Bugzilla (bugzilla.redhat.com) will be under maintenance for infrastructure upgrades and will not be available on July 31st between 12:30 AM - 05:30 AM UTC. We appreciate your understanding and patience. You can follow status.redhat.com for details.
Bug 885713 - SELinux is preventing index.pl (httpd_sys_script_t) "read" to <Desconocido> (httpd_sys_script_t)
Summary: SELinux is preventing index.pl (httpd_sys_script_t) "read" to <Desconocido> (...
Keywords:
Status: CLOSED NEXTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: selinux-policy
Version: 5.8
Hardware: x86_64
OS: Linux
unspecified
urgent
Target Milestone: rc
: ---
Assignee: Miroslav Grepl
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-12-10 13:15 UTC by Miguel González Laredo
Modified: 2013-03-25 10:02 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-03-25 10:02:30 UTC
Target Upstream Version:


Attachments (Terms of Use)
sealert output (2.62 KB, text/plain)
2012-12-10 13:40 UTC, Miguel González Laredo
no flags Details

Description Miguel González Laredo 2012-12-10 13:15:50 UTC
Description of problem: OTRS software's perl script not working with SELinux. 


Version-Release number of selected component (if applicable): 
 
 * CentOS release 5.8 (Final)
 * selinux-policy-2.4.6-327.el5
 * perl-5.8.8-38.el5_8
 * PRODUCT = OTRS; VERSION = 2.3.4; BUILDDATE = Tue Jan 20 21:06:45 CET 2009; BUILDHOST = 


How reproducible: Just installing these components and activing SELinux, in permissive mode is enough to obtain on /var/log/audit/audit.log the SELinux messages.


Steps to Reproduce:
1.
2.
3.
  
Actual results: 

OTRS perl script not working and audit.log displaying the following messages

type=AVC msg=audit(1355144264.091:253901): avc:  denied  { unix_read unix_write } for  pid=8875 comm="index.pl" key=44442410 scontext=root:system_r:httpd_sys_script_t:s0 tcontext=system_u:system_r:httpd_sys_script_t:s0 tclass=shm

type=AVC msg=audit(1355144264.091:253901): avc:  denied  { associate } for  pid=8875 comm="index.pl" key=44442410 scontext=root:system_r:httpd_sys_script_t:s0 tcontext=system_u:system_r:httpd_sys_script_t:s0 tclass=shm

type=SYSCALL msg=audit(1355144264.091:253901): arch=c000003e syscall=29 success=yes exit=2981895 a0=2a6232a a1=1 a2=3ff a3=12 items=0 ppid=28929 pid=8875 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=23607 comm="index.pl" exe="/usr/bin/perl" subj=root:system_r:httpd_sys_script_t:s0 key=(null)
fg


Expected results: No to show these messages and OTRS perl script to work on enforcing SELinux mode


Additional info: Hope you can help to fix this problem.

Comment 1 Miguel González Laredo 2012-12-10 13:40:05 UTC
Created attachment 660874 [details]
sealert output

Hoping this info is useful.

Comment 2 Miguel González Laredo 2013-01-16 08:09:47 UTC
Dear Miroslav,

 could I add some additional information in the way you can review this case? I'd need to solve it for reactivate SELINUX enforcing knowing the perl service will keep working. 

Thank in advance!

Comment 3 Miroslav Grepl 2013-03-19 14:54:12 UTC
Does it work with local policy?

Comment 4 Miguel González Laredo 2013-03-22 12:32:51 UTC
Hi Miroslav. The local custom policy, managed by means of audit2allow and semodule, worked but I don't know if that's the right way to solve it!

Comment 5 Miroslav Grepl 2013-03-25 10:02:30 UTC
Please, keep this local policy for RHEL5. We are going to fix this issue in RHEL6.


Note You need to log in before you can comment on or make changes to this bug.