Description of problem: When strongswan makes an IKEv2 connection, selinux warns during iptables rule insertion. SELinux is preventing /usr/sbin/xtables-multi from 'read' accesses on the chr_file /dev/random. ***** Plugin catchall (100. confidence) suggests *************************** If you believe that xtables-multi should be allowed read access on the random chr_file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep iptables /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:iptables_t:s0 Target Context system_u:object_r:random_device_t:s0 Target Objects /dev/random [ chr_file ] Source iptables Source Path /usr/sbin/xtables-multi Port <Unknown> Host (removed) Source RPM Packages iptables-1.4.16.2-5.fc18.x86_64 Target RPM Packages Policy RPM selinux-policy-3.11.1-67.fc18.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 3.7.2-204.fc18.x86_64 #1 SMP Wed Jan 16 16:22:52 UTC 2013 x86_64 x86_64 Alert Count 420 First Seen 2013-01-21 08:47:40 EST Last Seen 2013-01-24 08:11:35 EST Local ID 463f5b00-7fa2-4d69-b519-755dea0aeddc Raw Audit Messages type=AVC msg=audit(1359033095.373:4277): avc: denied { read } for pid=4514 comm="iptables" path="/dev/random" dev="devtmpfs" ino=1032 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:random_device_t:s0 tclass=chr_file type=AVC msg=audit(1359033095.373:4277): avc: denied { write } for pid=4514 comm="iptables" path="/run/charon.pid" dev="tmpfs" ino=5569639 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file type=SYSCALL msg=audit(1359033095.373:4277): arch=x86_64 syscall=execve success=yes exit=0 a0=1bfba30 a1=1bdd3f0 a2=1be9db0 a3=c8 items=0 ppid=4503 pid=4514 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm=iptables exe=/usr/sbin/xtables-multi subj=system_u:system_r:iptables_t:s0 key=(null) Hash: iptables,iptables_t,random_device_t,chr_file,read audit2allow #============= iptables_t ============== allow iptables_t initrc_var_run_t:file write; #!!!! This avc can be allowed using the boolean 'authlogin_nsswitch_use_ldap' allow iptables_t random_device_t:chr_file read; audit2allow -R #============= iptables_t ============== allow iptables_t initrc_var_run_t:file write; #!!!! This avc can be allowed using the boolean 'authlogin_nsswitch_use_ldap' allow iptables_t random_device_t:chr_file read; Additional info: hashmarkername: setroubleshoot kernel: 3.7.2-204.fc18.x86_64 type: libreport
type=AVC msg=audit(1359033095.373:4277): avc: denied { write } for pid=4514 comm="iptables" path="/run/charon.pid" dev="tmpfs" ino=5569639 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file This is a leak. What is "/run/charon.pid"? I mean which service creates this pid file?
Charon is the IKEv1 and IKEv2 daemon for Strongswan. (http://www.strongswan.org/). The SElinux warning pops up right after a new IKEv2 connection has been made.
