicate of bug 836311 ***
Note You need to log in before you can comment on or make changes to this bug.