Bug 885713 - SELinux is preventing index.pl (httpd_sys_script_t) "read" to <Desconocido> (httpd_sys_script_t)
SELinux is preventing index.pl (httpd_sys_script_t) "read" to <Desconocido> (...
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: selinux-policy (Show other bugs)
x86_64 Linux
unspecified Severity urgent
: rc
: ---
Assigned To: Miroslav Grepl
BaseOS QE Security Team
Depends On:
  Show dependency treegraph
Reported: 2012-12-10 08:15 EST by Miguel González Laredo
Modified: 2013-03-25 06:02 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2013-03-25 06:02:30 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
sealert output (2.62 KB, text/plain)
2012-12-10 08:40 EST, Miguel González Laredo
no flags Details

  None (edit)
Description Miguel González Laredo 2012-12-10 08:15:50 EST
Description of problem: OTRS software's perl script not working with SELinux. 

Version-Release number of selected component (if applicable): 
 * CentOS release 5.8 (Final)
 * selinux-policy-2.4.6-327.el5
 * perl-5.8.8-38.el5_8
 * PRODUCT = OTRS; VERSION = 2.3.4; BUILDDATE = Tue Jan 20 21:06:45 CET 2009; BUILDHOST = 

How reproducible: Just installing these components and activing SELinux, in permissive mode is enough to obtain on /var/log/audit/audit.log the SELinux messages.

Steps to Reproduce:
Actual results: 

OTRS perl script not working and audit.log displaying the following messages

type=AVC msg=audit(1355144264.091:253901): avc:  denied  { unix_read unix_write } for  pid=8875 comm="index.pl" key=44442410 scontext=root:system_r:httpd_sys_script_t:s0 tcontext=system_u:system_r:httpd_sys_script_t:s0 tclass=shm

type=AVC msg=audit(1355144264.091:253901): avc:  denied  { associate } for  pid=8875 comm="index.pl" key=44442410 scontext=root:system_r:httpd_sys_script_t:s0 tcontext=system_u:system_r:httpd_sys_script_t:s0 tclass=shm

type=SYSCALL msg=audit(1355144264.091:253901): arch=c000003e syscall=29 success=yes exit=2981895 a0=2a6232a a1=1 a2=3ff a3=12 items=0 ppid=28929 pid=8875 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=23607 comm="index.pl" exe="/usr/bin/perl" subj=root:system_r:httpd_sys_script_t:s0 key=(null)

Expected results: No to show these messages and OTRS perl script to work on enforcing SELinux mode

Additional info: Hope you can help to fix this problem.
Comment 1 Miguel González Laredo 2012-12-10 08:40:05 EST
Created attachment 660874 [details]
sealert output

Hoping this info is useful.
Comment 2 Miguel González Laredo 2013-01-16 03:09:47 EST
Dear Miroslav,

 could I add some additional information in the way you can review this case? I'd need to solve it for reactivate SELINUX enforcing knowing the perl service will keep working. 

Thank in advance!
Comment 3 Miroslav Grepl 2013-03-19 10:54:12 EDT
Does it work with local policy?
Comment 4 Miguel González Laredo 2013-03-22 08:32:51 EDT
Hi Miroslav. The local custom policy, managed by means of audit2allow and semodule, worked but I don't know if that's the right way to solve it!
Comment 5 Miroslav Grepl 2013-03-25 06:02:30 EDT
Please, keep this local policy for RHEL5. We are going to fix this issue in RHEL6.

Note You need to log in before you can comment on or make changes to this bug.