I guess we should label this stuff the same as we do for openswan? grep ipsec /etc/selinux/targeted/contexts/files/file_contexts /etc/racoon(/.*)? system_u:object_r:ipsec_conf_file_t:s0 /var/racoon(/.*)? system_u:object_r:ipsec_var_run_t:s0 /etc/ipsec\.d(/.*)? system_u:object_r:ipsec_key_file_t:s0 /var/run/pluto(/.*)? system_u:object_r:ipsec_var_run_t:s0 /usr/lib/ipsec/.* -- system_u:object_r:bin_t:s0 /etc/racoon/certs(/.*)? system_u:object_r:ipsec_key_file_t:s0 /etc/ipsec\.d/examples(/.*)? system_u:object_r:etc_t:s0 /etc/ipsec\.conf -- system_u:object_r:ipsec_conf_file_t:s0 /usr/sbin/ipsec -- system_u:object_r:ipsec_mgmt_exec_t:s0 /etc/ipsec\.secrets -- system_u:object_r:ipsec_key_file_t:s0 /usr/lib/ipsec/spi -- system_u:object_r:ipsec_exec_t:s0 /var/log/pluto\.log -- system_u:object_r:ipsec_log_t:s0 /etc/racoon/psk\.txt -- system_u:object_r:ipsec_key_file_t:s0 /var/run/racoon\.pid -- system_u:object_r:ipsec_var_run_t:s0 /usr/lib/ipsec/pluto -- system_u:object_r:ipsec_exec_t:s0 /usr/lib/ipsec/eroute -- system_u:object_r:ipsec_exec_t:s0 /etc/rc\.d/init\.d/ipsec -- system_u:object_r:ipsec_initrc_exec_t:s0 /usr/libexec/ipsec/spi -- system_u:object_r:ipsec_exec_t:s0 /var/lock/subsys/ipsec -- system_u:object_r:ipsec_mgmt_lock_t:s0 /etc/rc\.d/init\.d/racoon -- system_u:object_r:ipsec_initrc_exec_t:s0 /usr/lib/ipsec/_plutorun -- system_u:object_r:ipsec_mgmt_exec_t:s0 /usr/libexec/ipsec/pluto -- system_u:object_r:ipsec_exec_t:s0 /usr/lib/ipsec/_plutoload -- system_u:object_r:ipsec_mgmt_exec_t:s0 /usr/lib/ipsec/klipsdebug -- system_u:object_r:ipsec_exec_t:s0 /usr/libexec/ipsec/eroute -- system_u:object_r:ipsec_exec_t:s0 /usr/libexec/ipsec/_plutorun -- system_u:object_r:ipsec_mgmt_exec_t:s0 /usr/libexec/ipsec/_plutoload -- system_u:object_r:ipsec_mgmt_exec_t:s0 /usr/libexec/ipsec/klipsdebug -- system_u:object_r:ipsec_exec_t:s0 /usr/libexec/nm-openswan-service -- system_u:object_r:ipsec_mgmt_exec_t:s0 /etc/sysconfig/network-scripts/ifup-ipsec -- system_u:object_r:initrc_exec_t:s0 What paths are associated with strongswan.
I'm definitely not the expert here, but I have attached a filelist (strongswan-5.0.0-3.git20120619.fc18.x86_64.filelist.txt) from the FC18 Strongswan RPM (strongswan-5.0.0-3.git20120619.fc18.x86_64).
Created attachment 687501 [details] File list from FC18 strongswan package.
I added fixes. commit 82ff015a654202c0e9f6b2a48ba2c52c9cc5c473 Author: Miroslav Grepl <mgrepl> Date: Mon Jan 28 11:06:29 2013 +0100 Add labeling for strongswan
selinux-policy-3.11.1-74.fc18 has been submitted as an update for Fedora 18. https://admin.fedoraproject.org/updates/selinux-policy-3.11.1-74.fc18
Package selinux-policy-3.11.1-74.fc18: * should fix your issue, * was pushed to the Fedora 18 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.11.1-74.fc18' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-1693/selinux-policy-3.11.1-74.fc18 then log in and leave karma (feedback).
selinux-policy-3.11.1-74.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report.
Hey everyone, sorry to say I am still seeing this. Any time I restart the strongswan service, I get the following two denied entries: type=AVC msg=audit(1361196699.367:831): avc: denied { read } for pid=4066 comm="iptables" path="/dev/random" dev="devtmpfs" ino=1032 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:random_device_t:s0 tclass=chr_file type=AVC msg=audit(1361196699.367:831): avc: denied { write } for pid=4066 comm="iptables" path="/run/charon.pid" dev="tmpfs" ino=928464 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file I have the latest version of the selinux-policy: selinux-policy-3.11.1-78.fc18.noarch
Is this the entire AVC message? I think there are leaks from strongswan. ausearch -m avc -i -ts recent To get the all parts of the avc message.
