Description of problem: OTRS software's perl script not working with SELinux. Version-Release number of selected component (if applicable): * CentOS release 5.8 (Final) * selinux-policy-2.4.6-327.el5 * perl-5.8.8-38.el5_8 * PRODUCT = OTRS; VERSION = 2.3.4; BUILDDATE = Tue Jan 20 21:06:45 CET 2009; BUILDHOST = How reproducible: Just installing these components and activing SELinux, in permissive mode is enough to obtain on /var/log/audit/audit.log the SELinux messages. Steps to Reproduce: 1. 2. 3. Actual results: OTRS perl script not working and audit.log displaying the following messages type=AVC msg=audit(1355144264.091:253901): avc: denied { unix_read unix_write } for pid=8875 comm="index.pl" key=44442410 scontext=root:system_r:httpd_sys_script_t:s0 tcontext=system_u:system_r:httpd_sys_script_t:s0 tclass=shm type=AVC msg=audit(1355144264.091:253901): avc: denied { associate } for pid=8875 comm="index.pl" key=44442410 scontext=root:system_r:httpd_sys_script_t:s0 tcontext=system_u:system_r:httpd_sys_script_t:s0 tclass=shm type=SYSCALL msg=audit(1355144264.091:253901): arch=c000003e syscall=29 success=yes exit=2981895 a0=2a6232a a1=1 a2=3ff a3=12 items=0 ppid=28929 pid=8875 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=23607 comm="index.pl" exe="/usr/bin/perl" subj=root:system_r:httpd_sys_script_t:s0 key=(null) fg Expected results: No to show these messages and OTRS perl script to work on enforcing SELinux mode Additional info: Hope you can help to fix this problem.
Created attachment 660874 [details] sealert output Hoping this info is useful.
Dear Miroslav, could I add some additional information in the way you can review this case? I'd need to solve it for reactivate SELINUX enforcing knowing the perl service will keep working. Thank in advance!
Does it work with local policy?
Hi Miroslav. The local custom policy, managed by means of audit2allow and semodule, worked but I don't know if that's the right way to solve it!
Please, keep this local policy for RHEL5. We are going to fix this issue in RHEL6.