Additional info: libreport version: 2.0.18 kernel: 3.6.10-2.fc17.x86_64
Created attachment 672065 [details] File: type
Created attachment 672066 [details] File: hashmarkername
Your missing the AVC report?
SELinux is preventing /usr/libexec/nm-l2tp-service from name_bind access on the udp_socket . ***** Plugin catchall (100. confidence) suggests *************************** If вы считаете, что nm-l2tp-service следует разрешить доступ name_bind к udp_socket по умолчанию. Then рекомендуется создать отчет об ошибке. Чтобы разрешить доступ, можно создать локальный модуль политики. Do чтобы разрешить доступ, выполните: # grep nm-l2tp-service /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:NetworkManager_t:s0 Target Context system_u:object_r:l2tp_port_t:s0 Target Objects [ udp_socket ] Source nm-l2tp-service Source Path /usr/libexec/nm-l2tp-service Port 1701 Host localhost.localdomain Source RPM Packages NetworkManager-l2tp-0.9.6-3.fc17.x86_64 Target RPM Packages Policy RPM selinux-policy-3.10.0-161.fc17.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name localhost.localdomain Platform Linux localhost.localdomain 3.6.10-2.fc17.x86_64 #1 SMP Tue Dec 11 18:07:34 UTC 2012 x86_64 x86_64 Alert Count 1 First Seen 2013-01-04 22:39:10 FET Last Seen 2013-01-04 22:39:10 FET Local ID 304e5fc6-1374-420b-8362-0ea00e60fa8d Raw Audit Messages type=AVC msg=audit(1357328350.558:135): avc: denied { name_bind } for pid=8467 comm="nm-l2tp-service" src=1701 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:l2tp_port_t:s0 tclass=udp_socket type=SYSCALL msg=audit(1357328350.558:135): arch=x86_64 syscall=bind success=no exit=EACCES a0=8 a1=7fff2aff6c40 a2=10 a3=0 items=0 ppid=702 pid=8467 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=nm-l2tp-service exe=/usr/libexec/nm-l2tp-service subj=system_u:system_r:NetworkManager_t:s0 key=(null) Hash: nm-l2tp-service,NetworkManager_t,l2tp_port_t,udp_socket,name_bind audit2allow #============= NetworkManager_t ============== allow NetworkManager_t l2tp_port_t:udp_socket name_bind; audit2allow -R #============= NetworkManager_t ============== allow NetworkManager_t l2tp_port_t:udp_socket name_bind;
*** This bug has been marked as a duplicate of bug 891630 ***
*** Bug 901524 has been marked as a duplicate of this bug. ***
This seems to be a different error from 891630, which affects execution of xl2tpd. Besides, it's still affecting selinux-policy-targeted-3.11.1-87
(In reply to comment #7) > Besides, it's still affecting selinux-policy-targeted-3.11.1-87 (on Fedora 18 x86_64. abrt bug reporting fails, apparently getting confused by the chain of CLOSED DUPLICATES from 901524 to here to 891630)
What AVC msgs are you getting?
SELinux is preventing /usr/libexec/nm-l2tp-service from name_bind access on the udp_socket . ***** Plugin catchall (100. confidence) suggests *************************** If you believe that nm-l2tp-service should be allowed name_bind access on the udp_socket by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep nm-l2tp-service /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:NetworkManager_t:s0 Target Context system_u:object_r:l2tp_port_t:s0 Target Objects [ udp_socket ] Source nm-l2tp-service Source Path /usr/libexec/nm-l2tp-service Port 1701 Host verity.localdomain Source RPM Packages NetworkManager-l2tp-0.9.6-2.fc18.x86_64 Target RPM Packages Policy RPM selinux-policy-3.11.1-91.fc18.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name verity.localdomain Platform Linux verity.localdomain 3.8.8-202.fc18.x86_64 #1 SMP Wed Apr 17 23:25:17 UTC 2013 x86_64 x86_64 Alert Count 1 First Seen 2013-04-26 09:10:06 WIT Last Seen 2013-04-26 09:10:06 WIT Local ID 770b58b1-0250-4688-9db4-b0d4009e755a Raw Audit Messages type=AVC msg=audit(1366942206.510:1012): avc: denied { name_bind } for pid=22051 comm="nm-l2tp-service" src=1701 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:l2tp_port_t:s0 tclass=udp_socket type=SYSCALL msg=audit(1366942206.510:1012): arch=x86_64 syscall=bind success=yes exit=0 a0=8 a1=7fffe5bcb370 a2=10 a3=0 items=0 ppid=787 pid=22051 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm=nm-l2tp-service exe=/usr/libexec/nm-l2tp-service subj=system_u:system_r:NetworkManager_t:s0 key=(null) Hash: nm-l2tp-service,NetworkManager_t,l2tp_port_t,udp_socket,name_bind audit2allow #============= NetworkManager_t ============== allow NetworkManager_t l2tp_port_t:udp_socket name_bind; audit2allow -R require { type NetworkManager_t; } #============= NetworkManager_t ============== corenet_udp_bind_l2tp_port(NetworkManager_t)-- Michel Alexandre Salim IT Supervisor RS Mitra Keluarga Group
Ok, could you try to execute # chcon -t l2tpd_exec_t `which nm-l2tp-service` and re-test it. Thank you.
# chcon -t l2tpd_exec_t /usr/libexec/nm-l2tp-service (not in the PATH so which does not work) With that label, l2tp connects just fine - is this a packaging bug with NM-l2tp or something that should be fixed in selinux-policy ?
Great, thank you for testing. commit 7f7eb66d2482070c58963436219dace8141e3e81 Author: Miroslav Grepl <mgrepl> Date: Mon Apr 29 08:49:36 2013 +0200 Add labeling for nm-l2tp-service
selinux-policy-3.11.1-94.fc18 has been submitted as an update for Fedora 18. https://admin.fedoraproject.org/updates/selinux-policy-3.11.1-94.fc18
Package selinux-policy-3.11.1-94.fc18: * should fix your issue, * was pushed to the Fedora 18 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.11.1-94.fc18' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-7743/selinux-policy-3.11.1-94.fc18 then log in and leave karma (feedback).
selinux-policy-3.11.1-95.fc18 has been submitted as an update for Fedora 18. https://admin.fedoraproject.org/updates/selinux-policy-3.11.1-95.fc18
selinux-policy-3.11.1-95.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report.