Here you go. This is from a restart of strongswan, so might have messages from the shutdown as well. ---- type=SYSCALL msg=audit(02/18/2013 10:48:22.171:1126) : arch=x86_64 syscall=execve success=yes exit=0 a0=0x1d1b750 a1=0x1cfd3f0 a2=0x1d09db0 a3=0xc0 items=0 ppid=5762 pid=5775 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root ses=unset tty=(none) comm=iptables exe=/usr/sbin/xtables-multi subj=system_u:system_r:iptables_t:s0 key=(null) type=AVC msg=audit(02/18/2013 10:48:22.171:1126) : avc: denied { read } for pid=5775 comm=iptables path=/dev/random dev="devtmpfs" ino=1032 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:random_device_t:s0 tclass=chr_file ---- type=SYSCALL msg=audit(02/18/2013 10:48:22.178:1128) : arch=x86_64 syscall=execve success=yes exit=0 a0=0x1d1adf0 a1=0x1cfd3f0 a2=0x1d09db0 a3=0xc0 items=0 ppid=5762 pid=5776 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root ses=unset tty=(none) comm=iptables exe=/usr/sbin/xtables-multi subj=system_u:system_r:iptables_t:s0 key=(null) type=AVC msg=audit(02/18/2013 10:48:22.178:1128) : avc: denied { read } for pid=5776 comm=iptables path=/dev/random dev="devtmpfs" ino=1032 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:random_device_t:s0 tclass=chr_file ---- type=SYSCALL msg=audit(02/18/2013 10:48:22.180:1130) : arch=x86_64 syscall=execve success=yes exit=0 a0=0x1d1b410 a1=0x1cfd3f0 a2=0x1d09db0 a3=0xc0 items=0 ppid=5762 pid=5777 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root ses=unset tty=(none) comm=iptables exe=/usr/sbin/xtables-multi subj=system_u:system_r:iptables_t:s0 key=(null) type=AVC msg=audit(02/18/2013 10:48:22.180:1130) : avc: denied { read } for pid=5777 comm=iptables path=/dev/random dev="devtmpfs" ino=1032 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:random_device_t:s0 tclass=chr_file ---- type=SYSCALL msg=audit(02/18/2013 10:48:22.181:1132) : arch=x86_64 syscall=execve success=yes exit=0 a0=0x1d1b990 a1=0x1cfd3f0 a2=0x1d09db0 a3=0xc0 items=0 ppid=5762 pid=5778 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root ses=unset tty=(none) comm=iptables exe=/usr/sbin/xtables-multi subj=system_u:system_r:iptables_t:s0 key=(null) type=AVC msg=audit(02/18/2013 10:48:22.181:1132) : avc: denied { read } for pid=5778 comm=iptables path=/dev/random dev="devtmpfs" ino=1032 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:random_device_t:s0 tclass=chr_file ---- type=SYSCALL msg=audit(02/18/2013 10:48:22.572:1152) : arch=x86_64 syscall=execve success=yes exit=0 a0=0x24ab790 a1=0x248d3f0 a2=0x2499db0 a3=0xc8 items=0 ppid=5841 pid=5850 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root ses=unset tty=(none) comm=iptables exe=/usr/sbin/xtables-multi subj=system_u:system_r:iptables_t:s0 key=(null) type=AVC msg=audit(02/18/2013 10:48:22.572:1152) : avc: denied { write } for pid=5850 comm=iptables path=/run/charon.pid dev="tmpfs" ino=3168043 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file type=AVC msg=audit(02/18/2013 10:48:22.572:1152) : avc: denied { read } for pid=5850 comm=iptables path=/dev/random dev="devtmpfs" ino=1032 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:random_device_t:s0 tclass=chr_file ---- type=SYSCALL msg=audit(02/18/2013 10:48:22.574:1154) : arch=x86_64 syscall=execve success=yes exit=0 a0=0x24aadf0 a1=0x248d3f0 a2=0x2499db0 a3=0xc8 items=0 ppid=5841 pid=5851 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root ses=unset tty=(none) comm=iptables exe=/usr/sbin/xtables-multi subj=system_u:system_r:iptables_t:s0 key=(null) type=AVC msg=audit(02/18/2013 10:48:22.574:1154) : avc: denied { write } for pid=5851 comm=iptables path=/run/charon.pid dev="tmpfs" ino=3168043 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file type=AVC msg=audit(02/18/2013 10:48:22.574:1154) : avc: denied { read } for pid=5851 comm=iptables path=/dev/random dev="devtmpfs" ino=1032 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:random_device_t:s0 tclass=chr_file ---- type=SYSCALL msg=audit(02/18/2013 10:48:22.576:1156) : arch=x86_64 syscall=execve success=yes exit=0 a0=0x24ab450 a1=0x248d3f0 a2=0x2499db0 a3=0xc8 items=0 ppid=5841 pid=5852 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root ses=unset tty=(none) comm=iptables exe=/usr/sbin/xtables-multi subj=system_u:system_r:iptables_t:s0 key=(null) type=AVC msg=audit(02/18/2013 10:48:22.576:1156) : avc: denied { write } for pid=5852 comm=iptables path=/run/charon.pid dev="tmpfs" ino=3168043 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file type=AVC msg=audit(02/18/2013 10:48:22.576:1156) : avc: denied { read } for pid=5852 comm=iptables path=/dev/random dev="devtmpfs" ino=1032 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:random_device_t:s0 tclass=chr_file ---- type=SYSCALL msg=audit(02/18/2013 10:48:22.578:1158) : arch=x86_64 syscall=execve success=yes exit=0 a0=0x24aba30 a1=0x248d3f0 a2=0x2499db0 a3=0xc8 items=0 ppid=5841 pid=5853 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root ses=unset tty=(none) comm=iptables exe=/usr/sbin/xtables-multi subj=system_u:system_r:iptables_t:s0 key=(null) type=AVC msg=audit(02/18/2013 10:48:22.578:1158) : avc: denied { write } for pid=5853 comm=iptables path=/run/charon.pid dev="tmpfs" ino=3168043 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file type=AVC msg=audit(02/18/2013 10:48:22.578:1158) : avc: denied { read } for pid=5853 comm=iptables path=/dev/random dev="devtmpfs" ino=1032 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:random_device_t:s0 tclass=chr_file
As I expected these are leaks from stongswan. It needs to close the file descriptors on exec. fcntl(fd, F_SETFD, FD_CLOEXEC) For /dev/random and /run/chron.pid You might be able to do this in the open call also.
This message is a reminder that Fedora 18 is nearing its end of life. Approximately 4 (four) weeks from now Fedora will stop maintaining and issuing updates for Fedora 18. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as WONTFIX if it remains open with a Fedora 'version' of '18'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version prior to Fedora 18's end of life. Thank you for reporting this issue and we are sorry that we may not be able to fix it before Fedora 18 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior to Fedora 18's end of life. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete.
This bug still exists in Fedora 20: SELinux is preventing /usr/sbin/xtables-multi from read access on the chr_file /dev/random. ***** Plugin catchall_boolean (89.3 confidence) suggests ****************** If desea allow authlogin to nsswitch use ldap Then usted debe decir a SELinux sobre esto habilitando el booleano 'authlogin_nsswitch_use_ldap'. Puede leer la página man de 'None' para más detalles. Do setsebool -P authlogin_nsswitch_use_ldap 1 ***** Plugin catchall (11.6 confidence) suggests ************************** If cree que de manera predeterminada, xtables-multi debería permitir acceso read sobre random chr_file. Then debería reportar esto como un error. Puede generar un módulo de política local para permitir este acceso. Do permita el acceso momentáneamente executando: # grep iptables /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:iptables_t:s0 Target Context system_u:object_r:random_device_t:s0 Target Objects /dev/random [ chr_file ] Source iptables Source Path /usr/sbin/xtables-multi Port <Unknown> Host <removed> Source RPM Packages iptables-1.4.19.1-1.fc20.x86_64 Target RPM Packages Policy RPM selinux-policy-3.12.1-106.fc20.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name <removed> Platform Linux <removed> 3.12.6-300.fc20.x86_64 #1 SMP Mon Dec 23 16:44:31 UTC 2013 x86_64 x86_64 Alert Count 2414 First Seen 2013-12-20 13:40:23 CET Last Seen 2014-01-13 11:32:32 CET Local ID c0717df6-c523-44f6-91aa-09c12e9c48fb Raw Audit Messages type=AVC msg=audit(1389609152.118:17154): avc: denied { read } for pid=17940 comm="iptables" path="/dev/random" dev="devtmpfs" ino=5008 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:random_device_t:s0 tclass=chr_file type=AVC msg=audit(1389609152.118:17154): avc: denied { write } for pid=17940 comm="iptables" path="/run/charon.pid" dev="tmpfs" ino=2441891 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:ipsec_var_run_t:s0 tclass=file type=SYSCALL msg=audit(1389609152.118:17154): arch=x86_64 syscall=execve success=yes exit=0 a0=2652790 a1=2652910 a2=2640680 a3=7fffb85d6b80 items=0 ppid=17931 pid=17940 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm=iptables exe=/usr/sbin/xtables-multi subj=system_u:system_r:iptables_t:s0 key=(null) Hash: iptables,iptables_t,random_device_t,chr_file,read -------------------------- # ausearch -m avc -i -ts recent ---- type=SYSCALL msg=audit(13/01/14 11:32:26.933:17144) : arch=x86_64 syscall=execve success=yes exit=0 a0=0x2676e40 a1=0x26778b0 a2=0x2665680 a3=0x7fff033c9990 items=0 ppid=17874 pid=17882 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root ses=unset tty=(none) comm=iptables exe=/usr/sbin/xtables-multi subj=system_u:system_r:iptables_t:s0 key=(null) type=AVC msg=audit(13/01/14 11:32:26.933:17144) : avc: denied { write } for pid=17882 comm=iptables path=/run/charon.pid dev="tmpfs" ino=2441891 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:ipsec_var_run_t:s0 tclass=file type=AVC msg=audit(13/01/14 11:32:26.933:17144) : avc: denied { read } for pid=17882 comm=iptables path=/dev/random dev="devtmpfs" ino=5008 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:random_device_t:s0 tclass=chr_file ---- type=SYSCALL msg=audit(13/01/14 11:32:27.089:17146) : arch=x86_64 syscall=execve success=yes exit=0 a0=0x2677810 a1=0x2677990 a2=0x2665680 a3=0x7fff033c99b0 items=0 ppid=17874 pid=17889 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root ses=unset tty=(none) comm=iptables exe=/usr/sbin/xtables-multi subj=system_u:system_r:iptables_t:s0 key=(null) type=AVC msg=audit(13/01/14 11:32:27.089:17146) : avc: denied { write } for pid=17889 comm=iptables path=/run/charon.pid dev="tmpfs" ino=2441891 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:ipsec_var_run_t:s0 tclass=file type=AVC msg=audit(13/01/14 11:32:27.089:17146) : avc: denied { read } for pid=17889 comm=iptables path=/dev/random dev="devtmpfs" ino=5008 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:random_device_t:s0 tclass=chr_file ---- type=SYSCALL msg=audit(13/01/14 11:32:32.102:17152) : arch=x86_64 syscall=execve success=yes exit=0 a0=0x2651e00 a1=0x2652830 a2=0x2640680 a3=0x7fffb85d6b60 items=0 ppid=17931 pid=17939 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root ses=unset tty=(none) comm=iptables exe=/usr/sbin/xtables-multi subj=system_u:system_r:iptables_t:s0 key=(null) type=AVC msg=audit(13/01/14 11:32:32.102:17152) : avc: denied { write } for pid=17939 comm=iptables path=/run/charon.pid dev="tmpfs" ino=2441891 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:ipsec_var_run_t:s0 tclass=file type=AVC msg=audit(13/01/14 11:32:32.102:17152) : avc: denied { read } for pid=17939 comm=iptables path=/dev/random dev="devtmpfs" ino=5008 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:random_device_t:s0 tclass=chr_file ---- type=SYSCALL msg=audit(13/01/14 11:32:32.118:17154) : arch=x86_64 syscall=execve success=yes exit=0 a0=0x2652790 a1=0x2652910 a2=0x2640680 a3=0x7fffb85d6b80 items=0 ppid=17931 pid=17940 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root ses=unset tty=(none) comm=iptables exe=/usr/sbin/xtables-multi subj=system_u:system_r:iptables_t:s0 key=(null) type=AVC msg=audit(13/01/14 11:32:32.118:17154) : avc: denied { write } for pid=17940 comm=iptables path=/run/charon.pid dev="tmpfs" ino=2441891 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:ipsec_var_run_t:s0 tclass=file type=AVC msg=audit(13/01/14 11:32:32.118:17154) : avc: denied { read } for pid=17940 comm=iptables path=/dev/random dev="devtmpfs" ino=5008 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:random_device_t:s0 tclass=chr_file
Thanks for keeping the report up to date. Reported upstream: http://wiki.strongswan.org/issues/519
Fixed in rawhide. Submitted patch upstream.
strongswan-5.1.2-1.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/strongswan-5.1.2-1.fc20
Package strongswan-5.1.2-1.fc20: * should fix your issue, * was pushed to the Fedora 20 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing strongswan-5.1.2-1.fc20' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2014-3924/strongswan-5.1.2-1.fc20 then log in and leave karma (feedback).
Package strongswan-5.1.2-4.fc20: * should fix your issue, * was pushed to the Fedora 20 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing strongswan-5.1.2-4.fc20' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2014-3924/strongswan-5.1.2-4.fc20 then log in and leave karma (feedback).
strongswan-5.1.2-4.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.